cve/.github/workflows/sync_cve_pocs.yml

name: Sync CVE PoCs

on:
  schedule:
    - cron: "15 2 * * *"
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: repository-updates
  cancel-in-progress: false

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.13'

      - name: Discover and ingest CVE PoCs
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 scripts/update_cves.py --lookback-days 3 --all-years

      - name: Verify the generated index
        run: |
          python3 -m unittest discover -s tests
          python3 scripts/build_site.py

      - name: Check for changes and commit
        run: |
          git config user.name 'CVE-BOT'
          git config user.email '[email protected]'

          git add --all -- \
            .github/cve_sync_state.json \
            index/github.txt \
            index/references.txt \
            index/reference_pocs.txt \
            index/cve_dates.json \
            index/cve_record_state.json \
            cves/

          if git diff --cached --quiet; then
            echo "No changes to commit"
            exit 0
          fi

          git commit -m "Update CVE PoCs $(date -u +'%Y-%m-%d')"

          for attempt in 1 2 3; do
            if git push origin HEAD:main; then
              exit 0
            fi
            echo "Push rejected; replaying onto the current main (attempt $attempt)"
            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
            git rebase FETCH_HEAD
          done
          exit 1