add workflow for virus scanning binaries - #101
Conversation
|
Caution Review failedThe pull request is closed. 📝 WalkthroughWalkthroughAdds a new GitHub Actions workflow that builds Go binaries with GoReleaser and scans the produced artifacts with VirusTotal; the workflow is named "scan" and triggers on Changes
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. 📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: ASSERTIVE Plan: Pro Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting
📒 Files selected for processing (1)
.github/workflows/scan.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/scan.yml (1)
26-32: Be aware: VirusTotal submissions are shared with security vendorsUploading binaries to VirusTotal typically shares samples with AV partners. Ensure this aligns with your project’s policy and that no proprietary/private artifacts are included.
Do you want me to add a safeguard that only scans artifacts produced from public branches/tags and never from private/internal builds?
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (7)
.github/workflows/scan.yml (7)
13-15: Checkout depth 1 unless GoReleaser snapshot needs tagsUse depth 1 to speed up unless your snapshot build derives version from tags.
- uses: actions/checkout@v5 with: - fetch-depth: 0 + fetch-depth: 1If your GoReleaser config needs tags/history, keep depth: 0.
3-5: Tighten triggers and scan actual release artifacts tooLimit PR runs to relevant paths and add tag/release triggers so you also scan what you actually ship.
on: workflow_dispatch: + pull_request: + paths: + - '**/*.go' + - 'go.mod' + - 'go.sum' + - '.goreleaser*.y*ml' + - '.github/workflows/scan.yml' + push: + tags: + - 'v*' + release: + types: [published]
6-7: Avoid hardcoding Go version; sync with go.mod and enable module cachePrevents drift and speeds up builds.
-env: - GO_VERSION: '1.25.0'- name: Set up Go uses: actions/setup-go@v5 with: - go-version: ${{ env.GO_VERSION }} + go-version-file: 'go.mod' + cache: trueAlso applies to: 16-19
9-11: Harden the job: least-privilege permissions, concurrency, and timeoutReduces blast radius and avoids piled-up runs.
jobs: virus-total: runs-on: ubuntu-latest + permissions: + contents: read + concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + timeout-minutes: 20
21-24: Pin GoReleaser action by commit SHA; add --clean and distributionImproves supply-chain security and ensures a clean dist dir.
- - name: Build Binaries - uses: goreleaser/goreleaser-action@v6 - with: - version: 'v2.9.0' - args: build --snapshot + - name: Build Binaries + # Pin to the commit SHA for the chosen release; keep version comment for readability + uses: goreleaser/goreleaser-action@<COMMIT-SHA> # v6 + with: + distribution: goreleaser + version: 'v2.9.0' + args: build --snapshot --cleanReplace with the exact digest of the action release you trust.
20-24: Add a diagnostic step to verify dist contents match VT globsHelps catch pattern mismatches early.
- name: Build Binaries # ... - args: build --snapshot + args: build --snapshot --clean + - name: List dist for debugging + if: always() + run: | + echo "=== dist tree ===" + ls -lahR dist || true
25-31: Guard VirusTotal for forks/missing secret, broaden file patterns, fail on detections, and upload reportsPrevents secret-related failures on forked PRs, scans all platforms, and surfaces reports.
- name: VirusTotal scan - uses: crazy-max/ghaction-virustotal@d34968c958ae283fe976efed637081b9f9dcf74f #v4.2.0 + if: ${{ !github.event.pull_request.head.repo.fork && secrets.VT_API_KEY != '' }} + uses: crazy-max/ghaction-virustotal@d34968c958ae283fe976efed637081b9f9dcf74f # v4.2.0 with: vt_api_key: ${{ secrets.VT_API_KEY }} request_rate: 4 files: | - ./dist/hours_*/hours + ./dist/**/hours + ./dist/**/hours.exe + fail_ci_if_virus_found: true + + - name: Upload VT reports + if: always() + uses: actions/upload-artifact@v4 + with: + name: virustotal-reports + path: | + vt/*.json + vt/*.txtAdjust report paths if the action outputs differ.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting
📒 Files selected for processing (1)
.github/workflows/scan.yml(1 hunks)
1 participant
Summary by CodeRabbit