feat(ci): automated catalog refresh #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: pgdg-cve-scraper | |
| # PGDG ships security updates on Tuesdays (every ~4 weeks). This runs | |
| # weekly Monday evenings UTC and opens a PR with newly-disclosed CVEs | |
| # so a human can review + merge. Manual trigger via workflow_dispatch. | |
| on: | |
| schedule: | |
| # Mondays 22:00 UTC. Picked so we land after PGDG's Tuesday-batch of | |
| # fixes (i.e., the *next* Monday after a PGDG release). | |
| - cron: '0 22 * * 1' | |
| workflow_dispatch: | |
| # Don't open duplicate PRs if the previous one is still open for review. | |
| pull_request: | |
| concurrency: | |
| group: pgdg-cve-scraper | |
| cancel-in-progress: false | |
| permissions: {} | |
| jobs: | |
| scrape: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| name: Scrape PGDG security index | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install uv | |
| run: | | |
| curl -LsSf https://astral.sh/uv/install.sh | sh | |
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | |
| - name: Sync deps | |
| run: uv sync --quiet | |
| - name: Run scraper (CI mode) | |
| # --check exits non-zero when there are proposed additions. | |
| id: scrape | |
| run: | | |
| set +e | |
| PROPOSED=$(uv run python tools/scrape_pgdg.py --check 2>/dev/null) | |
| rc=$? | |
| set -e | |
| echo "scraper exit code: $rc" | |
| if [ $rc -ne 0 ]; then | |
| echo "needs_pr=true" >> "$GITHUB_OUTPUT" | |
| # Save the proposed JSON to a file so we can commit it. | |
| echo "$PROPOSED" > proposed-cves.json | |
| else | |
| echo "needs_pr=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Open PR with proposed additions | |
| if: steps.scrape.outputs.needs_pr == 'true' | |
| uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0 | |
| with: | |
| branch: chore/pgdg-cve-scrape | |
| title: "chore: add newly disclosed PostgreSQL CVEs" | |
| body: | | |
| Automated PGDG security-index scrape. | |
| The scraper (`tools/scrape_pgdg.py`) ran against | |
| https://www.postgresql.org/support/security/?cve=title and | |
| found CVE entries newer than what's in `data/cves.json`. The | |
| proposed additions are in `proposed-cves.json` below. | |
| **Action items for a human:** | |
| - [ ] Eyeball each entry: confirm it actually affects | |
| PostgreSQL 15-18. | |
| - [ ] Sanity-check summaries (one-line, technical). | |
| - [ ] Confirm CVSS thresholds (tool defaults to >= 7.0). | |
| - [ ] Merge the JSON into `data/cves.json`: | |
| ```bash | |
| uv run python tools/scrape_pgdg.py --write --yes | |
| uv run python tools/generate_cve_sql.py | |
| git add data/cves.json pgFirstAid.sql view_pgFirstAid.sql view_pgFirstAid_managed.sql | |
| git commit -m "chore: refresh CVE catalog" | |
| ``` | |
| - [ ] Delete `proposed-cves.json` before merge. | |
| scraper exit code: ${{ steps.scrape.outputs.needs_pr }} (non-zero = additions pending) | |
| add-paths: proposed-cves.json | |
| commit-message: "chore: scrape PGDG for new CVEs" | |
| delete-branch: true | |
| labels: automated,security |