Add initial implementation of PolinRider malware scanner

- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner.
- Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management.
- Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions.
- Implemented a README.md to provide documentation on usage, features, and setup instructions.
- Included necessary scripts for building the action and handling security measures during execution.
- Established a structured directory for reports and workspace management within Docker.
- Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.

docker-compose.yml

@@ -0,0 +1,46 @@
+services:
+  polinrider-cleanup:
+    build: .
+    image: polinrider-cleanup:latest
+    container_name: polinrider-cleanup
+
+    environment:
+      # Pass your GitHub PAT (needs repo + org:read scopes)
+      # Set this in your shell: export GH_TOKEN=ghp_...
+      - GH_TOKEN=${GH_TOKEN}
+      - GITHUB_TOKEN=${GH_TOKEN}   # gh CLI reads either
+      # Target account — set EXACTLY ONE (comment out the other):
+      - GH_ORG=${GH_ORG:-}         # an org name, e.g. mycompany
+      - GH_USER=${GH_USER:-}       # OR your personal username (scans repos you own)
+      - DRY_RUN=${DRY_RUN:-false}  # set to "true" to skip PR creation
+      - GH_REPO=${GH_REPO:-}       # optional: scope to one/few repos (comma-separated) for a pilot
+      - AUTO_MERGE=${AUTO_MERGE:-false}     # optional: auto-merge cleanup PRs (respects branch protection)
+      - MERGE_METHOD=${MERGE_METHOD:-squash} # squash | merge | rebase
+      - REPORTS_DIR=${REPORTS_DIR:-reports}  # JSON + Markdown run reports land here (mounted below)
+
+    # JSON + Markdown scan/remediation reports are written here (host ./reports).
+    volumes:
+      - ./reports:/app/reports
+
+    # No network access except github.com — drop everything else
+    # (requires Docker with custom network + external DNS)
+    # For stricter isolation remove this and use default bridge
+    network_mode: bridge
+
+    # Drop all Linux capabilities — scanner needs none
+    cap_drop:
+      - ALL
+
+    # Read-only root fs — only /workspace and /app/reports are writable
+    read_only: true
+    tmpfs:
+      - /workspace:exec,mode=1777,size=2g
+      - /tmp:mode=1777,size=128m
+      - /home/scanner:mode=755,size=64m
+
+    # Resource limits
+    deploy:
+      resources:
+        limits:
+          cpus: "2"
+          memory: 3G