mirror of
https://github.com/Droid-Deck/DroidDeck.git
synced 2026-11-12 19:41:10 +00:00
Kurt Himebauch
40242fa082
* ci: scan signed main and release APKs on VirusTotal * ci: upload to VirusTotal only for unknown hashes and escape annotations
46 lines
1.1 KiB
YAML
46 lines
1.1 KiB
YAML
name: Scan APKs
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
artifact:
|
|
description: Prefix of the signed artifacts to scan, as passed to sign.yml
|
|
type: string
|
|
required: true
|
|
fail_on_detection:
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
virustotal:
|
|
name: VirusTotal
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
sparse-checkout: tools/release
|
|
|
|
- uses: actions/download-artifact@v4
|
|
with:
|
|
pattern: ${{ inputs.artifact }}-*
|
|
merge-multiple: true
|
|
path: scan
|
|
|
|
- name: Scan
|
|
continue-on-error: ${{ !inputs.fail_on_detection }}
|
|
env:
|
|
VT_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
|
|
FAIL_ON_DETECTION: ${{ inputs.fail_on_detection && '1' || '0' }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "$VT_API_KEY" ]; then
|
|
echo "::warning title=VirusTotal::no VIRUSTOTAL_API_KEY secret; skipping the scan"
|
|
exit 0
|
|
fi
|
|
bash tools/release/virustotal-scan.sh scan/*.apk
|