gchq · IR96334 · Feb 19, 2026 · Jan 16, 2026 · Jan 20, 2026 · Jan 22, 2026
diff --git a/backend/config/default.cjs b/backend/config/default.cjs
@@ -185,7 +185,7 @@ module.exports = {
     },
   },
 
-  avScanning: {
+  artefactScanning: {
     clamdscan: {
       concurrency: 2,
       host: '127.0.0.1',
@@ -277,7 +277,7 @@ module.exports = {
       kind: 'silly',
     },
 
-    fileScanners: {
+    artefactScanners: {
       kinds: [],
       retryDelayInMinutes: 60,
       maxInitRetries: 5,

diff --git a/backend/config/dev_docker_compose.cjs b/backend/config/dev_docker_compose.cjs
@@ -74,7 +74,7 @@ module.exports = {
     region: 'ignored',
   },
 
-  avScanning: {
+  artefactScanning: {
     clamdscan: {
       host: 'clamd',
     },
@@ -85,7 +85,7 @@ module.exports = {
   },
 
   connectors: {
-    fileScanners: {
+    artefactScanners: {
       kinds: ['clamAV', 'modelScan'],
       retryDelayInMinutes: 60,
       maxInitRetries: 5,

diff --git a/backend/config/prod_docker_compose.cjs b/backend/config/prod_docker_compose.cjs
@@ -67,7 +67,7 @@ module.exports = {
     region: 'ignored',
   },
 
-  avScanning: {
+  artefactScanning: {
     clamdscan: {
       host: 'clamd',
     },
@@ -78,7 +78,7 @@ module.exports = {
   },
 
   connectors: {
-    fileScanners: {
+    artefactScanners: {
       kinds: ['clamAV', 'modelScan'],
       retryDelayInMinutes: 60,
       maxInitRetries: 5,

diff --git a/backend/src/clients/modelScan.ts b/backend/src/clients/modelScan.ts
@@ -51,7 +51,7 @@ interface ModelScanResponse {
 }
 
 export async function getModelScanInfo() {
-  const url = `${config.avScanning.modelscan.protocol}://${config.avScanning.modelscan.host}:${config.avScanning.modelscan.port}`
+  const url = `${config.artefactScanning.modelscan.protocol}://${config.artefactScanning.modelscan.host}:${config.artefactScanning.modelscan.port}`
   let res: FetchResponse
 
   try {
@@ -70,7 +70,7 @@ export async function getModelScanInfo() {
 }
 
 export async function scanStream(stream: Readable, fileName: string) {
-  const url = `${config.avScanning.modelscan.protocol}://${config.avScanning.modelscan.host}:${config.avScanning.modelscan.port}`
+  const url = `${config.artefactScanning.modelscan.protocol}://${config.artefactScanning.modelscan.host}:${config.artefactScanning.modelscan.port}`
   let res: FetchResponse
 
   try {

diff --git a/backend/src/connectors/artefactScanning/Base.ts b/backend/src/connectors/artefactScanning/Base.ts
@@ -0,0 +1,64 @@
+import PQueue from 'p-queue'
+
+import { FileInterface } from '../../models/File.js'
+import { ImageRefInterface } from '../../models/Release.js'
+import { ScanInterface } from '../../models/Scan.js'
+import log from '../../services/log.js'
+import { ArtefactTypeKeys } from '../../types/types.js'
+
+export type ArtefactScanResult = Pick<
+  ScanInterface,
+  'toolName' | 'scannerVersion' | 'state' | 'summary' | 'additionalInfo' | 'lastRunAt'
+>
+
+//NOTE: This is a placeholder, in preparation towards image scanning implementation
+export type ArtefactInterface = FileInterface | ImageRefInterface
+
+export const ArtefactScanState = {
+  NotScanned: 'notScanned',
+  InProgress: 'inProgress',
+  Complete: 'complete',
+  Error: 'error',
+} as const
+export type ArtefactScanStateKeys = (typeof ArtefactScanState)[keyof typeof ArtefactScanState]
+
+export type ArtefactScanningConnectorInfo = Pick<ArtefactScanResult, 'toolName' | 'scannerVersion'>
+
+export abstract class ArtefactBaseScanningConnector {
+  abstract readonly toolName: string
+  abstract readonly version: string | undefined
+  abstract readonly queue: PQueue
+  abstract artefactType: ArtefactTypeKeys
+
+  info(): ArtefactScanningConnectorInfo {
+    return { toolName: this.toolName, scannerVersion: this.version }
+  }
+
+  abstract init()
+
+  abstract _scan(artefact: ArtefactInterface): Promise<ArtefactScanResult>
+
+  async scan(artefact: ArtefactInterface): Promise<ArtefactScanResult> {
+    log.debug({ artefact, ...this.info(), queueSize: this.queue.size }, 'Queueing scan.')
+    const scanResult = await this.queue
+      .add(() => this._scan(artefact))
+      .catch((error) => {
+        return this.scanError('Queued scan threw an error.', { error, artefact })
+      })
+    // return type of `queue.add()` is Promise<void | ...> so reject void responses
+    if (scanResult === null || typeof scanResult !== 'object') {
+      return this.scanError('Queued scan failed to correctly return.', { artefact })
+    }
+    return scanResult
+  }
+
+  async scanError(message: string, context?: object): Promise<ArtefactScanResult> {
+    const scannerInfo = this.info()
+    log.error({ ...context, ...scannerInfo }, message)
+    return {
+      ...scannerInfo,
+      state: ArtefactScanState.Error,
+      lastRunAt: new Date(),
+    }
+  }
+}
diff --git a/...end/src/connectors/fileScanning/clamAv.ts → ...src/connectors/artefactScanning/clamAv.ts b/...end/src/connectors/fileScanning/clamAv.ts → ...src/connectors/artefactScanning/clamAv.ts
@@ -3,9 +3,11 @@ import PQueue from 'p-queue'
 
