main.yml

name: Test attachmentAV Scan

on:
  push:
    branches:
      - main
  pull_request: {}

permissions:
  actions: write
  contents: write

jobs:
  local_file_scan:
    name: Test local file (<10MB)
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Scan local .gitignore file
        id: scan_local
        uses: ./
        with:
          local-file-path: .gitignore
          api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
          fail-on-infected: true

      - name: Display local scan results
        run: |
          echo "Scan status: ${{ steps.scan_local.outputs.status }}"
          echo "File size: ${{ steps.scan_local.outputs.file-size }} bytes"
          echo "Real file type: ${{ steps.scan_local.outputs.real-file-type }}"
          if [ -n "${{ steps.scan_local.outputs.finding }}" ]; then
            echo "Finding: ${{ steps.scan_local.outputs.finding }}"
          fi

  artifact_scan:
    name: Test artifact
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Upload action.yml as artifact
        id: upload_artifact
        uses: actions/upload-artifact@v6
        with:
          name: test-action-yml
          path: action.yml

      - name: Scan artifact
        id: scan_artifact
        uses: ./
        with:
          artifact-id: ${{ steps.upload_artifact.outputs.artifact-id }}
          api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
          token: ${{ github.token }}
          fail-on-infected: true

      - name: Display artifact scan results
        run: |
          echo "Scan status: ${{ steps.scan_artifact.outputs.status }}"
          echo "File size: ${{ steps.scan_artifact.outputs.file-size }} bytes"
          echo "Real file type: ${{ steps.scan_artifact.outputs.real-file-type }}"
          if [ -n "${{ steps.scan_artifact.outputs.finding }}" ]; then
            echo "Finding: ${{ steps.scan_artifact.outputs.finding }}"
          fi

  release_scan:
    name: Test release
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Create release with action.yml asset
        id: create_release
        run: |
          # Create a test release with action.yml as an asset
          TAG_NAME="test-v${{ github.run_number }}"
          gh release create "$TAG_NAME" action.yml \
            --title "Test Release ${{ github.run_number }}" \
            --notes "Automated test release for attachmentAV scanning" \
            --repo ${{ github.repository }}

          # Get the asset ID
          ASSET_ID=$(gh api repos/${{ github.repository }}/releases/tags/$TAG_NAME \
            --jq '.assets[] | select(.name == "action.yml") | .id')
          echo "asset_id=$ASSET_ID" >> $GITHUB_OUTPUT
          echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
          echo "Release created: $TAG_NAME"
          echo "Asset ID: $ASSET_ID"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Scan release asset
        id: scan_asset
        uses: ./
        with:
          release-asset-id: ${{ steps.create_release.outputs.asset_id }}
          api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
          token: ${{ github.token }}
          fail-on-infected: true

      - name: Display release asset scan results
        run: |
          echo "Scan status: ${{ steps.scan_asset.outputs.status }}"
          echo "File size: ${{ steps.scan_asset.outputs.file-size }} bytes"
          echo "Real file type: ${{ steps.scan_asset.outputs.real-file-type }}"
          if [ -n "${{ steps.scan_asset.outputs.finding }}" ]; then
            echo "Finding: ${{ steps.scan_asset.outputs.finding }}"
          fi

      - name: Cleanup test release
        if: always() && steps.create_release.outcome == 'success'
        run: |
          if [ -n "${{ steps.create_release.outputs.tag_name }}" ]; then
            gh release delete "${{ steps.create_release.outputs.tag_name }}" --yes --cleanup-tag || true
          fi
        env:
          GH_TOKEN: ${{ github.token }}

  local_file_scan_large:
    name: Test large local file (80MB)
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Generate 80MB local file
        run: |
          mkdir test-data
          head -c 83886080 </dev/urandom >test-data/random-80mb-file

      - name: Create temporary branch and commit file
        id: create_temp_branch
        run: |
          BRANCH_NAME="ci-tests-${{ github.run_number }}-${{ github.run_attempt }}"
          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git checkout -b "$BRANCH_NAME"
          git add test-data/random-80mb-file
          git commit -m "Add 80MB test file for CI"
          git push origin "$BRANCH_NAME"
          echo "Temporary branch created: $BRANCH_NAME"

      - name: Scan local random-80mb-file
        id: scan_local_80mb
        uses: ./
        env:
          GIT_REF: ${{ steps.create_temp_branch.outputs.branch_name }}
        with:
          local-file-path: test-data/random-80mb-file
          api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
          token: ${{ github.token }}
          fail-on-infected: true

      - name: Display large local file scan results
        run: |
          echo "Scan status: ${{ steps.scan_local_80mb.outputs.status }}"
          echo "File size: ${{ steps.scan_local.outputs_80mb.file-size }} bytes"
          echo "Real file type: ${{ steps.scan_local_80mb.outputs.real-file-type }}"
          if [ -n "${{ steps.scan_local_80mb.outputs.finding }}" ]; then
            echo "Finding: ${{ steps.scan_local_80mb.outputs.finding }}"
          fi

