AccuKnox Malware Scan Action

A standalone GitHub Action to agentlessly scan container images for malware using ClamAV.

This action extracts the target container's filesystem and scans it using an ephemeral Docker container. This ensures zero dependencies on the GitHub runner, requires no image rebuilding, and natively produces detailed JSON reports ready for release assets or API ingestion.

✨ Features

• Agentless Scanning: Utilizes the official ClamAV Docker engine on the fly.
• Zero Rebuilds: Reuses the exact same image reference you just built .
• Detailed JSON Output: Generates a structured malware-scan-results.json containing scan duration, files scanned, and exact paths of infected files.
• Pipeline Control: Configure exit_code to fail your CI/CD pipeline if malware is detected.

---

🚀 Usage

Here is a complete workflow example showing how to build an image, scan it for malware, and attach the scan results to a GitHub Release:

name: Build and Malware Scan

on:
  push:
    tags:
      - 'v*'

env:
  IMAGE_NAME: my-organization/my-app

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Build Container Image
        run: |
          docker build -t ${{ env.IMAGE_NAME }}:${{ github.ref_name }} .

      - name: Run AccuKnox Malware Scan
        uses: accuknox/malware-scan@v1
        with:
          repository_name: ${{ env.IMAGE_NAME }}
          tag: ${{ github.ref_name }}
          exit_code: "1" # Fails the pipeline if malware is detected

      - name: Attach Scan Result to Release
        uses: softprops/action-gh-release@v2
        with:
          files: malware-scan-results.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}