Skip to content

feat!: add more inputs to Macaron Action and improve GitHub Action analysis#1339

Merged
behnazh-w merged 30 commits intomainfrom
behnazh/detect-injection-gha
Mar 31, 2026
Merged

feat!: add more inputs to Macaron Action and improve GitHub Action analysis#1339
behnazh-w merged 30 commits intomainfrom
behnazh/detect-injection-gha

Conversation

@behnazh-w
Copy link
Copy Markdown
Member

@behnazh-w behnazh-w commented Mar 27, 2026

Summary

This PR enhances the Macaron GitHub Action by updating its input/output interface and introducing new analysis to detect injection risks and other security issues in GitHub Actions workflows. It also improves result visibility by showing findings directly in the Action run summary.

Description of changes

  • Action I/O updates: refactored inputs and outputs for the Macaron GitHub Action to improve usability and consistency
  • Security analysis: added detection for injection vulnerabilities and other GitHub Actions security issues
  • Result reporting: outputs analysis results as a summary in the Action run for better visibility
  • Policy queries: introduced new SQL queries in template policies to simplify extraction of failure-related details
  • Bash parsing improvements: updated parser to map GitHub variables to placeholder variables, to be able to reason about expansions in inlined shell scripts.
  • CI pipeline update: action tests now run after container build to ensure validation against the correct Macaron version
  • Docs & actions updates: updated documentation and related action configurations

@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Mar 27, 2026
@behnazh-w behnazh-w force-pushed the behnazh/detect-injection-gha branch 7 times, most recently from 0c07766 to e1b95eb Compare March 29, 2026 02:38
@behnazh-w behnazh-w force-pushed the behnazh/detect-injection-gha branch 3 times, most recently from 5b93cd6 to df1c1cb Compare March 29, 2026 10:05
…alysis

Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
@behnazh-w behnazh-w force-pushed the behnazh/detect-injection-gha branch from 71cc986 to a1950ea Compare March 30, 2026 03:43
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
Signed-off-by: behnazh-w <behnaz.hassanshahi@oracle.com>
@behnazh-w behnazh-w marked this pull request as ready for review March 30, 2026 07:06
@behnazh-w behnazh-w merged commit d902a14 into main Mar 31, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants