US51939: Added malware scan workflow

.github/workflows/malware-scan.yml

@@ -0,0 +1,53 @@
+# (C) Copyright 2023 Hewlett Packard Enterprise Development LP
+
+name: Malware Scan
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  scan_repository:
+    name: "Scan Virus on Repository"
+    runs-on: "ubuntu-latest"
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/[email protected]"
+        with:
+          fetch-depth: 0
+      - name: "Scan Source for Viruses"
+        id: scan
+        run: |
+          SHA_SHORT=$(git rev-parse --short HEAD)
+          SCAN_OUTPUT=/tmp/clamav-repository-results-${{ github.event.repository.name }}-${SHA_SHORT}-$(date +%s).txt
+          echo "scan_output=${SCAN_OUTPUT}" >> $GITHUB_OUTPUT
+          docker run --rm -v ${{ github.workspace }}:/scandir -v /tmp:/tmp -e SCAN_OUTPUT=${SCAN_OUTPUT} clamav/clamav:stable clamscan --infected --recursive --max-files=0 --max-filesize=0 --max-scansize=0 --max-recursion=1000 --max-dir-recursion=1000 /scandir | tee -a $SCAN_OUTPUT
+          INFECTED_FILES=$(grep ^Infected $SCAN_OUTPUT | awk '{print $NF}')
+          echo "infected_files=${INFECTED_FILES}" >> $GITHUB_OUTPUT
+          exit $INFECTED_FILES
+      - name: "Configure AWS Credentials"
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: arn:aws:iam::522637239241:role/s3-avscan-upload 
+          role-session-name: malware-scan-upload 
+          aws-region: us-west-2
+      - name: "Upload Source Scan Results"
+        if: always()
+        run: aws s3 cp ${{ steps.scan.outputs.scan_output }} s3://glcs-cloud-security-dev-avscan.hpe-hcss.hpe.com/
+      - name: "Tag Scan Upload"
+        if: always()
+        run: |
+          GH_OWNER=${{ github.repository_owner }}
+          GH_REPO=${{ github.event.repository.name }}
+          INFECTED_FILES=${{ steps.scan.outputs.infected_files }}
+          OBJECT_KEY=`basename ${{ steps.scan.outputs.scan_output }}`
+          aws s3api put-object-tagging \
+            --bucket glcs-cloud-security-dev-avscan.hpe-hcss.hpe.com \
+            --key $OBJECT_KEY \
+            --tagging "{\"TagSet\": [{ \"Key\": \"github_owner\", \"Value\": \"$GH_OWNER\" },{ \"Key\": \"github_repository\", \"Value\": \"$GH_REPO\"},{\"Key\": \"infected_files\", \"Value\": \"$INFECTED_FILES\"}]}"