8282 outputs :
8383 default_report : ${{ steps.scan.outputs.default_report }}
8484 armv7_report : ${{ steps.scan.outputs.armv7_report }}
85+ default_status : ${{ steps.scan.outputs.default_status }}
86+ armv7_status : ${{ steps.scan.outputs.armv7_status }}
8587 steps :
8688 - name : Download APKs
8789 uses : actions/download-artifact@v4
9496 VT_API_KEY : ${{ secrets.VIRUSTOTAL_API_KEY }}
9597 VERSION : ${{ needs.build.outputs.version_name }}
9698 run : |
99+ RESULT_URL=""
100+ RESULT_STATUS=""
97101 upload_and_poll() {
98102 local file="$1"
99103 local sha256
@@ -107,7 +111,8 @@ jobs:
107111 --url https://www.virustotal.com/api/v3/files/upload_url \
108112 --header "x-apikey: $VT_API_KEY" | jq -r '.data')
109113 if [ -z "$upload_url" ] || [ "$upload_url" = "null" ]; then
110- echo "https://www.virustotal.com/gui/file/$sha256/detection"
114+ RESULT_URL="https://www.virustotal.com/gui/file/$sha256/detection"
115+ RESULT_STATUS="⬜ N/A"
111116 return
112117 fi
113118 fi
@@ -117,23 +122,46 @@ jobs:
117122 --header "x-apikey: $VT_API_KEY" \
118123 --form "file=@$file" | jq -r '.data.id')
119124 if [ -z "$analysis_id" ] || [ "$analysis_id" = "null" ]; then
120- echo "https://www.virustotal.com/gui/file/$sha256/detection"
125+ RESULT_URL="https://www.virustotal.com/gui/file/$sha256/detection"
126+ RESULT_STATUS="⬜ N/A"
121127 return
122128 fi
129+ local last_response=""
123130 for i in $(seq 1 30); do
124131 sleep 20
125- local status
126- status=$(curl -sS \
132+ last_response=$(curl -sS \
127133 --url "https://www.virustotal.com/api/v3/analyses/$analysis_id" \
128- --header "x-apikey: $VT_API_KEY" | jq -r '.data.attributes.status')
129- [ "$status" = "completed" ] && break
134+ --header "x-apikey: $VT_API_KEY")
135+ local poll_status
136+ poll_status=$(echo "$last_response" | jq -r '.data.attributes.status')
137+ [ "$poll_status" = "completed" ] && break
130138 done
131- echo "https://www.virustotal.com/gui/file/$sha256/detection"
139+ local malicious suspicious undetected harmless total detected
140+ malicious=$(echo "$last_response" | jq -r '.data.attributes.stats.malicious // 0')
141+ suspicious=$(echo "$last_response" | jq -r '.data.attributes.stats.suspicious // 0')
142+ undetected=$(echo "$last_response" | jq -r '.data.attributes.stats.undetected // 0')
143+ harmless=$(echo "$last_response" | jq -r '.data.attributes.stats.harmless // 0')
144+ total=$((malicious + suspicious + undetected + harmless))
145+ detected=$((malicious + suspicious))
146+ if [ "$detected" -eq 0 ]; then
147+ RESULT_STATUS="✅ ${detected}/${total} Clean"
148+ else
149+ RESULT_STATUS="⚠️ ${detected}/${total} Detected"
150+ fi
151+ RESULT_URL="https://www.virustotal.com/gui/file/$sha256/detection"
132152 }
133- DEFAULT_REPORT=$(upload_and_poll "PlainApp-${VERSION}-default.apk")
134- ARMV7_REPORT=$(upload_and_poll "PlainApp-${VERSION}-armeabi-v7a.apk")
135- echo "default_report=$DEFAULT_REPORT" >> $GITHUB_OUTPUT
136- echo "armv7_report=$ARMV7_REPORT" >> $GITHUB_OUTPUT
153+ upload_and_poll "PlainApp-${VERSION}-default.apk"
154+ DEFAULT_REPORT="$RESULT_URL"
155+ DEFAULT_STATUS="$RESULT_STATUS"
156+ upload_and_poll "PlainApp-${VERSION}-armeabi-v7a.apk"
157+ ARMV7_REPORT="$RESULT_URL"
158+ ARMV7_STATUS="$RESULT_STATUS"
159+ {
160+ echo "default_report=$DEFAULT_REPORT"
161+ echo "armv7_report=$ARMV7_REPORT"
162+ echo "default_status=$DEFAULT_STATUS"
163+ echo "armv7_status=$ARMV7_STATUS"
164+ } >> $GITHUB_OUTPUT
137165
138166 release :
139167 needs : [build, provenance, virustotal]
@@ -162,10 +190,10 @@ jobs:
162190 ## Security
163191
164192 ### VirusTotal Scan
165- | APK | Scan Report |
166- |-----|-------------|
167- | `PlainApp-${{ needs.build.outputs.version_name }}-default.apk` | [View Report](${{ needs.virustotal.outputs.default_report }}) |
168- | `PlainApp-${{ needs.build.outputs.version_name }}-armeabi-v7a.apk` | [View Report](${{ needs.virustotal.outputs.armv7_report }}) |
193+ | APK | Status | Scan Report |
194+ |-----|--------|-------- -----|
195+ | `PlainApp-${{ needs.build.outputs.version_name }}-default.apk` | ${{ needs.virustotal.outputs.default_status }} | [View Report](${{ needs.virustotal.outputs.default_report }}) |
196+ | `PlainApp-${{ needs.build.outputs.version_name }}-armeabi-v7a.apk` | ${{ needs.virustotal.outputs.armv7_status }} | [View Report](${{ needs.virustotal.outputs.armv7_report }}) |
169197
170198 ### SLSA Provenance (Level 3)
171199 The `.intoto.jsonl` file attached to this release is a signed SLSA provenance document.
0 commit comments