ci(security): scan Nuitka build artifacts before publishing release assets (#76) #123

Merged

ValleyGeek merged 1 commit from 0.1.42/issue-76-build-security-scanning into main

2026-06-22 01:36:45 +00:00

Claude commented

2026-06-22 00:34:18 +00:00

Member

Summary

#76 — both release jobs (Linux AppImage, Windows release) now run a security scan on the freshly built artifact, after the Nuitka build and before it's published as a Forgejo release asset:
- ClamAV scans the AppImage/exe; a detection fails the build.
- Static analysis is informational only and never fails the build: checksec/readelf/file on Linux, an Authenticode signature check + PE section/entropy dump (via pefile) on Windows.
- VirusTotal upload is optional infrastructure: it skips quietly when no VT_API_KEY secret is configured, and never fails the build on a network error or a detection — it only links the multi-engine report.
- Each step writes its summary (including the artifact's SHA256) to the job's step summary. Documented in README under a new "Security scanning" section.
CI/workflow-only change — no src/resources/pyproject.toml changes, so no VERSION bump per AGENTS.md.

Test plan

Workflow YAML reviewed for correctness
No app-level pytest/smoke needed (CI-only change)

Refs #76.

Stacked on #122 — part of the 11-PR sequential chain into main.

## Summary - **#76** — both release jobs (Linux AppImage, Windows release) now run a security scan on the freshly built artifact, after the Nuitka build and before it's published as a Forgejo release asset: - ClamAV scans the AppImage/exe; a detection fails the build. - Static analysis is informational only and never fails the build: checksec/readelf/file on Linux, an Authenticode signature check + PE section/entropy dump (via pefile) on Windows. - VirusTotal upload is optional infrastructure: it skips quietly when no `VT_API_KEY` secret is configured, and never fails the build on a network error or a detection — it only links the multi-engine report. - Each step writes its summary (including the artifact's SHA256) to the job's step summary. Documented in README under a new "Security scanning" section. - CI/workflow-only change — no `src`/`resources`/`pyproject.toml` changes, so no VERSION bump per AGENTS.md. ## Test plan - [x] Workflow YAML reviewed for correctness - [x] No app-level pytest/smoke needed (CI-only change) Refs #76. Stacked on #122 — part of the 11-PR sequential chain into `main`.

Claude added 1 commit

2026-06-22 00:34:18 +00:00

ci(security): scan Nuitka build artifacts before publishing release assets

CI / lint (push) Successful in 7s

Details

CI / test (push) Failing after 1m50s

Details

CI / appimage (push) Has been skipped

Details

CI / windows-exe (push) Has been skipped

Details

CI / build-appimage (push) Failing after 0s

Details

CI / build-windows-exe (push) Failing after 0s

Details

fcfbc39ab8

Both release jobs (linux-appimage.yml, windows-release.yml) now run a
security scan on the freshly built artifact, after the Nuitka build and
before it's published as a Forgejo release asset:

- ClamAV scans the AppImage/exe; a detection fails the build, so a published
  release was never flagged by ClamAV's signature database at build time
  (scripts/security-scan-artifact.py).
- Static analysis is informational only and never fails the build: checksec/
  readelf/file on Linux, an Authenticode signature check + PE section/entropy
  dump (via pefile) on Windows.
- VirusTotal upload is optional infrastructure: it skips quietly when no
  VT_API_KEY secret is configured, and never fails the build on a network
  error or a detection — it only links the multi-engine report
  (scripts/virustotal-scan.py).

Each step writes its summary (including the artifact's SHA256) to the job's
GITHUB_STEP_SUMMARY. Documented in README under a new "Security scanning"
section. No src/resources/pyproject.toml changes, so no VERSION bump per
AGENTS.md (workflow/script-only).

Fixes #76

Claude referenced this pull request

2026-06-22 00:34:53 +00:00

feat(thumbnails): configurable thumbnail generation thread count (#64) #124

Claude referenced this pull request

2026-06-22 00:40:29 +00:00

[Security]: Add comprehensive security scanning to Nuitka build jobs #76

Claude force-pushed 0.1.42/issue-76-build-security-scanning from fcfbc39ab8

CI / lint (push) Successful in 7s

Details

CI / test (push) Failing after 1m50s

Details

CI / appimage (push) Has been skipped