Sync CVE Delta (CVElistV5) #117
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sync CVE Delta (CVElistV5) | |
| # Moved from Vercel cron because /api/cron/ingest-cve-delta consistently hit | |
| # the 270s soft-timeout even with MAX_PAGES=1. Then the first GH-Actions | |
| # attempt against the NVD v2 API 404'd consistently — NVD IP-blocks | |
| # date-range queries from cloud runners even with a key (single-CVE | |
| # lookups still work, which is why sync-cve-products is fine). | |
| # | |
| # The script now sources CVEs from the CVElistV5 git repo — the same | |
| # upstream that feeds NVD, pushed every few minutes, no rate limits, | |
| # no IP blocks. Daily 04:30 UTC with a 48h lookback so each run overlaps | |
| # the previous one — if a day fails the next backfills automatically. | |
| on: | |
| schedule: | |
| - cron: '30 4 * * *' # daily 04:30 UTC | |
| workflow_dispatch: | |
| inputs: | |
| lookback: | |
| description: 'Hours of git history (max 720)' | |
| required: false | |
| default: '48' | |
| jobs: | |
| sync: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: '22' | |
| - name: Install pg | |
| run: npm install pg | |
| - name: Run CVElistV5 CVE-delta ingest | |
| env: | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| run: | | |
| LOOKBACK="${{ github.event.inputs.lookback || '48' }}" | |
| node scripts/sync-cve-delta.mjs --lookback="$LOOKBACK" --repo-dir="$RUNNER_TEMP/cvelistv5" |