mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
c8f213af17
The daily sweep found new repositories within 2 to 9 hours where their name carried the CVE, and up to 30 hours where only the README did. The hourly run now searches repositories pushed in the last day for this year's and last year's CVEs, reads their READMEs and applies the same classifier, so a PoC published this morning is on the site within the hour. The daily run keeps covering every year and the CVE record references; the hourly run skips those, and skipping leaves the delta checkpoint alone. A sample of two hundred indexed repositories held six with nothing in them: an empty README or none, a placeholder, a link to a paywall. A repository with no directory, no code, no file named for the CVE or as a PoC, and a README with no code block, command, request or real write-up is bare, and neither discovery nor the daily audit keeps it. The audit now reads each repository's README and root to judge that, and sweeps 4,000 repositories a day instead of 1,750, since one link in eight pointed at a deleted repository under the fortnightly cycle. The upstream PoC-in-GitHub collection is judged daily rather than weekly: fourteen of the last thirty-nine additions came from it, which means it finds repositories our own search does not.
90 lines
2.7 KiB
YAML
90 lines
2.7 KiB
YAML
name: Sync PoC-in-GitHub
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '10 5 * * *'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
actions: write
|
|
|
|
concurrency:
|
|
group: repository-updates
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
sync:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.13'
|
|
|
|
# Every candidate is judged again each day rather than remembered as
|
|
# rejected: a repository that was an empty shell in March is often a
|
|
# working exploit by June, and re-reading 6,800 of them costs five
|
|
# minutes. Daily because the collection keeps finding repositories our
|
|
# own search missed.
|
|
- name: Judge upstream PoC candidates
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: python3 scripts/sync_pocingithub.py
|
|
|
|
- name: Verify the generated index
|
|
run: |
|
|
python3 -m unittest discover -s tests
|
|
python3 scripts/build_site.py
|
|
|
|
- name: Refresh published counts
|
|
run: |
|
|
python3 .github/hero.py
|
|
python3 .github/getTrending.py --counts-only
|
|
|
|
- name: Check for changes and commit
|
|
id: commit
|
|
run: |
|
|
git config user.name 'CVE-BOT'
|
|
git config user.email '[email protected]'
|
|
git add --all -- \
|
|
README.md \
|
|
docs/hero.svg \
|
|
docs/social-card.svg \
|
|
docs/stats.json \
|
|
docs/kev.svg \
|
|
index/github.txt \
|
|
index/cve_dates.json \
|
|
index/cve_record_state.json \
|
|
cves/
|
|
|
|
if git diff --cached --quiet; then
|
|
echo "No changes to commit"
|
|
exit 0
|
|
fi
|
|
|
|
git commit -m "Add PoC repositories from upstream collection $(date -u +'%Y-%m-%d')"
|
|
|
|
for attempt in 1 2 3; do
|
|
if git push origin HEAD:main; then
|
|
echo "pushed=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
echo "Push rejected; replaying onto the current main (attempt $attempt)"
|
|
git fetch --unshallow origin main 2>/dev/null || git fetch origin main
|
|
git rebase FETCH_HEAD || { git rebase --abort; exit 1; }
|
|
done
|
|
exit 1
|
|
|
|
# Commits pushed with the workflow token raise no push event, so site.yml
|
|
# would otherwise wait for its daily schedule. Dispatching is exempt.
|
|
- name: Rebuild and deploy the site
|
|
if: steps.commit.outputs.pushed == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: gh workflow run site.yml --ref main
|