refresh.yml

name: Refresh data

on:
  schedule:
    # 144 runs a day. Each run writes one KV key, under the free 1,000 writes/day.
    - cron: "*/10 * * * *"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: refresh-snapshot
  cancel-in-progress: false

jobs:
  refresh:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check Cloudflare credentials
        id: creds
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          if [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$CLOUDFLARE_ACCOUNT_ID" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID is unset. Skipping snapshot refresh."
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - uses: oven-sh/setup-bun@v2.2.0
        if: steps.creds.outputs.skip != 'true'

      - name: Install dependencies
        if: steps.creds.outputs.skip != 'true'
        run: bun install --frozen-lockfile

      - name: Build snapshot
        if: steps.creds.outputs.skip != 'true'
        env:
          # Actions reserves GITHUB_TOKEN, so advisories use the public API.
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
        run: bun scripts/refresh-snapshot.ts snapshot.json

      - name: Write snapshot to KV
        if: steps.creds.outputs.skip != 'true'
        uses: cloudflare/wrangler-action@v4
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          packageManager: bun
          command: kv key put snapshot --binding CVE_CACHE --path snapshot.json --remote