[afeezorobsco-cyber]

What changed

Adds a workflow_dispatch trigger to pr-malware-scan.yml, with inputs prs (all, or space-separated PR numbers) and dry_run, plus a backfill() entry point in pr-malware-scan.cjs.

Why

Malware scan became a required check today, but it only runs when a PR is opened or pushed to. PRs opened before the scanner existed have no result, so they're blocked until their author pushes. Backfill scans them now, and is reusable after any rule change.

How it works

For each open PR it runs the same scan, posts or updates the usual comment and security-review label, and records a Malware scan commit status on the PR's head commit: success if clean, failure if there are HIGH findings. That status satisfies the required check exactly like the check run a normal push produces. Unknown or closed PR numbers are skipped, and a PR whose scan errors gets no status, so it's retried later rather than wrongly passed.

Security

The trust model is unchanged: the PR is read only as data through the API, and nothing from it is checked out or executed. The only new permission is statuses: write. Dispatch inputs reach the script through env, never ${{ }} interpolation into code. Only users with write access can trigger workflow_dispatch.

Testing

Dry-ran backfill locally over all 58 open escrow PRs, with writes stubbed out (about 2 minutes). The results match the earlier full-repo testing: escrow #183 is clean, and HIGH findings appear only on the 7 known PRs (#137, #138, #175, #176, #182, #201, #202). A nonexistent number and a merged PR (#203) are skipped without aborting the run.

After merging

Go to Actions → PR malware scan → Run workflow with prs: all, or I can trigger it.

Which ROADMAP.md item does this close/progress?

Extends the existing malware-scan item in ROADMAP.md.

🤖 Generated with Claude Code

[github-actions]

Malware scan: passed, with notes for the reviewer

Nothing malicious was detected in 775f05a. These changes touch sensitive areas and should get a careful look before CI is approved:

Where	Rule	Why
.github/workflows/pr-malware-scan.yml:17	workflow-change	Changes a CI workflow; a maintainer must review before approving runs.