ci: add clamav malware scan job (#639)

Author: thijmv

.github/workflows/vulnerability-check.yaml

@@ -30,6 +30,34 @@ jobs:
           scanners: 'vuln,license,secret,misconfig'
           skip-version-check: true
 
+  clamav_scan:
+    name: ClamAV Malware Scan
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install ClamAV
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clamav
+
+      - name: Update ClamAV signatures
+        run: |
+          sudo systemctl stop clamav-freshclam
+          # Retry up to 3 times, as ClamAV's CDN may be rate-limited.
+          for i in {0..2}; do
+            sudo freshclam && exit 0
+            [ "$i" -lt 2 ] && sleep 10
+          done
+          exit 1
+
+      - name: Run ClamAV to check for malware
+        # Enforce a 10MB file/archive limit, and fail when exceeded.
+        run: clamscan --recursive --infected --exclude-dir="(^|/)\.git$" --max-filesize=10M --max-scansize=10M --alert-exceeds-max .
+
   trivy_report:
     name: Trivy Vulnerability Report
     runs-on: ubuntu-latest