GitHub Actions

Create .github/workflows/malware-scan.yml in the repository you want to scan:

name: Malware scan

on:
  push:
  pull_request:
  schedule:
    - cron: '0 0 * * 0'

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Scan for malware
        id: amwscan
        uses: marcocesarato/PHP-Antimalware-Scanner@master
        with:
          path: .
          mode: lite
          report-format: sarif
          ignore-paths: '*/cache/*,*/logs/*'

      - name: Upload SARIF report
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.amwscan.outputs.report-path }}

The default scan checks the repository in Lite mode and fails the job when it finds a security issue. The final step uploads the SARIF report to Security > Code scanning even when the scan step fails.

Configure the scan

Input	Default	Purpose
path	.	File or directory to scan.
mode	lite	Select full, lite, signatures, exploits, or functions.
report-format	sarif	Write html, txt, json, or sarif.
report-path	amwscan-report	Set the report path; AMWScan adds the format extension when needed.
php-version	8.3	Select the PHP runtime used by the action.
scan-archives	false	Inspect entries in ZIP archives within resource limits.
scan-all	false	Scan files regardless of extension.
ignore-paths	Empty	Exclude comma-separated paths or wildcard patterns.
disable-checksum	false	Disable supported platform and framework checksum checks.
disable-definitions-update	true	Skip remote Maltrail definition updates.
fail-on-findings	true	Return exit code 1 when the scan has findings.

The action exposes exit-code and report-path outputs. Set fail-on-findings: false to collect findings without failing the job; scanner and source errors still fail with exit code 2.

Keep an HTML report

Use an artifact when your team wants to inspect the standalone HTML report instead of uploading SARIF:

- name: Scan for malware
  id: amwscan
  uses: marcocesarato/PHP-Antimalware-Scanner@master
  with:
    report-format: html

- name: Upload scan report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: amwscan-report
    path: ${{ steps.amwscan.outputs.report-path }}
    retention-days: 30

Reports can contain local paths and matched code. Restrict artifact access and retention to the people who review security findings.