demolus13/Macaron Security Analysis
Run Macaron to analyze supply chain security
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| sbom_path | The path to the SBOM of the analysis target. | — | — |
| python_venv | Path to a Python virtual environment to resolve Python dependencies (used with Python analyze). | — | — |
| package_url | The PURL string used to uniquely identify the target software component for analysis. | — | — |
| repo_path | The path to the repository, can be local or remote. | — | — |
| policy_file | Path to the Datalog policy. | — | — |
| policy_purl | The PURL string for the pre-defined policy. | — | — |
| defaults_path | The path to the defaults configuration file. | — | — |
| digest | The digest of the commit we want to checkout in the branch. | — | — |
| provenance_expectation | The path to provenance expectation file or directory. | — | — |
| provenance_file | The path to the provenance file in in-toto format. | — | — |
| show_prelude | Shows the Datalog prelude for the database. | — | — |
| branch | The branch of the repository that we want to checkout. | — | — |
| deps_depth | The depth of the dependency resolution. 0: disable, 1: direct dependencies, inf: all transitive dependencies. | — | 0 |
| github_token | The GitHub personal access token is needed for to run the analysis. | — | ${{ github.token }} |
| output_dir | The output destination path for Macaron. | — | output |
| upload_attestation | Upload the generated VSA report. default : false | — | false |
| subject_path | Path to the artifact serving as the subject of the attestation, the default is current repository. default : github.workspace | — | ${{ github.workspace }} |
Outputs
| name | description |
|---|---|
| policy_report | Paths to the Macaron analysis report |
| vsa_report | Verification Summary Attestation |