 import { getObjectStream } from '../../clients/s3.js'
 import { FileInterfaceDoc } from '../../models/File.js'
+import { ClamAVSummary } from '../../models/Scan.js'
 import log from '../../services/log.js'
+import { ArtefactType, ArtefactTypeKeys } from '../../types/types.js'
 import config from '../../utils/config.js'
-import { BaseQueueFileScanningConnector, FileScanResult, ScanState } from './Base.js'
+import { ArtefactBaseScanningConnector, ArtefactScanResult, ArtefactScanState } from './Base.js'
 
 function safeParseVersion(versionStr: string): string {
   try {
@@ -19,8 +21,9 @@ function safeParseVersion(versionStr: string): string {
   }
 }
 
-export class ClamAvFileScanningConnector extends BaseQueueFileScanningConnector {
-  queue: PQueue = new PQueue({ concurrency: config.avScanning.clamdscan.concurrency })
+export class ClamAvFileScanningConnector extends ArtefactBaseScanningConnector {
+  queue: PQueue = new PQueue({ concurrency: config.artefactScanning.clamdscan.concurrency })
+  artefactType: ArtefactTypeKeys = ArtefactType.FILE
   toolName = 'Clam AV'
   version: string | undefined = undefined
   av: NodeClam | undefined = undefined
@@ -30,14 +33,14 @@ export class ClamAvFileScanningConnector extends BaseQueueFileScanningConnector
   }
 
   async init() {
-    this.av = await new NodeClam().init({ clamdscan: config.avScanning.clamdscan })
+    this.av = await new NodeClam().init({ clamdscan: config.artefactScanning.clamdscan })
     const scannerVersion = await this.av.getVersion()
     this.version = safeParseVersion(scannerVersion)
     log.debug({ ...this.info() }, 'Initialised Clam AV scanner')
     return this
   }
 
-  async _scan(file: FileInterfaceDoc): Promise<FileScanResult[]> {
+  async _scan(file: FileInterfaceDoc): Promise<ArtefactScanResult> {
     const scannerInfo = this.info()
     if (!this.av) {
       return await this.scanError(`Could not use ${this.toolName} as it is not been correctly initialised.`, {
@@ -48,17 +51,21 @@ export class ClamAvFileScanningConnector extends BaseQueueFileScanningConnector
     const s3Stream = await getObjectStream(file.path)
 
     try {
-      const { isInfected, viruses } = await this.av.scanStream(s3Stream)
-      log.debug({ file, result: { isInfected, viruses }, ...scannerInfo }, 'Scan complete.')
-      return [
-        {
-          ...scannerInfo,
-          state: ScanState.Complete,
-          isInfected,
-          viruses,
-          lastRunAt: new Date(),
-        },
-      ]
+      const { viruses } = await this.av.scanStream(s3Stream)
+      log.debug({ file, result: { viruses }, ...scannerInfo }, 'Scan complete.')
+      const summary: ClamAVSummary[] = viruses.map(
+        (virus) =>
+          ({
+            virus,
+          }) as ClamAVSummary,
+      )
+
+      return {
+        ...scannerInfo,
+        state: ArtefactScanState.Complete,
+        summary,
+        lastRunAt: new Date(),
+      }
     } catch (error) {
       return this.scanError(`This file could not be scanned due to an error caused by ${this.toolName}`, {
         error: Error.isError(error) ? { name: error.name, stack: error.stack } : error,

