Jenkins

Use this declarative pipeline on a Linux agent where Docker is available:

pipeline {
  agent any

  options {
    buildDiscarder(logRotator(daysToKeepStr: '30', artifactDaysToKeepStr: '30'))
  }

  stages {
    stage('Scan for malware') {
      steps {
        sh '''
          mkdir -p amwscan-output
          docker run --rm \
            --volume "$WORKSPACE:/scan:ro" \
            --volume "$WORKSPACE/amwscan-output:/output" \
            marcocesarato/php-antimalware-scanner:latest /scan \
            --lite --report-only --report-format=sarif \
            --path-report=/output/amwscan-report.sarif \
            --disable-checksum --disable-definitions-update
        '''
      }
    }
  }

  post {
    always {
      archiveArtifacts artifacts: 'amwscan-output/amwscan-report.sarif', allowEmptyArchive: true
    }
  }
}

The workspace is mounted read only. The separate output directory remains writable so Jenkins can archive the SARIF report after a finding causes the scan stage to fail. The pipeline retains reports for 30 days.