Skip to content

Commit c423ed4

Browse files
Demolus13Demolus13
authored
feat: add github actions for macaron (#1241)
Adds an official GitHub Action (action.yaml) to run Macaron inside GitHub workflows, a test workflow (.github/workflows/test_macaron_action.yaml) that test the Action across multiple tutorial scenarios, and a set of tutorial datalog policies under tests/tutorials/ used by the workflow. Signed-off-by: Demolus13 <parth.govale@oracle.com>
1 parent 8302a95 commit c423ed4

File tree

17 files changed

+1026
-4
lines changed

17 files changed

+1026
-4
lines changed

‎.github/workflows/test_macaron_action.yaml‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
# Copyright (c) 2025 - 2025, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
name: Test Macaron Action (tutorials)
5+
6+
on:
7+
push:
8+
paths:
9+
- action.yaml
10+
pull_request:
11+
paths:
12+
- action.yaml
13+
workflow_dispatch:
14+
15+
permissions:
16+
id-token: write
17+
attestations: write
18+
19+
jobs:
20+
tutorial-commit-finder:
21+
name: Analyzing and comparing different versions of an artifact
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
25+
26+
- name: Run Macaron (analyze arrow@1.3.0)
27+
uses: ./
28+
with:
29+
package_url: pkg:pypi/arrow@1.3.0
30+
output_dir: macaron_output/commit_finder
31+
32+
- name: Run Macaron (analyze arrow@0.15.0)
33+
uses: ./
34+
with:
35+
package_url: pkg:pypi/arrow@0.15.0
36+
output_dir: macaron_output/commit_finder
37+
38+
- name: Run Macaron (verify policy - has-hosted-build)
39+
uses: ./
40+
with:
41+
policy_file: ./tests/tutorial_resources/commit_finder/has-hosted-build.dl
42+
output_dir: macaron_output/commit_finder
43+
44+
tutorial-detect-malicious-package:
45+
name: Detecting malicious packages
46+
runs-on: ubuntu-latest
47+
steps:
48+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
49+
- name: Run Macaron (analyze django@5.0.6 without dependencies)
50+
uses: ./
51+
with:
52+
package_url: pkg:pypi/django@5.0.6
53+
output_dir: macaron_output/detect_malicious_package
54+
55+
- name: Run Macaron (verify policy - check-django)
56+
uses: ./
57+
with:
58+
policy_file: ./tests/tutorial_resources/detect_malicious_package/check-django.dl
59+
output_dir: macaron_output/detect_malicious_package
60+
61+
- name: Setup Python for analyzed venv
62+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
63+
with:
64+
python-version: 3.11.13
65+
66+
- name: Create and populate analyzed venv
67+
run: |
68+
python -m venv /tmp/.django_venv
69+
source /tmp/.django_venv/bin/activate
70+
pip install --upgrade pip
71+
pip install django==5.0.6
72+
shell: bash
73+
74+
- name: Clean previous macaron output
75+
run: |
76+
rm -rf macaron_output/detect_malicious_package
77+
shell: bash
78+
79+
- name: Run Macaron (analyze django@5.0.6 with direct dependencies)
80+
uses: ./
81+
with:
82+
package_url: pkg:pypi/django@5.0.6
83+
output_dir: macaron_output/detect_malicious_package
84+
deps_depth: '1'
85+
python_venv: /tmp/.django_venv
86+
87+
- name: Run Macaron (verify policy - check-dependencies)
88+
uses: ./
89+
with:
90+
policy_file: ./tests/tutorial_resources/detect_malicious_package/check-dependencies.dl
91+
output_dir: macaron_output/detect_malicious_package
92+
93+
tutorial-detect-vulnerable-actions:
94+
name: How to detect vulnerable GitHub Actions
95+
runs-on: ubuntu-latest
96+
steps:
97+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
98+
99+
- name: Run Macaron (analyze repo - apache/logging-log4j2)
100+
uses: ./
101+
with:
102+
repo_path: https://github.com/apache/logging-log4j2
103+
output_dir: macaron_output/detect_vulnerable_github_actions
104+
105+
- name: Run Macaron (verify policy - github_actions_vulns for repo)
106+
uses: ./
107+
with:
108+
policy_file: ./tests/tutorial_resources/detect_vulnerable_github_actions/check_github_actions_vuln_repo.dl
109+
