Add initial implementation of PolinRider malware scanner

- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner.
- Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management.
- Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions.
- Implemented a README.md to provide documentation on usage, features, and setup instructions.
- Included necessary scripts for building the action and handling security measures during execution.
- Established a structured directory for reports and workspace management within Docker.
- Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.

.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - run: npm ci
+      - name: Unit tests
+        run: npm test
+      - name: Unit tests (hardened)
+        run: npm run test:hardened
+
+  bundle:
+    # The committed dist/ci.mjs is what the action runs (no install step at
+    # action runtime), so it must always match src/. Rebuild and fail on drift.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - run: npm ci
+      - name: Rebuild action bundle
+        run: npm run build:action
+      - name: Verify dist/ is up to date
+        run: |
+          if ! git diff --quiet -- dist/; then
+            echo "::error::dist/ is stale. Run 'npm run build:action' and commit the result."
+            git --no-pager diff -- dist/
+            exit 1
+          fi
+
+  self-scan:
+    # Dogfood + self-protection: scan our OWN code for PolinRider malware on
+    # every push/PR. We exclude only the files that legitimately contain
+    # signature strings — the signature catalog, the payload fixtures, and the
+    # bundle that inlines them. Everything else (real source, bin/, scripts/,
+    # configs) is scanned for real, so an actual infection here would fail CI.
+    runs-on: ubuntu-latest
+    needs: bundle
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./
+        with:
+          mode: check
+          comment-on-pr: false
+          exclude: |
+            src/signatures.js
+            test/**
+            dist/**

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release
+
+# Tag a release (e.g. `git tag v1.2.0 && git push --tags`) to:
+#   1. verify the committed bundle is fresh,
+#   2. create a GitHub Release, and
+#   3. move the major tag (e.g. v1) to this commit so consumers can pin `@v1`.
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - run: npm ci
+
+      - name: Tests
+        run: npm test
+
+      - name: Verify committed bundle is fresh
+        run: |
+          npm run build:action
+          if ! git diff --quiet -- dist/; then
+            echo "::error::dist/ does not match src/. Build and commit dist/ before tagging."
+            exit 1
+          fi
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes
+
+      - name: Move major tag (vN → this commit)
+        run: |
+          MAJOR="${GITHUB_REF_NAME%%.*}"   # v1.2.0 -> v1
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -f "$MAJOR"
+          git push -f origin "refs/tags/$MAJOR"