jodosjodos
39f03add71
- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner. - Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management. - Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions. - Implemented a README.md to provide documentation on usage, features, and setup instructions. - Included necessary scripts for building the action and handling security measures during execution. - Established a structured directory for reports and workspace management within Docker. - Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.
57 lines
2.5 KiB
Bash
57 lines
2.5 KiB
Bash
# Copy to .env and fill in. NEVER commit your real .env.
|
|
# cp .env.example .env
|
|
#
|
|
# Docker Compose auto-loads .env for variable substitution. For direct
|
|
# `node bin/polinrider.js` runs, export these in your shell instead.
|
|
|
|
# ─── Required ──────────────────────────────────────────────────────────────────
|
|
|
|
# GitHub Personal Access Token (classic) with scopes: repo (full) + read:org.
|
|
GH_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
|
|
# Target account — set EXACTLY ONE of the following (comment out the other).
|
|
# • GH_ORG → scans every repo in the organization.
|
|
# • GH_USER → scans every repo you OWN under your personal account.
|
|
# Your GitHub organization name (e.g. mycompany):
|
|
GH_ORG=your-org-name
|
|
# Your personal GitHub username (uncomment to clean personal repos instead):
|
|
# GH_USER=your-username
|
|
|
|
# ─── Recommended for a first run ─────────────────────────────────────────────────
|
|
|
|
# Pilot against specific repo(s) before scanning the whole account. Comma-separated.
|
|
# Each entry is "name" (the GH_ORG/GH_USER owner is prefixed) or "owner/name".
|
|
# Leave empty to scan the entire account.
|
|
# GH_REPO=my-first-repo
|
|
GH_REPO=
|
|
|
|
# DRY_RUN=true scans + reports the planned surgical changes but writes nothing
|
|
# and opens no PRs. Start with true; set to false only once you're satisfied.
|
|
DRY_RUN=true
|
|
|
|
# Auto-merge the cleanup PRs (default false). Respects branch protection: PRs that
|
|
# require reviews/checks are left open and reported, not bypassed. Needs a token
|
|
# with merge rights on the repos.
|
|
AUTO_MERGE=false
|
|
# Merge method when AUTO_MERGE=true: squash | merge | rebase.
|
|
# MERGE_METHOD=squash
|
|
|
|
# ─── Optional (sane defaults — usually leave unset) ──────────────────────────────
|
|
|
|
# Where JSON + Markdown run reports are written (the container mounts ./reports
|
|
# here). Set empty to disable report files.
|
|
# REPORTS_DIR=reports
|
|
|
|
# Where repos are cloned (the container provides /workspace via tmpfs).
|
|
# WORKSPACE=/workspace
|
|
|
|
# Where repos are cloned (the container provides /workspace via tmpfs).
|
|
# WORKSPACE=/workspace
|
|
|
|
# Branch name prefix for the cleanup PRs.
|
|
# BRANCH_PREFIX=fix/polinrider-cleanup
|
|
|
|
# Extra hardening: freeze built-in prototypes (--frozen-intrinsics). Experimental;
|
|
# leave off unless you've confirmed it doesn't break the run.
|
|
# POLINRIDER_FROZEN=1
|