      - name: Cleanup temporary branch
        if: always() && steps.create_temp_branch.outcome == 'success'
        run: |
          if [ -n "${{ steps.create_temp_branch.outputs.branch_name }}" ]; then
            git push origin --delete "${{ steps.create_temp_branch.outputs.branch_name }}" || true
          fi

  artifact_scan_large:
    name: Test large artifact (>200MB)
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Create large test data
        run: |
          mkdir test-data
          head -c 83886080 </dev/urandom >test-data/random-80mb-file
          cp test-data/random-80mb-file test-data/random-80mb-file2
          cp test-data/random-80mb-file test-data/random-80mb-file3
          cp test-data/random-80mb-file test-data/random-80mb-file4

      - name: Upload test-data/ folder as artifact
        id: upload_artifact_large
        uses: actions/upload-artifact@v6
        with:
          name: test-data-folder
          path: test-data/
          retention-days: 1 # set retention to avoid a full storage

      - name: Scan large artifact
        id: scan_artifact_large
        uses: ./
        with:
          artifact-id: ${{ steps.upload_artifact_large.outputs.artifact-id }}
          api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
          token: ${{ github.token }}
          fail-on-infected: true

      - name: Display large artifact scan results
        run: |
          echo "Scan status: ${{ steps.scan_artifact_large.outputs.status }}"
          echo "File size: ${{ steps.scan_artifact_large.outputs.file-size }} bytes"
          echo "Real file type: ${{ steps.scan_artifact_large.outputs.real-file-type }}"
          if [ -n "${{ steps.scan_artifact_large.outputs.finding }}" ]; then
            echo "Finding: ${{ steps.scan_artifact_large.outputs.finding }}"
          fi

      - name: Cleanup large artifact file
        if: always() && steps.upload_artifact_large.outcome == 'success'
        run: |
          if [ -n "${{ steps.upload_artifact_large.outputs.artifact-id }}" ]; then
            curl -L \
              -X DELETE \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer ${{ github.token }}" \
              -H "X-GitHub-Api-Version: 2022-11-28" \
              https://api.github.com/repos/${{ github.repository }}/actions/artifacts/${{ steps.upload_artifact_large.outputs.artifact-id }}
          fi

  release_scan_large:
    name: Test large release (>200MB)
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Create large test data
        run: |
          mkdir test-data
          head -c 83886080 </dev/urandom >test-data/random-80mb-file
          cp test-data/random-80mb-file test-data/random-80mb-file2
          cp test-data/random-80mb-file test-data/random-80mb-file3
          cp test-data/random-80mb-file test-data/random-80mb-file4

      - name: Create release with test-data/ asset
        id: create_release_large
        run: |
          # Zip test data folder
          zip -r test-data.zip test-data/

          # Create a large test release with test-data.zip as an asset
          TAG_NAME="large-test-v${{ github.run_number }}"
          gh release create "$TAG_NAME" test-data.zip \
            --title "Large Test Release ${{ github.run_number }}" \
            --notes "Automated large test release for attachmentAV scanning" \
            --repo ${{ github.repository }}

          # Get the asset ID
          ASSET_ID=$(gh api repos/${{ github.repository }}/releases/tags/$TAG_NAME \
            --jq '.assets[] | select(.name == "test-data.zip") | .id')
          echo "asset_id=$ASSET_ID" >> $GITHUB_OUTPUT
          echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
          echo "Release created: $TAG_NAME"
          echo "Asset ID: $ASSET_ID"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Scan release asset
        id: scan_asset_large
        uses: ./
        with:
          release-asset-id: ${{ steps.create_release_large.outputs.asset_id }}
          api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
          token: ${{ github.token }}
          fail-on-infected: true

      - name: Display large release asset scan results
        run: |
          echo "Scan status: ${{ steps.scan_asset_large.outputs.status }}"
          echo "File size: ${{ steps.scan_asset_large.outputs.file-size }} bytes"
          echo "Real file type: ${{ steps.scan_asset_large.outputs.real-file-type }}"
          if [ -n "${{ steps.scan_asset_large.outputs.finding }}" ]; then
            echo "Finding: ${{ steps.scan_asset_large.outputs.finding }}"
          fi

      - name: Cleanup large release
        if: always() && steps.create_release_large.outcome == 'success'
        run: |
          if [ -n "${{ steps.create_release_large.outputs.tag_name }}" ]; then
            gh release delete "${{ steps.create_release_large.outputs.tag_name }}" --yes --cleanup-tag || true
          fi
        env:
          GH_TOKEN: ${{ github.token }}