cve/.github/workflows/hot_cves.yml

name: Hot CVEs List

on:
  workflow_dispatch:

permissions:
  contents: write
  actions: write

concurrency:
  group: repository-updates
  queue: max
  cancel-in-progress: false

jobs:
  ScheduledRun:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      PYTHONUNBUFFERED: '1'
    steps:
      - name: Start the job clock
        run: echo "JOB_STARTED=$(date +%s)" >> "$GITHUB_ENV"

      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: main

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.13'

      - name: Publish saved candidates and refresh pending CVE metadata
        id: pending
        continue-on-error: true
        run: python3 scripts/update_cves.py --pending-only

      - name: Discover this year's PoCs pushed in the last day
        id: discovery
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 scripts/update_cves.py --lookback-days 1 --years 2 --skip-cvelist

      - name: Refresh repository metadata and remove confirmed dead links
        id: repository_metadata
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 scripts/sync_repo_metadata.py

      - name: Rebuild the trending PoC table
        id: trending
        continue-on-error: true
        timeout-minutes: 15
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Reserve six minutes for publishing.
          left=$(( ${JOB_STARTED:?} + 30 * 60 - 6 * 60 - $(date +%s) ))
          budget=$(( left < 12 * 60 ? left : 12 * 60 ))
          if [ "$budget" -lt 240 ]; then
            echo "::error title=Trending refresh skipped::Only ${left}s left before the publishing reserve; last hour's tables stay published"
            exit 1
          fi
          status=0
          timeout --kill-after=30 $(( budget + 60 )) \
            python3 .github/getTrending.py --budget-seconds "$budget" || status=$?
          case "$status" in
            0) echo "written=true" >> "$GITHUB_OUTPUT" ;;
            75) echo "written=true" >> "$GITHUB_OUTPUT"
                echo "::warning title=Trending refresh incomplete::Tables written, but some lanes kept last hour's rows or judged fewer candidates; the step summary says which" ;;
            124|137) echo "::error title=Trending refresh killed::Still running a minute past its ${budget}s budget; last hour's tables stay published" ;;
          esac
          exit "$status"

      - name: Ingest the current candidates
        id: ingest
        continue-on-error: true
        if: steps.trending.outputs.written == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 scripts/sync_pocingithub.py --input index/trending.json

      - name: Record published artifact releases
        run: python3 scripts/releases.py --record

      - name: Redraw the banner and recount the index
        run: |
          python3 .github/hero.py

      - name: Refresh README counts
        run: python3 .github/getTrending.py --counts-only

      - name: Check for changes and commit
        id: commit
        run: |
          git config user.name 'CVE-BOT'
          git config user.email '[email protected]'
          git add --all -- \
            README.md \
            .github/repo_metadata_state.json \
            index/link_health.json \
            index/repo_meta.json \
            index/metadata/ \
            index/trending.json \
            index/github.txt \
            index/references.txt \
            index/reference_pocs.txt \
            index/cve_dates.json \
            index/cve_record_state.json \
            index/github_discovery_state.json \
            index/source_artifact_reviews.json \
            index/source_artifact_candidates.json \
            docs/hero.svg \
            docs/social-card.svg \
            docs/stats.json \
            docs/kev.svg \
            index/releases/ \
            cves/
          if git diff --cached --quiet; then
            echo "No changes to commit"
            exit 0
          fi

          git commit -m "Trending CVEs update $(date -u +'%Y-%m-%d %H:%M') :robot:"

          for attempt in 1 2 3; do
            if git push origin HEAD:main; then
              echo "pushed=true" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            echo "Push rejected; replaying onto the current main (attempt $attempt)"
            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
            git rebase FETCH_HEAD || { git rebase --abort; exit 1; }
          done
          exit 1

      # GITHUB_TOKEN pushes do not trigger push workflows.
      - name: Rebuild and deploy the site
        if: steps.commit.outputs.pushed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run site.yml --ref main

      - name: Continue the archive queue
        if: ${{ !cancelled() }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run archive_pocs.yml --ref main

      - name: Report incomplete refresh
        if: steps.pending.outcome == 'failure' || steps.discovery.outcome == 'failure' || steps.repository_metadata.outcome == 'failure' || steps.trending.outcome == 'failure' || steps.ingest.outcome == 'failure'
        env:
          OUTCOMES: >-
            pending=${{ steps.pending.outcome }}
            discovery=${{ steps.discovery.outcome }}
            repository_metadata=${{ steps.repository_metadata.outcome }}
            trending=${{ steps.trending.outcome }}
            ingest=${{ steps.ingest.outcome }}
          PUSHED: ${{ steps.commit.outputs.pushed }}
        run: |
          failed=$(tr ' ' '\n' <<< "$OUTCOMES" | sed -n 's/=failure$//p' | paste -sd ' ' -)
          if [ "$PUSHED" = true ]; then
            published="What this run did produce was pushed."
          else
            published="Nothing new was pushed."
          fi
          echo "::error title=Incomplete hourly refresh::Failed: ${failed}. ${published} Each failed step's log says what it deferred."
          echo "**Incomplete hourly refresh.** Failed: ${failed}. ${published}" >> "$GITHUB_STEP_SUMMARY"
          exit 1