reference-data-refresh.yml

name: reference-data-refresh

# Monthly: regenerate the MITRE ATLAS and CWE tables in
# data_validation/reference_data/ from MITRE's latest releases. If anything
# changed, push the result to a branch and open an issue so a maintainer can
# open the PR (this repository does not let workflows open pull requests).
on:
  schedule:
    - cron: '17 6 2 * *'   # 06:17 UTC on the 2nd of each month
  workflow_dispatch:

permissions:
  contents: write
  issues: write

jobs:
  refresh:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.11'

      - name: Install requirements
        run: python -m pip install --quiet -r data_validation/requirements.txt

      - name: Regenerate ATLAS and CWE tables
        run: python data_validation/reference_data/update_reference_data.py

      - name: Run the checks against the new tables
        id: checks
        continue-on-error: true
        run: python data_validation/run_all_checks.py --no-shared && python data_validation/validators/crossref_validator.py

      - name: Push a branch and open an issue if anything changed
        env:
          GH_TOKEN: ${{ github.token }}
          CHECKS: ${{ steps.checks.outcome }}
        run: |
          if git diff --quiet -- data_validation/reference_data; then
            echo "Reference data is current."
            exit 0
          fi
          branch="automation/reference-data-$(date -u +%Y-%m)"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git switch -c "$branch"
          git add data_validation/reference_data
          git commit -m "reference_data: refresh MITRE ATLAS and CWE tables"
          git push --force origin "$branch"
          versions=$(grep -E '^\| (MITRE ATLAS|CWE) ' data_validation/reference_data/SOURCES.md | cut -d'|' -f2,4)
          {
            echo "The monthly refresh regenerated the MITRE ATLAS and CWE tables."
            echo
            echo "Versions: $versions"
            echo
            echo "Identifier check against the existing data: **$CHECKS**. A failure usually means MITRE retired or renamed an ID the datasets cite; the crossref output in the run log names the entries."
            echo
            echo "Open the PR: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/main...${branch}?expand=1"
            echo
            echo "Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
          } > body.md
          if gh issue list --state open --search "in:title Reference data refresh $(date -u +%Y-%m)" --json number --jq 'length' | grep -q '^0$'; then
            gh issue create --title "Reference data refresh $(date -u +%Y-%m)" --body-file body.md
          fi