Add MIT license and GitHub Actions CI

Author: rootverdict

.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.14"]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install project
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install .
+
+      - name: Run tests
+        run: python -m pytest -q
+
+      - name: Compile Python sources
+        run: >-
+          python -m compileall -q
+          attck converters core enrichment extractor generators ingestion ioc
+          quality reporting review tests main.py

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 rootverdict
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,5 +1,7 @@
 # MalForge
 
+[![CI](https://github.com/rootverdict/MalForge/actions/workflows/ci.yml/badge.svg)](https://github.com/rootverdict/MalForge/actions/workflows/ci.yml)
+
 Local malware behavior to detection-rule pipeline for sandbox JSON reports. The project parses Cuckoo, CAPE, and ANY.RUN reports, extracts behavior, maps to MITRE ATT&CK, generates Sigma rules, converts them to Wazuh XML, scores and validates output, creates synthetic test events, and builds analyst-facing reports.
 
 ## Safety
@@ -152,6 +154,7 @@ Evidence files:
 This validates broad externally sourced URL/IOC report handling. It does not prove compatibility with every possible sandbox/vendor schema.
 
 The URLhaus validation set also includes a Mozi `elf/mips` sample-style report. For that case the pipeline now emits Linux/generic telemetry rules instead of Windows/Sysmon rules, preserves raw IP values as generic network evidence without forcing an application-protocol or Remote Services mapping, preserves direct HTTP URL evidence as web-protocol behavior, tags non-standard ports with T1571, and reports missing payload hashes as source-data limitations when URL-only metadata does not include MD5/SHA1/SHA256 values.
+
 ## Current Limitations
 
 - VirusTotal and MISP enrichment modules build local descriptors but do not make API calls
@@ -168,7 +171,11 @@ The URLhaus validation set also includes a Mozi `elf/mips` sample-style report.
 - Improve Sigma selector fidelity and rule grouping
 - Add optional Wazuh deployment packaging and manager-side validation
 - Export consolidated pipeline manifests
-- Add optional packaging and CI workflow polish
+- Add automated release and artifact publishing
+
+## License
+
+MalForge is released under the [MIT License](LICENSE).
 
 
 

tests/test_repository_metadata.py

@@ -50,3 +50,21 @@ def test_generated_handbook_is_ignored() -> None:
     }
 
     assert "MALFORGE_COMPLETE_PROJECT_HANDBOOK.md" in ignored_entries
+
+
+def test_repository_has_an_mit_license() -> None:
+    license_text = (PROJECT_ROOT / "LICENSE").read_text(encoding="utf-8")
+
+    assert license_text.startswith("MIT License")
+    assert "Copyright (c) 2026 rootverdict" in license_text
+
+
+def test_ci_runs_tests_and_compilation_on_supported_python_versions() -> None:
+    workflow = (PROJECT_ROOT / ".github" / "workflows" / "ci.yml").read_text(encoding="utf-8")
+
+    assert "actions/checkout@v6" in workflow
+    assert "actions/setup-python@v6" in workflow
+    assert 'python-version: ["3.11", "3.14"]' in workflow
+    assert "python -m pytest -q" in workflow
+    assert "python -m compileall -q" in workflow
+    assert "quality reporting review tests main.py" in workflow