jodosjodos
39f03add71
- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner. - Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management. - Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions. - Implemented a README.md to provide documentation on usage, features, and setup instructions. - Included necessary scripts for building the action and handling security measures during execution. - Established a structured directory for reports and workspace management within Docker. - Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.
47 lines
1.7 KiB
YAML
47 lines
1.7 KiB
YAML
services:
|
|
polinrider-cleanup:
|
|
build: .
|
|
image: polinrider-cleanup:latest
|
|
container_name: polinrider-cleanup
|
|
|
|
environment:
|
|
# Pass your GitHub PAT (needs repo + org:read scopes)
|
|
# Set this in your shell: export GH_TOKEN=ghp_...
|
|
- GH_TOKEN=${GH_TOKEN}
|
|
- GITHUB_TOKEN=${GH_TOKEN} # gh CLI reads either
|
|
# Target account — set EXACTLY ONE (comment out the other):
|
|
- GH_ORG=${GH_ORG:-} # an org name, e.g. mycompany
|
|
- GH_USER=${GH_USER:-} # OR your personal username (scans repos you own)
|
|
- DRY_RUN=${DRY_RUN:-false} # set to "true" to skip PR creation
|
|
- GH_REPO=${GH_REPO:-} # optional: scope to one/few repos (comma-separated) for a pilot
|
|
- AUTO_MERGE=${AUTO_MERGE:-false} # optional: auto-merge cleanup PRs (respects branch protection)
|
|
- MERGE_METHOD=${MERGE_METHOD:-squash} # squash | merge | rebase
|
|
- REPORTS_DIR=${REPORTS_DIR:-reports} # JSON + Markdown run reports land here (mounted below)
|
|
|
|
# JSON + Markdown scan/remediation reports are written here (host ./reports).
|
|
volumes:
|
|
- ./reports:/app/reports
|
|
|
|
# No network access except github.com — drop everything else
|
|
# (requires Docker with custom network + external DNS)
|
|
# For stricter isolation remove this and use default bridge
|
|
network_mode: bridge
|
|
|
|
# Drop all Linux capabilities — scanner needs none
|
|
cap_drop:
|
|
- ALL
|
|
|
|
# Read-only root fs — only /workspace and /app/reports are writable
|
|
read_only: true
|
|
tmpfs:
|
|
- /workspace:exec,mode=1777,size=2g
|
|
- /tmp:mode=1777,size=128m
|
|
- /home/scanner:mode=755,size=64m
|
|
|
|
# Resource limits
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: "2"
|
|
memory: 3G
|