ingest-snapshot.yaml

name: Dump GLVD Postgres Snapshot
on:
  workflow_dispatch:

jobs:
  dump-db-snapshot:
    runs-on: ubuntu-latest
    container: ghcr.io/gardenlinux/glvd:edge
    env:
      PGUSER: glvd
      PGDATABASE: glvd
      PGPASSWORD: glvd
      PGHOST: postgres
      PGPORT: 5432

    services:
      postgres:
        image: ghcr.io/gardenlinux/glvd-postgres:edge
        env:
          POSTGRES_USER: glvd
          POSTGRES_DB: glvd
          POSTGRES_PASSWORD: glvd
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
      - name: Check out repository code
        uses: actions/checkout@v4

      - name: prepare
        run: |
          apt-get -q update
          apt-get -yqq install git curl debian-archive-keyring postgresql-client
          mkdir -p data/ingest-debsec/{debian,gardenlinux}/CVE
          mkdir -p data/ingest-debsec/debian/CVE
          mkdir -p data/ingest-debsrc/debian
          mkdir -p data/ingest-debsrc/var/lib/dpkg
          touch data/ingest-debsrc/var/lib/dpkg/status
          curl https://salsa.debian.org/security-tracker-team/security-tracker/-/raw/master/data/CVE/list?ref_type=heads \
              --output data/ingest-debsec/debian/CVE/list
          mkdir -p conf/ingest-debsrc/
          curl https://raw.githubusercontent.com/gardenlinux/glvd-data-ingestion/main/conf/ingest-debsrc/apt.conf \
              --output conf/ingest-debsrc/apt.conf
          curl https://raw.githubusercontent.com/gardenlinux/glvd-data-ingestion/main/conf/ingest-debsrc/debian.sources \
              --output conf/ingest-debsrc/debian.sources
          APT_CONFIG=conf/ingest-debsrc/apt.conf apt-get -q update \
            -o Dir="$PWD/data/ingest-debsrc/" \
            -o Dir::Etc::sourcelist="$PWD/conf/ingest-debsrc/debian.sources" \
            -o Dir::State="$PWD/data/ingest-debsrc/"
          git clone --depth=1 https://salsa.debian.org/security-tracker-team/security-tracker

      - name: Run data ingestion (ingest-debsrc - debian trixie)
        run: glvd-data ingest-debsrc debian trixie data/ingest-debsrc/lists/deb.debian.org_debian_dists_trixie_main_source_Sources

      - name: Run data ingestion (ingest-debsrc - debian bookworm)
        run: glvd-data ingest-debsrc debian bookworm data/ingest-debsrc/lists/deb.debian.org_debian_dists_bookworm_main_source_Sources

      - name: Run data ingestion (ingest-debsec - debian)
        run: glvd-data ingest-debsec debian security-tracker/data

      - name: Run data ingestion (nvd)
        run: glvd-data ingest-nvd

      - name: Run data combination (combine-deb)
        run: glvd-data combine-deb

      - name: Run data combination (combine-all)
        run: glvd-data combine-all

      - name: Dump Database Snapshot
        run: |
          echo "$PGHOST:$PGPORT:$PGDATABASE:$PGUSER:$PGPASSWORD" > ~/.pgpass
          chmod 0600 ~/.pgpass
          pg_dump -h postgres -p 5432 -U glvd glvd > glvd.sql

      - uses: actions/upload-artifact@v4
        with:
          name: glvd.sql
          path: glvd.sql
          retention-days: 2