Remove sudo in clamav

Signed-off-by: Samet Akcay <[email protected]>

Author: samet-akcay

.github/actions/security/clamav/action.yaml

@@ -65,10 +65,6 @@ inputs:
     description: "Maximum file size to scan in MB"
     required: false
     default: "100"
-  max_scan_size:
-    description: "Maximum scan data size in MB"
-    required: false
-    default: "400"
   output_format:
     description: "Format for scan results (json/txt)"
     required: false
@@ -92,95 +88,80 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Install ClamAV
-      shell: bash
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y clamav clamav-daemon
-        sudo systemctl stop clamav-freshclam
-
-    - name: Update virus definitions
-      shell: bash
-      run: sudo freshclam --quiet
-
     - name: Get changed files
       if: inputs.scan_scope == 'changed'
       id: changed-files
       uses: tj-actions/changed-files@v41
 
     - name: Run ClamAV scan
       id: run-clamav
-      shell: bash
-      run: |
-        REPORT_FILE="clamav-report.${{ inputs.output_format }}"
-        EXCLUDE_DIRS=$(echo "${{ inputs.exclude_dirs }}" | tr ',' ' ' | sed 's/[^ ]* */--exclude-dir=&/g')
-
-        # Convert MB to bytes for ClamAV
-        MAX_FILE_SIZE=$(( ${{ inputs.max_file_size }} * 1024 * 1024 ))
-        MAX_SCAN_SIZE=$(( ${{ inputs.max_scan_size }} * 1024 * 1024 ))
-
-        if [[ "${{ inputs.scan_scope }}" == "changed" && -n "${{ steps.changed-files.outputs.all_changed_files }}" ]]; then
-          echo "Running ClamAV on changed files"
-          FILES="${{ steps.changed-files.outputs.all_changed_files }}"
-          SCAN_CMD="clamscan"
-        else
-          echo "Running ClamAV on all files in ${{ inputs.paths }}"
-          FILES="${{ inputs.paths }}"
-          SCAN_CMD="clamscan -r"
-        fi
-
-        # Create temporary file for raw scan output
-        TEMP_OUTPUT=$(mktemp)
-
-        echo "Running scan with max file size: ${MAX_FILE_SIZE} bytes"
-        echo "Running scan with max scan size: ${MAX_SCAN_SIZE} bytes"
-
-        ${SCAN_CMD} \
-          --max-filesize=${MAX_FILE_SIZE} \
-          --max-scansize=${MAX_SCAN_SIZE} \
-          ${EXCLUDE_DIRS} \
-          ${FILES} 2>&1 | tee ${TEMP_OUTPUT}
-
-        SCAN_EXIT_CODE=${PIPESTATUS[0]}
-        echo "exit_code=${SCAN_EXIT_CODE}" >> $GITHUB_OUTPUT
-
-        # Parse scan summary
-        SCANNED_FILES=$(grep "Scanned files:" ${TEMP_OUTPUT} | awk '{print $3}')
-        INFECTED_FILES=$(grep "Infected files:" ${TEMP_OUTPUT} | awk '{print $3}')
-        START_DATE=$(grep "Start Date:" ${TEMP_OUTPUT} | cut -d: -f2- | xargs)
-        END_DATE=$(grep "End Date:" ${TEMP_OUTPUT} | cut -d: -f2- | xargs)
-
-        # Generate report in requested format
-        if [[ "${{ inputs.output_format }}" == "json" ]]; then
+      uses: docker://clamav/clamav:stable
+      env:
+        GITHUB_OUTPUT: /tmp/gh_output
+      with:
+        entrypoint: sh
+        args: |
+          -c "
+          # Update virus definitions
+          freshclam --quiet
+
+          # Prepare exclude dirs
+          EXCLUDE_DIRS=`echo '${{ inputs.exclude_dirs }}' | tr ',' ' ' | sed 's/[^ ]* */--exclude-dir=&/g'`
+
+          # Convert MB to bytes
+          MAX_FILE_SIZE=`expr ${{ inputs.max_file_size }} \* 1024 \* 1024`
+
+          # Create output directory
