Add VirusTotal scanning of bootloaders to CI

[danyeaw]

Closes #8372 by matrix building all the Windows bootloaders and uploading them to VirusTotal for each push to the develop branch.

[bwoodsend]

If you remember, can you add [skip ci] to your commit message title so that the main CI test job isn't spinning away on a change that doesn't affect it.

[danyeaw]

@bwoodsend It looks like [skip ci] disables all workflows, so I'll just temporarily disable the main CI workflow and drop the commit later

[bwoodsend]

I've added a VIRUSTOTAL_API_KEY to this repo's secrets although, since secrets are hidden for PRs from forks, the on: pull_request trigger is effectively a no go. Perhaps a workflow_dispatch (for verifying) plus a schedule trigger would be better? Then you could add your own key to your fork, trigger it there and post a link to the job here?

[danyeaw]

Hi @bwoodsend, thanks for creating the secret!

I was thinking once this is tested we make it only on push to develop, but I'm good with workflow_dispatch and a schedule. Maybe we should run it nightly?

[danyeaw]

Workflow run completed successfully: https://github.com/danyeaw/pyinstaller/actions/runs/8680718643/job/23801928189
It looks like you can only do workflow_dispatch on the main branch of a repo, so I merged these changes in to my fork's develop branch and I can force push the develop branch later to sync back up.

[bwoodsend]

Is there a reason for the exact pins on actions/{download,upload}-artifact? Looks good otherwise.

[danyeaw]

@bwoodsend I am actually used to pinning to the hash for security, but pins to the major versions updated to be consistent. Thanks for the feedback!

[rokm]

The workflow looks good to me, but I'm not sure about the news fragment. If this will appear under "Features" section under PyInstaller's release changelog, it will likely give incorrect impression that this is a build-time feature.

There is a process news category, but I think we should do without news fragment at all, to minimize confusion.

[danyeaw]

Hi @rokm, thanks for the feedback! I dropped the news fragment 👍

[bwoodsend]

Thanks again