output_dir: macaron_output/detect_vulnerable_github_actions
110+
111+
- name: Run Macaron (analyze purl - log4j-core example)
112+
uses: ./
113+
with:
114+
package_url: pkg:maven/org.apache.logging.log4j/log4j-core@3.0.0-beta3
115+
output_dir: macaron_output/detect_vulnerable_github_actions
116+
117+
- name: Run Macaron (verify policy - github_actions_vulns for purl)
118+
uses: ./
119+
with:
120+
policy_file: ./tests/tutorial_resources/detect_vulnerable_github_actions/check_github_actions_vuln_purl.dl
121+
output_dir: macaron_output/detect_vulnerable_github_actions
122+
123+
tutorial-provenance:
124+
name: Provenance discovery, extraction, and verification
125+
runs-on: ubuntu-latest
126+
steps:
127+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
128+
- name: Run Macaron (analyze semver 7.7.2)
129+
uses: ./
130+
with:
131+
package_url: pkg:npm/semver@7.7.2
132+
output_dir: macaron_output/provenance
133+
134+
- name: Run Macaron (verify provenance - semver)
135+
uses: ./
136+
with:
137+
policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_semver.dl
138+
output_dir: macaron_output/provenance
139+
140+
- name: Run Macaron (analyze toga 0.5.1 - PyPI provenance)
141+
uses: ./
142+
with:
143+
package_url: pkg:pypi/toga@0.5.1
144+
output_dir: macaron_output/provenance
145+
146+
- name: Run Macaron (verify provenance - toga PyPI)
147+
uses: ./
148+
with:
149+
policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_toga.dl
150+
output_dir: macaron_output/provenance
151+
152+
- name: Run Macaron (analyze toga 0.4.8 - GitHub attestation)
153+
uses: ./
154+
with:
155+
package_url: pkg:pypi/toga@0.4.8
156+
output_dir: macaron_output/provenance
157+
158+
- name: Run Macaron (verify provenance - toga GitHub)
159+
uses: ./
160+
with:
161+
policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_toga.dl
162+
output_dir: macaron_output/provenance
163+
164+
- name: Run Macaron (analyze urllib3 2.0.0a1 - GitHub attestation)
165+
uses: ./
166+
with:
167+
package_url: pkg:pypi/urllib3@2.0.0a1
168+
output_dir: macaron_output/provenance
169+
170+
- name: Run Macaron (verify provenance - urllib3)
171+
uses: ./
172+
with:
173+
policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_urllib3.dl
174+
output_dir: macaron_output/provenance
175+
176+
tutorial-detect-malicious-java-dep:
177+
name: Detecting Java dependencies manually uploaded to Maven Central
178+
runs-on: ubuntu-latest
179+
steps:
180+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
181+
- name: Run Macaron (analyze example-maven-app with SBOM)
182+
uses: ./
183+
with:
184+
package_url: pkg:maven/io.github.behnazh-w.demo/example-maven-app@2.0?type=jar
185+
repo_path: https://github.com/behnazh-w/example-maven-app
186+
output_dir: macaron_output/detect_malicious_java_dep
187+
sbom_path: ./resources/detect_malicious_java_dep/example-sbom.json
188+
deps_depth: '1'
189+
190+
- name: Run Macaron (verify policy - detect-malicious-upload)
191+
uses: ./
192+
with:
193+
policy_file: ./tests/tutorial_resources/detect_malicious_java_dep/example-maven-app.dl
194+
output_dir: macaron_output/detect_malicious_java_dep
195+
196+
tutorial-exclude-include-checks:
197+
name: Exclude and include checks in Macaron
198+
runs-on: ubuntu-latest
199+
steps:
200+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
201+
202+
- name: Run Macaron (analyze micronaut-core with default checks)
203+
uses: ./
204+
with:
205+
package_url: pkg:maven/io.micronaut/micronaut-core@4.3.10
206+
output_dir: macaron_output/exclude_include_checks/normal
207+
208+
- name: Run Macaron (analyze micronaut-core excluding witness check via defaults.ini)
209+
uses: ./
210+
with:
211+
package_url: pkg:maven/io.micronaut/micronaut-core@4.3.10
212+
defaults_path: ./tests/tutorial_resources/exclude_include_checks/defaults_exclude_witness.ini
213+
output_dir: macaron_output/exclude_include_checks/excluded