+          mkdir -p security-results/clamav
+
+          # Run scan based on scope
+          if [ '${{ inputs.scan_scope }}' = 'changed' ] && [ -n '${{ steps.changed-files.outputs.all_changed_files }}' ]; then
+            echo 'Running ClamAV on changed files'
+            FILES='${{ steps.changed-files.outputs.all_changed_files }}'
+            SCAN_CMD='clamscan'
+          else
+            echo 'Running ClamAV on all files in ${{ inputs.paths }}'
+            FILES='${{ inputs.paths }}'
+            SCAN_CMD='clamscan -r'
+          fi
+
+          # Run scan and capture output
+          $SCAN_CMD \
+            --max-filesize=$MAX_FILE_SIZE \
+            $EXCLUDE_DIRS \
+            $FILES \
+            > scan_output.txt 2>&1
+
+          SCAN_EXIT_CODE=$?
+
+          # Count infected files
+          INFECTED_FILES=`grep 'Infected files:' scan_output.txt | awk '{print $3}'`
+          if [ -z \"$INFECTED_FILES\" ]; then
+            INFECTED_FILES=0
+          fi
+
+          # Generate report
+          if [ '${{ inputs.output_format }}' = 'json' ]; then
+            echo '{
+              \"scan_summary\": {
+                \"files_scanned\": '`grep 'Scanned files:' scan_output.txt | awk '{print $3}'`',
+                \"threats_found\": '$INFECTED_FILES',
+                \"start_time\": \"'`grep 'Start time:' scan_output.txt | cut -d: -f2- | xargs`'\",
+                \"end_time\": \"'`grep 'End time:' scan_output.txt | cut -d: -f2- | xargs`'\"
+              }
+            }' > security-results/clamav/report.json
+          else
+            cp scan_output.txt security-results/clamav/report.txt
+          fi
+
+          # Write to outputs file
           {
-            echo "{"
-            echo "  \"scan_summary\": {"
-            echo "    \"files_scanned\": ${SCANNED_FILES:-0},"
-            echo "    \"threats_found\": ${INFECTED_FILES:-0},"
-            echo "    \"start_date\": \"${START_DATE}\","
-            echo "    \"end_date\": \"${END_DATE}\""
-            echo "  },"
-            echo "  \"threats\": ["
-            # Only try to process threats if there are any
-            if [ "${INFECTED_FILES:-0}" -gt 0 ]; then
-              grep "FOUND" ${TEMP_OUTPUT} | while IFS= read -r line; do
-                FILE=$(echo "$line" | cut -d: -f1)
-                THREAT=$(echo "$line" | awk '{print $NF}')
-                echo "    {\"file\": \"${FILE}\", \"threat\": \"${THREAT}\"},"
-              done | sed '$ s/,$//'
-            fi
-            echo "  ]"
-            echo "}"
-          } > "${REPORT_FILE}"
-        else
-          cp ${TEMP_OUTPUT} "${REPORT_FILE}"
-        fi
-
-        echo "report_path=${REPORT_FILE}" >> $GITHUB_OUTPUT
-        echo "threats_found=${INFECTED_FILES:-0}" >> $GITHUB_OUTPUT
-
-        rm ${TEMP_OUTPUT}
-
-        if [[ "${{ inputs.fail_on_findings }}" == "true" && "${INFECTED_FILES:-0}" -gt 0 ]]; then
-          exit 1
-        fi
+            echo \"exit_code=$SCAN_EXIT_CODE\"
+            echo \"threats_found=$INFECTED_FILES\"
+            echo \"report_path=security-results/clamav/report.${{ inputs.output_format }}\"
+          } > \"$GITHUB_OUTPUT\"
+
+          if [ '${{ inputs.fail_on_findings }}' = 'true' ] && [ $INFECTED_FILES -gt 0 ]; then
+            exit 1
+          fi
+          "