Repository navigation
Mise a jour CVE #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/cve-update.yml -- CD : mise a jour periodique de la | |
| # base CVE locale (issue #255). | |
| # | |
| # Interroge l'API NVD 2.0 via scripts/import_nvd.py --fetch, puis commit | |
| # la base SQLite mise a jour sur la branche dev (ou une branche dediee | |
| # si la CI tourne sur main). | |
| # | |
| # Declenche : | |
| # - planifie : tous les lundis a 03:00 UTC (le NVD publie en continu, | |
| # une frequence hebdomadaire suffit pour couvrir la majorite des | |
| # nouvelles CVE sans saturer le quota de l'API publique) | |
| # - manuel : bouton "Run workflow" dans l'onglet Actions | |
| name: Mise a jour CVE | |
| "on": | |
| schedule: | |
| - cron: "0 3 * * 1" # tous les lundis a 03:00 UTC | |
| workflow_dispatch: | |
| inputs: | |
| keyword: | |
| description: "Mot-cle optionnel (ex: apache, openssh) pour filtrer" | |
| required: false | |
| type: string | |
| permissions: | |
| contents: write # pour committer la base mise a jour | |
| jobs: | |
| update-cve: | |
| name: Import NVD -> base CVE locale | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout du depot | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: dev | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Installation de Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.14" | |
| - name: Installation des dependances | |
| run: pip install -r requirements.txt | |
| - name: Import NVD (fetch) | |
| run: | | |
| mkdir -p data | |
| python3 scripts/import_nvd.py \ | |
| --db data/cve.db \ | |
| --fetch \ | |
| ${{ github.event.inputs.keyword && format('--keyword {0}', github.event.inputs.keyword) || '' }} | |
| - name: Verification de la base | |
| run: | | |
| python3 -c " | |
| import sqlite3 | |
| conn = sqlite3.connect('data/cve.db') | |
| count = conn.execute('SELECT COUNT(*) FROM cve').fetchone()[0] | |
| print(f'Base CVE : {count} entrees') | |
| conn.close() | |
| " | |
| - name: Commit de la base mise a jour | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git add data/cve.db | |
| if git diff --staged --quiet; then | |
| echo "Aucune modification de la base CVE -- abandon." | |
| else | |
| git commit -m "chore(#255): mise a jour automatique de la base CVE (NVD)" | |
| git push | |
| fi |