innovative-vas/PolinRider Malware Scanner

Scan a repository for PolinRider malware — fail the check, auto-clean the working tree, or open a cleanup PR.

Trust Signals

name	description	required	default
mode	What to do on detection: check (scan + fail), fix (clean the working tree), or pr (open a cleanup PR).	no	check
path	Directory to scan, relative to the workspace root.	no	.
exclude	Comma/newline-separated paths or globs to skip (repo-relative), e.g. "test/, vendor/". Useful to ignore files that legitimately contain malware signatures.	no	""
token	GitHub token used for pr mode, fix + commit, and PR comments.	no	${{ github.token }}
fail-on	Severity that fails the job: infected \| suspicious \| never.	no	infected
commit	In fix mode, commit and push the cleaned files back to the branch (push events only).	no	false
comment-on-pr	Post the scan report as a comment on pull_request events (needs pull-requests: write).	no	true
sarif-file	Write a SARIF report to this path for upload to GitHub code scanning (empty = skip).	no	""
dry-run	Scan and plan remediation without writing files, pushing, or opening PRs. Also reads the DRY_RUN env var. Default: false.	no	—
auto-merge	In pr mode, auto-merge the cleanup PR (respects branch protection). Also reads the AUTO_MERGE env var. Default: false.	no	—
merge-method	Merge method when auto-merge is on: squash \| merge \| rebase. Also reads the MERGE_METHOD env var. Default: squash.	no	—
branch-prefix	Branch name prefix for pr mode. Also reads the BRANCH_PREFIX env var. Default: fix/polinrider-cleanup.	no	—

name	description
severity	clean \| suspicious \| infected.
infected	true when a confirmed PolinRider payload was found.
findings-count	Number of findings.
changed	true when files were modified or deleted (fix/pr modes).
remediated	true when any file was cleaned or removed.
pr-url	URL of the cleanup PR (pr mode).
sarif-file	Path to the written SARIF report, if any.