feat: Deprecate active malware analysis in favour of SafeDep threat intelligence query

[abhisek]

No description provided.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

❌ Patch coverage is 4.44444% with 43 lines in your changes missing coverage. Please review.
✅ Project coverage is 12.57%. Comparing base (7517804) to head (3a98231).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/inspect/malware.go	0.00%	13 Missing ⚠️
scan.go	0.00%	12 Missing ⚠️
pkg/scanner/enrich_malware_query.go	0.00%	10 Missing and 1 partial ⚠️
pkg/reporter/markdown_summary.go	0.00%	4 Missing ⚠️
pkg/reporter/common.go	50.00%	2 Missing ⚠️
pkg/reporter/summary.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #752      +/-   ##
==========================================
- Coverage   12.59%   12.57%   -0.02%     
==========================================
  Files         371      370       -1     
  Lines       49203    48834     -369     
==========================================
- Hits         6199     6143      -56     
+ Misses      42514    42204     -310     
+ Partials      490      487       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[KunalSin9h]

Deep-dive review of the active-malware-analysis deprecation. Direction is good — this removes ~600 lines of complexity, the exclusion-record handling and GitHub Actions commit-SHA resolution survived intact in the query enricher, dropping the community-mode hard error means --malware now works keyless, and the new reporter copy is more honest than the old text. Branch builds cleanly and go vet passes; the deleted tests only covered the deleted enricher.

That said, two findings are significant and worth addressing before merge (inline comments):

1. Silent security downgrade: entitled --malware users lose on-demand/zero-day analysis with no runtime notice — needs MarkDeprecated and/or ui.PrintWarning (scan.go).
2. Dead quota reporting: IncrementMalwareAnalysisQuotaError has no callers after deleting enrich_malware.go, so the quota-denied report sections can never render, while real rate-limit errors from the query API surface as generic errors (pkg/reporter/common.go).

Smaller items inline: --malware-analysis-timeout is now a silent no-op, eventScanMalwareAnalysis now fires on every default scan (dashboard discontinuity), and a README nit about vet inspect malware still offering on-demand analysis.

One non-anchorable nit: the doc comment on NewMalysisMalwareAnalysisQueryEnricher ("We are re-using the config from the malware enricher because this enricher is a subset of the malware enricher") is now stale — that enricher no longer exists and the config lives here.

Also: consider linking this PR to a tracking issue for the active-analysis deprecation, since it changes paid-feature behavior.

---

Generated by Claude Code