# Copyright 2024-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

name: Scan release archives with ClamAV

permissions: read-all

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'ISPC release version (just number without v, e.g., 1.24.0)'
        required: true
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  release_base_url: https://github.com/ispc/ispc/releases/download/

jobs:
  scan:
    runs-on: ubuntu-latest
    # Disabling this workflow for non ispc/ispc repo as it needs to run on releases only.
    if: github.repository == 'ispc/ispc'

    steps:
    - name: Checkout repository
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

    - name: Install ClamAV
      run: |
        sudo apt-get update
        sudo apt-get install -y clamav

    - name: Update ClamAV database
      run: |
        sudo systemctl stop clamav-freshclam
        sudo freshclam
        sudo systemctl start clamav-freshclam

    - name: Download and unpack release artifacts
      env:
        V: ${{ inputs.version }}
      run: |
        TAR=("ispc-examples-v$V.tar.gz" \
             "ispc-v$V-linux.aarch64.tar.gz" "ispc-v$V-linux.tar.gz" \
             "ispc-v$V-macOS.arm64.tar.gz" "ispc-v$V-macOS.universal.tar.gz" \
             "ispc-v$V-macOS.x86_64.tar.gz")
        ZIP=("ispc-examples-v$V.zip" "ispc-v$V-windows.zip")
        for f in "${TAR[@]}" "${ZIP[@]}"; do
          echo "Download $f"
          wget --quiet -O "$f" "${{ env.release_base_url }}/v$V/$f"
        done
        for f in "${TAR[@]}"; do
          echo "Unpack $f"
          # unpack linux examples to separate directory to avoid conflicts
          # with windows examples and source code examples directory
          if [[ $f == ispc-examples* ]]; then
            mkdir -p linux-examples
            tar -xzf "$f" -C linux-examples
          else
            tar -xzf "$f"
          fi
        done
        for f in "${ZIP[@]}"; do
          echo "Unpack $f"
          # unpack windows examples to separate directory to avoid conflicts
          # with linux/macOS examples and source code examples directory
          if [[ $f == ispc-examples* ]]; then
            unzip -q "$f" -d windows-examples
          else
            unzip -q "$f"
          fi
        done

    - name: Scan archives and source code with ClamAV
      run: |
        clamscan --recursive --scan-archive --archive-verbose --verbose ./ 2>&1 | tee ispc-releases-clamscan.log

    - name: Upload ClamAV logs
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: always()
      with:
        name: clamav-logs
        path: |
          ispc-releases-clamscan.log
