Monitor for Suspicious Repo Copies #392
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Last updated: 2025-05-08 | |
| name: Monitor for Suspicious Repo Copies | |
| on: | |
| workflow_dispatch: | |
| jobs: | |
| check-repos: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Search GitHub for similar repo names | |
| run: | | |
| echo "🔍 Searching for suspicious clones..." | |
| declare -a targets=("rdcj-research.github.io" "symbolicresonance.github.io" "rdcjazinski.github.io") | |
| touch matches.txt | |
| for repo_name in "${targets[@]}"; do | |
| echo "🔍 Searching for $repo_name..." | |
| curl -s -H "Accept: application/vnd.github+json" \ | |
| "https://api.github.com/search/repositories?q=${repo_name}+in:name" > search_results.json | |
| jq -r '.items[] | select(.owner.login != "rdcj-research") | .full_name' search_results.json >> matches.txt | |
| done | |
| sort -u matches.txt -o matches.txt | |
| touch flagged_repos.txt | |
| while read repo; do | |
| echo "🔎 Checking $repo..." | |
| for file in CNAME LICENSE index.md; do | |
| status=$(curl -s -o /dev/null -w "%{http_code}" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| "https://api.github.com/repos/$repo/contents/$file") | |
| if [ "$status" = "200" ]; then | |
| echo "⚠️ Found $file in $repo" | |
| echo "https://github.com/$repo (contains $file)" >> flagged_repos.txt | |
| break # Only one match per repo needed | |
| fi | |
| done | |
| done < matches.txt | |
| if [[ -s flagged_repos.txt ]]; then | |
| echo "found=true" >> $GITHUB_ENV | |
| else | |
| echo "found=false" >> $GITHUB_ENV | |
| fi | |
| - name: Open issue if clones are flagged | |
| if: env.found == 'true' | |
| uses: actions/github-script@v7 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const fs = require('fs'); | |
| const matches = fs.readFileSync('flagged_repos.txt', 'utf8'); | |
| await github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: "⚠️ Potential copy detected (CNAME / LICENSE / index.md)", | |
| body: `The following repositories were found with suspicious similarity to your public domains and contain at least one of: \`CNAME\`, \`LICENSE\`, or \`index.md\`.\n\n${matches}\n\nPlease review them for potential misuse or unauthorized replication.\n\n_Automated scan triggered by repository monitoring workflow._` | |
| }); |