ci: exclude PRs from issue search, sanitize vulnix descriptions for markdown tables

.github/workflows/vulnix.yml

@@ -5,10 +5,6 @@ on:
     - cron: "0 6 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: read
-  issues: write
-
 jobs:
   scan:
     runs-on: nix

ci.py

@@ -33,13 +33,16 @@ def gitea(method, path, body=None):
     req.add_header("Authorization", f'token {os.environ["GH_TOKEN"]}')
     if data is not None:
         req.add_header("Content-Type", "application/json")
-    with urllib.request.urlopen(req) as resp:
-        raw = resp.read()
+    try:
+        with urllib.request.urlopen(req) as resp:
+            raw = resp.read()
+    except urllib.error.HTTPError as e:
+        sys.exit(f"gitea {method} {path}: {e.code} {e.reason}\n{e.read().decode()}")
     return json.loads(raw) if raw else None
 
 
 def find_open_issue(label):
-    issues = gitea("GET", f"/issues?state=open&labels={label}")
+    issues = gitea("GET", f"/issues?state=open&type=issues&labels={label}")
     return issues[0] if issues else None
 
 
@@ -236,7 +239,7 @@ def format_vulnix(vulns):
     for v in vulns:
         for cve in v["affected_by"]:
             score = v.get("cvssv3_basescore", {}).get(cve)
-            desc = v.get("description", {}).get(cve, "")
+            desc = v.get("description", {}).get(cve, "").replace("\n", " ").replace("|", "∣")
             if len(desc) > 120:
                 desc = desc[:117] + "..."
             rows.append((v["pname"], v["version"], cve, score, desc))