feat: add VirusTotal scan results sidebar card to plugin detail page

[Rezn1r]

Description

Adds VirusTotal API v3 scanning for plugin artifacts when a version is submitted for review. After a build is submitted, a vt-scans BullMQ job is enqueued and consumed by a new Worker in the API server. The worker downloads artifacts from storage, uploads them to VT, polls until analysis completes, and stores per-version results (malicious/suspicious/undetected counts, engine total, permalink, scan date).

Supports both plugin types:

• Python: single .whl artifact → 1 scan
• C++: .so + .dll artifacts → 2 scans with a 15s rate-limit gap, worst-case result stored

Results are surfaced via the existing getBySlug API endpoint (8 new fields on each version object) and consumed by a new VirusTotalCard sidebar component on the frontend (separate PR on endgit-web).

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Changes

• Prisma schema: 8 new nullable fields on Version model (vtScanId, vtStatus, vtMalicious, vtSuspicious, vtUndetected, vtTotal, vtPermalink, vtScanDate)
• virustotal.service.ts (new): VT API v3 client — file upload, analysis polling (30s interval, 20 retries / 10 min timeout), scanVersion orchestrator with multi-artifact support
• src/index.ts: BullMQ Worker("vt-scans") consumer with concurrency: 1 and Redis TLS detection
• submit.service.ts: Sets vtStatus: "queued" on version create/update; enqueues scan job after transaction with artifact keys parsed per plugin type
• plugins.service.ts: VT fields added to getBySlug version select
• .env.example: VT_API_KEY added

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings

Notes

• Free tier rate limits (4 req/min, 500/day) respected via concurrency: 1 and 15s gap between C++ artifacts
• If VT API fails or times out, vtStatus is set to "failed" — the worker logs and continues without crashing
• pnpm db:push must be run against the database after merging to apply the schema migration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
endgit-web	Ready	Preview, Comment	May 21, 2026 5:17pm

[Rezn1r]

linked pr:

two-tech-dev/endgit-core#17
https://github.com/two-tech-dev/endgit-worker/pull/10