Sync CVE → Application Products (NVD) #363
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sync CVE → Application Products (NVD) | |
| # Moved from Vercel cron (which was hard-capped at 300s, limiting us to | |
| # ~60-CVE batches × 3 runs/day = 180 CVEs/day — not enough to keep up with | |
| # NVD's ~100-200 CVEs/day publishing rate PLUS clear the ~1k backlog). | |
| # | |
| # GH Actions hourly × 100-CVE batch = 2,400 CVEs/day → clears backlogs fast | |
| # and keeps up with new arrivals with 10× headroom. | |
| on: | |
| schedule: | |
| - cron: '17 * * * *' # hourly at :17 (spread load, avoid :00) | |
| workflow_dispatch: | |
| inputs: | |
| batch: | |
| description: 'CVEs per run (max 500)' | |
| required: false | |
| default: '100' | |
| lookback: | |
| description: 'Days of pending pool (max 365)' | |
| required: false | |
| default: '60' | |
| jobs: | |
| sync: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Install pg | |
| run: npm install pg | |
| - name: Run NVD CVE-products enrichment | |
| env: | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| NVD_API_KEY: ${{ secrets.NVD_API_KEY }} | |
| run: | | |
| BATCH="${{ github.event.inputs.batch || '100' }}" | |
| LOOKBACK="${{ github.event.inputs.lookback || '60' }}" | |
| node scripts/sync-cve-products.mjs --batch="$BATCH" --lookback="$LOOKBACK" |