# Copyright 2024-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

name: Scan trunk archives with ClamAV

permissions: read-all

on:
  workflow_dispatch:
  schedule:
    # Run every day at 22:00 UTC
    - cron: '0 22 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  zip_url: https://github.com/ispc/ispc/releases/download/trunk-artifacts/ispc-trunk-windows.zip
  tar_url: https://github.com/ispc/ispc/releases/download/trunk-artifacts/ispc-trunk-linux.tar.gz

jobs:
  scan:
    runs-on: ubuntu-latest
    # Disabling this workflow for non ispc/ispc repo to reduce the traffic to artifacts downloads.
    if: github.repository == 'ispc/ispc'

    steps:
    - name: Checkout repository
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

    - name: Install ClamAV
      run: |
        sudo apt-get update
        sudo apt-get install -y clamav

    - name: Update ClamAV database
      run: |
        sudo systemctl stop clamav-freshclam
        sudo freshclam
        sudo systemctl start clamav-freshclam

    - name: Download archives
      run: |
        wget -O archive.zip ${{ env.zip_url }}
        unzip -q archive.zip
        wget -O archive.tar.gz ${{ env.tar_url }}
        gunzip archive.tar.gz

    - name: Scan archvies and source code with ClamAV
      run: |
        clamscan --recursive --scan-archive --archive-verbose --verbose ./ 2>&1 | tee ispc-trunk-clamscan.log

    - name: Upload ClamAV logs
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: always()
      with:
        name: clamav-logs
        path: |
          ispc-trunk-clamscan.log
