Should I expect virus detection?

[mk-pmb]

Hi! Thanks for this great project! I tried to test it, and it seems that fortunately, my repo is clean.
So I made a test branch where I uploaded the EICAR test file as eicar-test.txt and my repo still was clean. That's ok.
I then renamed it to eicar-test.com and my repo still was clean. I had expected an alert now.
I suspected an encoding issue, so I checked the SHA-1 of my file, but it's as expected, 3395856ce81f2b7382dee72602f798b642f14140.
Does it mean we don't have any standard virus scanning in audit-ci? Should we have it?

[quinnturner]

This is out of the scope of this project.

The scope of this project involves using the package manager's audit feature and adding functionality like allowlisting advisories for dedicated periods of time.

Since package manager's audit features do not report viruses, that's out of scope for this package.