mirror of
https://github.com/peass-ng/PEASS-ng.git
synced 2026-07-28 14:47:18 -07:00
Carlos PolopandClaude Opus 4.8
5ca6d6b797
The workflows referenced a secret (CHACK_AGENT_FIXER_TOKEN) that does not exist in the repo, so it resolved to empty and the windows-definitions auto-merge could neither dispatch PR-tests nor merge. Point every reference at the existing CODEX_FIXER_TOKEN PAT (fine-grained, admin on the repo) instead. Remove the temporary token probe. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
90 lines
3.5 KiB
YAML
90 lines
3.5 KiB
YAML
name: Update Windows Version Definitions
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "17 4 */14 * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
actions: write
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
update-definitions:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v5
|
|
with:
|
|
ref: master
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version: "3.x"
|
|
|
|
- name: Install Python dependencies
|
|
run: python3 -m pip install --disable-pip-version-check openpyxl
|
|
|
|
- name: Update windows version definitions
|
|
timeout-minutes: 50
|
|
run: python3 build_lists/update_windows_version_defs.py --verbose
|
|
|
|
- name: Validate windows version definitions
|
|
run: python3 build_lists/validate_windows_version_defs.py
|
|
|
|
- name: Create validated update pull request
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR_TESTS_DISPATCH_TOKEN: ${{ secrets.CODEX_FIXER_TOKEN }}
|
|
run: |
|
|
title="chore(winpeas): update windows version vulnerability definitions"
|
|
branch="bot/update-windows-version-definitions"
|
|
|
|
if git diff --quiet -- build_lists/windows_version_exploits.json; then
|
|
echo "No windows version definition updates detected."
|
|
exit 0
|
|
fi
|
|
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git checkout -B "$branch"
|
|
git add build_lists/windows_version_exploits.json
|
|
git commit -m "$title"
|
|
git push --force origin "$branch"
|
|
|
|
pr_number="$(gh pr list --state open --head "$branch" --base master --json number --jq '.[0].number')"
|
|
if [ -z "$pr_number" ]; then
|
|
gh pr create \
|
|
--base master \
|
|
--head "$branch" \
|
|
--title "$title" \
|
|
--body "Automated update of \`build_lists/windows_version_exploits.json\`. The generated JSON passed \`build_lists/validate_windows_version_defs.py\` before this PR was created."
|
|
else
|
|
gh pr edit "$pr_number" \
|
|
--title "$title" \
|
|
--body "Automated update of \`build_lists/windows_version_exploits.json\`. The generated JSON passed \`build_lists/validate_windows_version_defs.py\` before this PR was updated."
|
|
fi
|
|
|
|
pr_number="$(gh pr list --state open --head "$branch" --base master --json number --jq '.[0].number')"
|
|
if [ -z "$pr_number" ]; then
|
|
echo "Could not resolve the generated pull request after creating/updating it."
|
|
exit 1
|
|
fi
|
|
|
|
# Dispatch PR-tests with a PAT instead of github.token. A workflow run that is
|
|
# owned by GITHUB_TOKEN does NOT emit a downstream `workflow_run` event, so a
|
|
# github.token-dispatched run never triggered the chack-agent-pr-triage auto-merge
|
|
# job. Dispatching with a PAT makes the run user-owned, so `workflow_run` fires and
|
|
# the trusted merge job runs once PR-tests pass.
|
|
if [ -z "$PR_TESTS_DISPATCH_TOKEN" ]; then
|
|
echo "CODEX_FIXER_TOKEN is required to dispatch PR-tests so the auto-merge workflow_run event fires."
|
|
exit 1
|
|
fi
|
|
|
|
GH_TOKEN="$PR_TESTS_DISPATCH_TOKEN" gh workflow run PR-tests.yml --ref "$branch"
|
|
echo "PR-tests dispatched (via PAT) for PR #$pr_number. The trusted workflow_run merge job will merge it after tests pass."
|