chore: merge main into feat/lse-emu

.github/workflows/build.yml

@@ -558,6 +558,12 @@ jobs:
           SOURCE_TREE: ${{ needs.source.outputs.tree-sha }}
         run: python3 tools/components/prepare.py unpack --tree "$SOURCE_TREE"
 
+      - name: Ubisoft launcher service (x86_64-pc-windows-gnu)
+        run: |
+          set -euo pipefail
+          command -v x86_64-w64-mingw32-gcc >/dev/null || { sudo apt-get update -qq && sudo apt-get install -y -qq gcc-mingw-w64-x86-64; }
+          bash tools/ubisoft-launcher/build.sh
+
       - uses: actions/download-artifact@v4
         with:
           name: xbox-arm64
@@ -794,6 +800,9 @@ jobs:
           set -o pipefail
           cd app/src/main/rust/stores
           cargo test --locked 2>&1 | tail -60
+      - name: Ubisoft launcher service host unit tests
+        timeout-minutes: 10
+        run: cargo test --locked --manifest-path tools/ubisoft-launcher/Cargo.toml
 
   python-tests:
     name: Python and native regression tests
@@ -886,6 +895,16 @@ jobs:
       variants: ${{ needs.build.outputs.variants }}
     secrets: inherit
 
+  scan:
+    needs: sign
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/scan.yml
+    with:
+      artifact: droiddeck-signed
+    secrets: inherit
+
   packs:
     needs: [build, checks]
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'

.github/workflows/release.yml

@@ -63,6 +63,15 @@ jobs:
       artifact: droiddeck-release
     secrets: inherit
 
+  scan:
+    needs: sign
+    permissions:
+      contents: read
+    uses: ./.github/workflows/scan.yml
+    with:
+      artifact: droiddeck-release
+    secrets: inherit
+
   packs:
     needs: find
     permissions:

.github/workflows/scan.yml

@@ -0,0 +1,45 @@
+name: Scan APKs
+
+on:
+  workflow_call:
+    inputs:
+      artifact:
+        description: Prefix of the signed artifacts to scan, as passed to sign.yml
+        type: string
+        required: true
+      fail_on_detection:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  virustotal:
+    name: VirusTotal
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          sparse-checkout: tools/release
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: ${{ inputs.artifact }}-*
+          merge-multiple: true
+          path: scan
+
+      - name: Scan
+        continue-on-error: ${{ !inputs.fail_on_detection }}
+        env:
+          VT_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
+          FAIL_ON_DETECTION: ${{ inputs.fail_on_detection && '1' || '0' }}
+        run: |
+          set -euo pipefail
+          if [ -z "$VT_API_KEY" ]; then
+            echo "::warning title=VirusTotal::no VIRUSTOTAL_API_KEY secret; skipping the scan"
+            exit 0
+          fi
+          bash tools/release/virustotal-scan.sh scan/*.apk