‎action.yaml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Copyright (c) 2025 - 2025, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
name: Macaron Security Analysis
5+
description: Run Macaron to analyze supply chain security
6+
author: Oracle - github.com/oracle/macaron
7+
# This composite GitHub Action wraps the Macaron tool. It exposes inputs for analysis options to shell scripts under `scripts/actions/` for readability.
8+
9+
inputs:
10+
sbom_path:
11+
description: The path to the SBOM of the analysis target.
12+
python_venv:
13+
description: Path to a Python virtual environment to resolve Python dependencies (used with Python analyze).
14+
package_url:
15+
description: The PURL string used to uniquely identify the target software component for analysis.
16+
repo_path:
17+
description: The path to the repository, can be local or remote.
18+
policy_file:
19+
description: Path to the Datalog policy.
20+
policy_purl:
21+
description: The PURL string for the pre-defined policy.
22+
defaults_path:
23+
description: The path to the defaults configuration file.
24+
digest:
25+
description: The digest of the commit we want to checkout in the branch.
26+
provenance_expectation:
27+
description: The path to provenance expectation file or directory.
28+
provenance_file:
29+
description: The path to the provenance file in in-toto format.
30+
show_prelude:
31+
description: Shows the Datalog prelude for the database.
32+
branch:
33+
description: The branch of the repository that we want to checkout.
34+
deps_depth:
35+
description: 'The depth of the dependency resolution. 0: disable, 1: direct dependencies, inf: all transitive dependencies.'
36+
default: '0'
37+
github_token:
38+
description: The GitHub personal access token is needed for to run the analysis.
39+
default: ${{ github.token }}
40+
output_dir:
41+
description: The output destination path for Macaron.
42+
default: output
43+
upload_attestation:
44+
description: 'Upload the generated VSA report. default : false'
45+
default: false
46+
subject_path:
47+
description: 'Path to the artifact serving as the subject of the attestation, the default is current repository. default : github.workspace'
48+
default: ${{ github.workspace }}
49+
50+
outputs:
51+
policy_report:
52+
description: Paths to the Macaron analysis report
53+
value: ${{ steps.run-macaron-policy-verification.outputs.policy_report }}
54+
vsa_report:
55+
description: Verification Summary Attestation
56+
value: ${{ steps.run-macaron-policy-verification.outputs.vsa_report }}
57+
58+
runs:
59+
using: composite
60+
steps:
61+
- name: Setup Python
62+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
63+
with:
64+
python-version: 3.11.13
65+
66+
- name: Setup Go
67+
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
68+
with:
69+
go-version: '1.23'
70+
cache: false
71+
72+
- name: Setup JDK
73+
uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4.4.0
74+
with:
75+
java-version: '17'
76+
distribution: oracle
77+
78+
- name: Setup Macaron
79+
# Create or reuse a Python virtualenv with the macaron CLI and export the `MACARON` binary path via `$GITHUB_ENV` so later steps can use it.
80+
run: |
81+
bash "$GITHUB_ACTION_PATH/scripts/actions/setup_macaron.sh"
82+
shell: bash
83+
84+
- name: Run Macaron Analysis
85+
id: run-macaron-analysis
86+
if: ${{ inputs.repo_path != '' || inputs.package_url != '' }}
87+
# Build and execute the `macaron analyze` command. We pass action inputs into the script via `env` so the script can assemble the CLI command.
88+
run: |
89+
bash "$GITHUB_ACTION_PATH/scripts/actions/run_macaron_analysis.sh"
90+
shell: bash
91+
env:
92+
GITHUB_TOKEN: ${{ inputs.github_token }}
93+
DEFAULTS_PATH: ${{ inputs.defaults_path }}
94+
OUTPUT_DIR: ${{ inputs.output_dir }}
95+
REPO_PATH: ${{ inputs.repo_path }}
96+
PACKAGE_URL: ${{ inputs.package_url }}
97+
BRANCH: ${{ inputs.branch }}
98+
DIGEST: ${{ inputs.digest }}
99+
DEPS_DEPTH: ${{ inputs.deps_depth }}
100+
SBOM_PATH: ${{ inputs.sbom_path }}
101+
PYTHON_VENV: ${{ inputs.python_venv }}
102+
PROVENANCE_FILE: ${{ inputs.provenance_file }}
103+
PROVENANCE_EXPECTATION: ${{ inputs.provenance_expectation }}
104+
105+
- name: Run Macaron Policy Verification
106+
id: run-macaron-policy-verification
107+
if: ${{ inputs.policy_file != '' }}
108+
# Run policy verification using a Datalog policy file or a pre-defined policy and a PURL. The script writes `policy_report` and `vsa_report` to `$GITHUB_OUTPUT` if policy verification is successful.
109+
run: |
110+
bash "$GITHUB_ACTION_PATH/scripts/actions/run_macaron_policy_verification.sh"
111+
shell: bash
112+
env:
113+
DEFAULTS_PATH: ${{ inputs.defaults_path }}
114+
OUTPUT_DIR: ${{ inputs.output_dir }}
115+
POLICY_FILE: ${{ inputs.policy_file }}
116+
POLICY_PURL: ${{ inputs.policy_purl }}
117+
118+
- name: Upload Attestation
119+
if: ${{ inputs.upload_attestation == 'true' && steps.run-macaron-policy-verification.outputs.vsa_report != 'VSA Not Generated.' }}
120+
uses: actions/attest@daf44fb950173508f38bd2406030372c1d1162b1 #3.0.0
121+
with:
122+
subject-path: ${{ inputs.subject_path }}
123+
predicate-type: https://slsa.dev/verification_summary/v1
124+
predicate-path: ${{ steps.run-macaron-policy-verification.outputs.vsa_report }}

‎docs/source/pages/cli_usage/command_analyze.rst‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,6 @@ Options
8787

8888
The path to the local `.m2` Maven repository. If this option is not used, Macaron will use the default location at `$HOME/.m2`.
8989

90-
.. option:: --verify-provenance
91-
92-
Allow the analysis to attempt to verify provenance files as part of its normal operations.
93-
9490
.. option:: --force-analyze-source
9591

9692
Forces PyPI source code analysis to run, regardless of other heuristic results.

0 commit comments

Comments
 (0)