diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..8a24fa9
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,13 @@
+name: upload a malicious artifact
+
+on: [pull_request]
+
+jobs:
+  job:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "legit artifact" >> malicious
+      - uses: actions/upload-artifact@v2
+        with:
+          name: bin
+          path: malicious