jodosjodos
39f03add71
- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner. - Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management. - Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions. - Implemented a README.md to provide documentation on usage, features, and setup instructions. - Included necessary scripts for building the action and handling security measures during execution. - Established a structured directory for reports and workspace management within Docker. - Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.
77 lines
2.9 KiB
YAML
77 lines
2.9 KiB
YAML
name: "PolinRider Malware Scanner"
|
|
description: "Scan a repository for PolinRider malware — fail the check, auto-clean the working tree, or open a cleanup PR."
|
|
author: "RMSoft-ltd"
|
|
|
|
branding:
|
|
icon: "shield"
|
|
color: "red"
|
|
|
|
inputs:
|
|
mode:
|
|
description: "What to do on detection: check (scan + fail), fix (clean the working tree), or pr (open a cleanup PR)."
|
|
required: false
|
|
default: "check"
|
|
path:
|
|
description: "Directory to scan, relative to the workspace root."
|
|
required: false
|
|
default: "."
|
|
exclude:
|
|
description: 'Comma/newline-separated paths or globs to skip (repo-relative), e.g. "test/**, vendor/**". Useful to ignore files that legitimately contain malware signatures.'
|
|
required: false
|
|
default: ""
|
|
token:
|
|
description: "GitHub token used for pr mode, fix + commit, and PR comments."
|
|
required: false
|
|
default: ${{ github.token }}
|
|
fail-on:
|
|
description: "Severity that fails the job: infected | suspicious | never."
|
|
required: false
|
|
default: "infected"
|
|
commit:
|
|
description: "In fix mode, commit and push the cleaned files back to the branch (push events only)."
|
|
required: false
|
|
default: "false"
|
|
comment-on-pr:
|
|
description: "Post the scan report as a comment on pull_request events (needs pull-requests: write)."
|
|
required: false
|
|
default: "true"
|
|
sarif-file:
|
|
description: "Write a SARIF report to this path for upload to GitHub code scanning (empty = skip)."
|
|
required: false
|
|
default: ""
|
|
dry-run:
|
|
# No action default on purpose: omitting it lets the DRY_RUN env var apply.
|
|
# Effective default false.
|
|
description: "Scan and plan remediation without writing files, pushing, or opening PRs. Also reads the DRY_RUN env var. Default: false."
|
|
required: false
|
|
auto-merge:
|
|
# No action default on purpose: omitting it lets the AUTO_MERGE env var apply.
|
|
description: "In pr mode, auto-merge the cleanup PR (respects branch protection). Also reads the AUTO_MERGE env var. Default: false."
|
|
required: false
|
|
merge-method:
|
|
description: "Merge method when auto-merge is on: squash | merge | rebase. Also reads the MERGE_METHOD env var. Default: squash."
|
|
required: false
|
|
branch-prefix:
|
|
description: "Branch name prefix for pr mode. Also reads the BRANCH_PREFIX env var. Default: fix/polinrider-cleanup."
|
|
required: false
|
|
|
|
outputs:
|
|
severity:
|
|
description: "clean | suspicious | infected."
|
|
infected:
|
|
description: "true when a confirmed PolinRider payload was found."
|
|
findings-count:
|
|
description: "Number of findings."
|
|
changed:
|
|
description: "true when files were modified or deleted (fix/pr modes)."
|
|
remediated:
|
|
description: "true when any file was cleaned or removed."
|
|
pr-url:
|
|
description: "URL of the cleanup PR (pr mode)."
|
|
sarif-file:
|
|
description: "Path to the written SARIF report, if any."
|
|
|
|
runs:
|
|
using: "node24"
|
|
main: "dist/ci.mjs"
|