jodosjodos
39f03add71
- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner. - Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management. - Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions. - Implemented a README.md to provide documentation on usage, features, and setup instructions. - Included necessary scripts for building the action and handling security measures during execution. - Established a structured directory for reports and workspace management within Docker. - Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.
40 lines
1.4 KiB
Docker
40 lines
1.4 KiB
Docker
FROM node:20-slim
|
|
|
|
# Install git, gh CLI, bash, curl, ca-certs
|
|
RUN apt-get update && apt-get install -y \
|
|
git \
|
|
curl \
|
|
ca-certificates \
|
|
gnupg \
|
|
--no-install-recommends \
|
|
&& mkdir -p /etc/apt/keyrings \
|
|
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
|
|
| gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
|
|
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
|
|
> /etc/apt/sources.list.d/github-cli.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y gh \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create non-root user
|
|
RUN groupadd --gid 1001 scanner \
|
|
&& useradd --uid 1001 --gid scanner --shell /bin/bash --create-home scanner
|
|
|
|
# App directory owned by non-root user
|
|
WORKDIR /app
|
|
COPY --chown=scanner:scanner . .
|
|
|
|
# Install Node deps. .npmrc sets ignore-scripts=true, so no dependency lifecycle
|
|
# scripts run during install (defense-in-depth). --ignore-scripts is explicit too.
|
|
RUN npm ci --omit=dev --ignore-scripts
|
|
|
|
# Repos will be cloned here at runtime (tmpfs or volume)
|
|
RUN mkdir -p /workspace && chown scanner:scanner /workspace
|
|
|
|
# Switch to non-root
|
|
USER scanner
|
|
|
|
# Run via the hardened launcher (applies --disallow-code-generation-from-strings).
|
|
ENTRYPOINT ["node", "bin/polinrider.js"]
|