[CI] issue: 4705805 Add antivirus scan to release job

Add antivirus scan step to the release job to scan release packages.

Signed-off-by: Noam Tsemah <[email protected]>

Author: ntsemah

.ci/antivirus.sh

@@ -0,0 +1,45 @@
+#!/bin/bash -Exel
+
+echo -e "\n\n**********************************"
+echo -e "\n\nStarting antivirus.sh script...\n\n"
+echo -e "**********************************\n\n"
+
+[[ -z "$WORKSPACE" ]] && { echo "ERROR: WORKSPACE variable is empty"; exit 1; }
+[[ ! -d "$WORKSPACE" ]] && { echo "ERROR: ${WORKSPACE} does not exist"; exit 1; }
+[[ -z "$release_folder" ]] && { echo "ERROR: release_folder variable is empty"; exit 1; }
+[[ ! -d "$release_folder" ]] && { echo "ERROR: ${release_folder} does not exist"; exit 1; }
+[[ -z "$release_tag" ]] && { echo "ERROR: release_tag variable is empty"; exit 1; }
+
+if [ -z "${revision}" ]; then
+    echo "WARN: 'revision' was not set, defaulting to 1"
+    revision=1
+fi
+
+release_src_folder="${release_folder}/vma_v_${release_tag}-0/src"
+[[ ! -d "$release_src_folder" ]] && { echo "ERROR: ${release_src_folder} does not exist"; exit 1; }
+
+pkg_name="libvma-${release_tag}-${revision}.src.rpm"
+tarball_name="libvma-${release_tag}.tar.gz"
+
+if ! [[ -e "${release_src_folder}/${pkg_name}" ]]; then
+    echo "ERROR: ${release_src_folder}/${pkg_name} does not exist. Exit"
+    exit 1
+fi
+
+if ! [[ -e "${release_src_folder}/${tarball_name}" ]]; then
+    echo "ERROR: ${release_src_folder}/${tarball_name} does not exist. Exit"
+    exit 1
+fi
+
+mkdir -p "${WORKSPACE}/logs/"
+RPM_LOG="${WORKSPACE}/logs/${pkg_name}_antivirus.log"
+TARBALL_LOG="${WORKSPACE}/logs/${tarball_name}_antivirus.log"
+
+/auto/GLIT/SCRIPTS/HELPERS/antivirus-scan.sh "${release_src_folder}/${pkg_name}" 2>&1 | tee "$RPM_LOG" || true
+/auto/GLIT/SCRIPTS/HELPERS/antivirus-scan.sh "${release_src_folder}/${tarball_name}" 2>&1 | tee "$TARBALL_LOG" || true
+
+if grep -q 'Possibly Infected:.............     0' "$RPM_LOG" && grep -q 'Possibly Infected:.............     0' "$TARBALL_LOG"; then
+    exit 0
+else
+    exit 1
+fi

.ci/pipeline/release_jjb.yaml

@@ -34,7 +34,11 @@
         - bool:
             name: "do_release"
             default: true
-            description: "Release build packges into the release folder, set to false for debugging"
+            description: "Release build packages into the release folder, set to false for debugging"
+        - bool:
+            name: "do_antivirus"
+            default: true
+            description: "Run Antivirus scan."
         - string:
             name: "notification_email"
             default: "{jjb_release_email}"

.ci/pipeline/release_matrix_job.yaml

@@ -24,6 +24,8 @@ volumes:
   - {mountPath: /auto/mswg/release/vma, hostPath: /auto/mswg/release/vma}
   # User profile for release
   - {mountPath: /var/home/swx-jenkins, hostPath: /labhome/swx-jenkins}
+  # for Antivirus
+  - {mountPath: /auto/GLIT/SCRIPTS/HELPERS, hostPath: /auto/GLIT/SCRIPTS/HELPERS}
 
 empty_volumes:
   - {mountPath: /tmp/source_rpms, memory: true}
@@ -35,7 +37,9 @@ runs_on_dockers:
       uri: '$arch/$name/release',
       build_args: '--no-cache',
       arch: 'x86_64',
-      tag: '20250128'
+      tag: '20250128',
+      runAsUser: '6213',
+      runAsGroup: '101'
     }
 
 steps:
@@ -45,6 +49,12 @@ steps:
       .ci/do_release.sh
     archiveArtifacts: pkg/build_pkg.log,pkg/packages/*.rpm
 
+  - name: Antivirus
+    enable: ${do_antivirus}
+    run: |
+      env WORKSPACE=$PWD .ci/antivirus.sh
+    archiveArtifacts: 'logs/'
+
 pipeline_start:
     shell: action
     module: groovy