CI & code scanning

malware-detector is a normal CLI with stable exit codes, so it works on any CI provider. The recipes below are ready to copy.

GitHub Actions

Gate every pull request

# .github/workflows/malware.yml
name: malware-scan
on: [pull_request, push]

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pipx install malware-detector-py
      - run: malware-detector scan . --fail-on HIGH

GitHub code scanning

Upload SARIF to see findings as annotations on pull requests and in Security → Code scanning:

# .github/workflows/malware.yml
name: malware-scan
on: [pull_request, push]

permissions:
  contents: read
  security-events: write # upload SARIF

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pipx install malware-detector-py
      - name: Scan
        # Keep going on findings so the upload step still runs; we fail later.
        run: malware-detector scan . --sarif > malware.sarif || echo "FOUND=1" >> "$GITHUB_ENV"
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: malware.sarif
          category: malware-detector
      - name: Fail on findings
        if: env.FOUND == '1'
        run: exit 1

INFO

Code scanning is free for public repositories. Private repositories need GitHub Advanced Security.

GitLab CI

# .gitlab-ci.yml
malware-scan:
  image: ghcr.io/benzid-wael/malware-detector:latest
  entrypoint: [""]
  script:
    - malware-detector scan . --fail-on HIGH

Any other CI (Jenkins, CircleCI, Buildkite, Bitbucket…)

Use the Docker image. Nothing needs to be installed on the runner:

docker run --rm -v "$PWD:/scan:ro" ghcr.io/benzid-wael/malware-detector:latest scan . --fail-on HIGH

Scanning dependencies in CI

To check your installed dependency tree as well (for example after npm ci), add --include-deps. Many legitimate libraries use risky capabilities, so gate on HIGH and keep a reviewed ignore file:

npm ci --ignore-scripts
malware-detector scan . --include-deps --fail-on HIGH

--ignore-scripts stops a malicious postinstall from running before you've scanned it.