diff --git a/backend/src/connectors/artefactScanning/index.ts b/backend/src/connectors/artefactScanning/index.ts
@@ -0,0 +1,52 @@
+import config from '../../utils/config.js'
+import { ConfigurationError } from '../../utils/error.js'
+import { ArtefactBaseScanningConnector } from './Base.js'
+import { ClamAvFileScanningConnector } from './clamAv.js'
+import { ModelScanFileScanningConnector } from './modelScan.js'
+import { ArtefactScanningWrapper } from './wrapper.js'
+
+export const ArtefactScanKind = {
+  ClamAv: 'clamAV',
+  ModelScan: 'modelScan',
+} as const
+export type ArtefactScanKindKeys = (typeof ArtefactScanKind)[keyof typeof ArtefactScanKind]
+
+const artefactScanConnectors: Set<ArtefactBaseScanningConnector> = new Set<ArtefactBaseScanningConnector>()
+let scannerWrapper: undefined | ArtefactScanningWrapper = undefined
+
+async function addArtefactScanners(cache = true): Promise<ArtefactScanningWrapper> {
+  if (scannerWrapper && cache) {
+    return scannerWrapper
+  }
+  artefactScanConnectors.clear()
+  for (const artefactScanner of config.connectors.artefactScanners.kinds) {
+    switch (artefactScanner) {
+      case ArtefactScanKind.ClamAv:
+        try {
+          const scanner = new ClamAvFileScanningConnector()
+          artefactScanConnectors.add(scanner)
+        } catch (error) {
+          throw ConfigurationError('Could not configure or initialise Clam AV', { error })
+        }
+        break
+      case ArtefactScanKind.ModelScan:
+        try {
+          const scanner = new ModelScanFileScanningConnector()
+          artefactScanConnectors.add(scanner)
+        } catch (error) {
+          throw ConfigurationError('Could not configure or initialise ModelScan', { error })
+        }
+        break
+      default:
+        throw ConfigurationError(`'${artefactScanner}' is not a valid file scanning kind.`, {
+          validKinds: Object.values(ArtefactScanKind),
+        })
+    }
+  }
+
+  scannerWrapper = new ArtefactScanningWrapper(artefactScanConnectors)
+  await scannerWrapper.initialiseScanners()
+  return scannerWrapper
+}
+
+export default await addArtefactScanners()
diff --git a/.../src/connectors/fileScanning/modelScan.ts → .../connectors/artefactScanning/modelScan.ts b/.../src/connectors/fileScanning/modelScan.ts → .../connectors/artefactScanning/modelScan.ts
@@ -3,12 +3,15 @@ import PQueue from 'p-queue'
 import { getModelScanInfo, scanStream } from '../../clients/modelScan.js'
 import { getObjectStream } from '../../clients/s3.js'
 import { FileInterfaceDoc } from '../../models/File.js'
+import { ModelScanSummary, SeverityLevelKeys } from '../../models/Scan.js'
 import log from '../../services/log.js'
+import { ArtefactType, ArtefactTypeKeys } from '../../types/types.js'
 import config from '../../utils/config.js'
-import { BaseQueueFileScanningConnector, FileScanResult, ScanState } from './Base.js'
+import { ArtefactBaseScanningConnector, ArtefactScanResult, ArtefactScanState } from './Base.js'
 
-export class ModelScanFileScanningConnector extends BaseQueueFileScanningConnector {
-  queue: PQueue = new PQueue({ concurrency: config.avScanning.modelscan.concurrency })
+export class ModelScanFileScanningConnector extends ArtefactBaseScanningConnector {
+  queue: PQueue = new PQueue({ concurrency: config.artefactScanning.modelscan.concurrency })
+  artefactType: ArtefactTypeKeys = ArtefactType.FILE
   toolName: string = 'ModelScan'
   version: string | undefined = undefined
 
@@ -22,7 +25,7 @@ export class ModelScanFileScanningConnector extends BaseQueueFileScanningConnect
     return this
   }
 
-  async _scan(file: FileInterfaceDoc): Promise<FileScanResult[]> {
+  async _scan(file: FileInterfaceDoc): Promise<ArtefactScanResult> {
     await this.init()
     const scannerInfo = this.info()
     if (!scannerInfo.scannerVersion) {
@@ -42,21 +45,21 @@ export class ModelScanFileScanningConnector extends BaseQueueFileScanningConnect
         })
       }
 
-      const issues = scanResults.summary.total_issues
-      const isInfected = issues > 0
-      const viruses: string[] = isInfected
-        ? scanResults.issues.map((issue) => `${issue.severity}: ${issue.description}. ${issue.scanner}`)
-        : []
-      log.debug({ file, result: { isInfected, viruses }, ...scannerInfo }, 'Scan complete.')
-      return [
-        {
-          ...scannerInfo,
-          state: ScanState.Complete,
-          isInfected,
-          viruses,
-          lastRunAt: new Date(),
-        },
-      ]
+      const summary: ModelScanSummary[] = scanResults.issues.map(
+        (issue) =>
+          ({
+            severity: issue.severity.toLowerCase() as SeverityLevelKeys,
+            vulnerabilityDescription: `${issue.description}. (scanner: ${issue.scanner})`,
+          }) as ModelScanSummary,
+      )
+
+      log.debug({ file, result: { summary }, ...scannerInfo }, 'Scan complete.')
+      return {
+        ...scannerInfo,
+        state: ArtefactScanState.Complete,
+        summary,
+        lastRunAt: new Date(),
+      }
     } catch (error) {
       return this.scanError(`This file could not be scanned due to an error caused by ${this.toolName}`, {
         error: Error.isError(error) ? { name: error.name, stack: error.stack } : error,