Add Daily Malicious Code Scan workflow

[github-actions]

This PR adds a new Daily Malicious Code Scan security workflow, along with its documentation page and README entry.

Phase 1: Consistency Check

No inconsistencies were found between ./workflows/, ./docs/, and README.md. All workflow files have matching docs pages and README entries.

Phase 2: New Workflow — Daily Malicious Code Scan

Source

Adapted from daily-malicious-code-scan.md in the gh-aw repository.

Merge Rate

The security workflow family is documented in the [Security-related Workflows blog post]((github.github.io/redacted) The Daily Malicious Code Scan complements other security tools (CodeQL, Dependabot) with change-focused analysis of recent commits.

Why It's Valuable

As AI-assisted code generation becomes common, new supply chain risks emerge — a compromised agent or dependency could silently inject credential-harvesting code, a crypto miner, or a backdoor. This workflow:

• Runs daily and scans all files changed in the last 3 days
• Looks for secret exfiltration patterns, suspicious network calls, obfuscated code, out-of-context additions, and privilege escalation
• Reports findings as GitHub native code-scanning alerts (visible in the Security tab alongside CodeQL and Dependabot)
• Provides threat scores and actionable remediation steps
• Works with any programming language — no configuration required

Generalization Plan

The original workflow contained Go-specific file location checks (e.g., verifying Go files are inside cmd/ or pkg/ directories). These were replaced with language-agnostic checks:

• Removed: Go-specific directory structure validation
• Added: General checks for executable files added to source directories
• Added: General base64 payload detection pattern
• Kept: Core secret exfiltration, suspicious network, system operations, and obfuscation detection logic unchanged
• Kept: create-code-scanning-alert output (GitHub native, works in any repo)

Files Changed

• workflows/daily-malicious-code-scan.md — generalized workflow spec
• docs/daily-malicious-code-scan.md — documentation page
• README.md — new "Security Workflows" section with entry

Generated by Daily Repo Goal Achiever

[dsyme]

THis is too corner case