From ee2fc0cc59de697d4fd0eb64a1e8bc7ef7d885be Mon Sep 17 00:00:00 2001
From: William Martin <contact@willmartian.com>
Date: Wed, 22 Oct 2025 17:52:51 -0400
Subject: [PATCH] add wip workflow

---
 .github/workflows/go-phish.yml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .github/workflows/go-phish.yml

diff --git a/.github/workflows/go-phish.yml b/.github/workflows/go-phish.yml
new file mode 100644
index 00000000000..c36faaddaf0
--- /dev/null
+++ b/.github/workflows/go-phish.yml
@@ -0,0 +1,34 @@
+name: Update Phishing Domains Data
+
+on:
+  schedule:
+    - cron: '0 0 */14 * *' # Every 14 days at midnight UTC
+  workflow_dispatch: # Allow manual runs
+
+jobs:
+  update-phishing-db:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y moreutils jq curl
+          # Install GNU split as gsplit (for macOS compatibility, on Ubuntu it's just split)
+          sudo apt-get install -y coreutils
+
+      - name: Run phishing domains update script
+        run: bash ./clients/apps/browser/src/dirt/phishing-detection/services/fetch-phishing-domains.sh
+
+      - name: Commit and create PR
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "chore: update phishing domains data"
+          branch: update/phishing-domains-data
+          title: "chore: update phishing domains data"
+          body: |
+            This PR updates the local phishing domains data and checksum.
+          labels: |
+            automated
\ No newline at end of file