oracle/Macaron Security Analysis Action
Run Macaron to analyze artifacts for supply chain security
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Jul 6, 2026
- Maintenance Recency
- Activelast commit Jun 30, 2026
- License
- Other
Pinned Snippet
uses: oracle/macaron@4ddb55e3c9ef2c77b548be55c557078c4476fd9c # v0.24.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| sbom_path | The path to the SBOM of the analysis target. | — | — |
| python_venv | Path to a Python virtual environment to resolve Python dependencies (used with Python analyze). | — | — |
| package_url | The PURL string used to uniquely identify the target software component for analysis. | — | — |
| repo_path | The path to the repository, can be local or remote. | — | — |
| policy_file | Path to the Datalog policy. | — | — |
| policy_purl | The PURL string for the pre-defined policy. | — | — |
| defaults_path | The path to the defaults configuration file. | — | — |
| digest | The digest of the commit we want to checkout in the branch. | — | — |
| provenance_expectation | The path to provenance expectation file or directory. | — | — |
| provenance_file | The path to the provenance file in in-toto format. | — | — |
| show_prelude | Shows the Datalog prelude for the database. | — | — |
| branch | The branch of the repository that we want to checkout. | — | — |
| deps_depth | The depth of the dependency resolution. 0: disable, 1: direct dependencies, inf: all transitive dependencies. | — | 0 |
| github_token | The GitHub personal access token is needed for to run the analysis. | — | ${{ github.token }} |
| output_dir | The output destination path for Macaron. | — | output |
| upload_reports | Upload Macaron reports as a workflow artifact. | — | true |
| reports_artifact_name | Name of the uploaded reports artifact. | — | macaron-reports |
| reports_retention_days | Retention period in days for uploaded reports. | — | 90 |
| write_job_summary | Write a human-friendly summary to the workflow run page. | — | true |
| upload_attestation | Upload the generated VSA report. default : false | — | false |
| subject_path | Path to the artifact serving as the subject of the attestation, the default is current repository. default : github.workspace | — | ${{ github.workspace }} |
Outputs
| name | description |
|---|---|
| html_report_path | Path to the generated HTML analysis report (if available). |
| report_dir | Directory containing HTML/JSON reports. |
| db_path | Path to the generated Macaron SQLite database. |
| policy_report | Paths to the Macaron analysis report |
| vsa_report | Verification Summary Attestation |
| vsa_generated | Whether VSA was generated. |