test_macaron_action.yaml

# Copyright (c) 2025 - 2026, Oracle and/or its affiliates. All rights reserved.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.

name: Test Macaron Action

on:
  workflow_call:
    # Optional overrides used by reusable callers (for example _build_docker.yaml).
    # Defaults target the test image artifact produced by our Docker build workflow.
    inputs:
      docker_image_artifact_name:
        required: false
        type: string
        default: macaron-test-image
      macaron_image_tag:
        required: false
        type: string
        default: test

permissions:
  contents: read

jobs:
  tutorial-commit-finder:
    name: Analyzing and comparing different versions of an artifact
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar

    - name: Run Macaron (analyze arrow@1.3.0)
      uses: ./
      with:
        package_url: pkg:pypi/arrow@1.3.0
        output_dir: macaron_output/commit_finder
        upload_reports: 'false'

    - name: Run Macaron (analyze arrow@0.15.0)
      uses: ./
      with:
        package_url: pkg:pypi/arrow@0.15.0
        output_dir: macaron_output/commit_finder
        upload_reports: 'false'

    - name: Run Macaron (verify policy - has-hosted-build)
      id: verify_has_hosted_build
      # This verification is expected to fail for this tutorial scenario.
      continue-on-error: true
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/commit_finder/has-hosted-build.dl
        output_dir: macaron_output/commit_finder
        upload_reports: 'false'
    - name: Assert expected failure (has-hosted-build)
      if: ${{ always() }}
      run: |
        # Keep this workflow green only when the verify step actually fails.
        if [ "${{ steps.verify_has_hosted_build.outcome }}" != "failure" ]; then
          echo "Expected verify step to fail, but it did not."
          exit 1
        fi

  tutorial-detect-malicious-package:
    name: Detecting malicious packages
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar
    - name: Run Macaron (analyze django@5.0.6 without dependencies)
      uses: ./
      with:
        package_url: pkg:pypi/django@5.0.6
        output_dir: macaron_output/detect_malicious_package
        upload_reports: 'false'

    - name: Run Macaron (verify policy - check-django)
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/detect_malicious_package/check-django.dl
        output_dir: macaron_output/detect_malicious_package
        upload_reports: 'false'

    - name: Setup Python for analyzed venv
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: 3.11.14

    - name: Create and populate analyzed venv
      run: |
        python -m venv /tmp/.django_venv
        source /tmp/.django_venv/bin/activate
        pip install --upgrade pip
        pip install django==5.0.6
      shell: bash

    - name: Clean previous macaron output
      run: |
        rm -rf macaron_output/detect_malicious_package
      shell: bash

    - name: Run Macaron (analyze django@5.0.6 with direct dependencies)
      uses: ./
      with:
        package_url: pkg:pypi/django@5.0.6
        output_dir: macaron_output/detect_malicious_package
        deps_depth: '1'
        python_venv: /tmp/.django_venv
        upload_reports: 'false'

    - name: Run Macaron (verify policy - check-dependencies)
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/detect_malicious_package/check-dependencies.dl
        output_dir: macaron_output/detect_malicious_package
        upload_reports: 'false'

  tutorial-detect-vulnerable-actions:
    name: How to detect vulnerable GitHub Actions
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar

    - name: Run Macaron (analyze repo - apache/logging-log4j2)
      uses: ./
      with:
        repo_path: https://github.com/apache/logging-log4j2
        output_dir: macaron_output/detect_vulnerable_github_actions
        upload_reports: 'false'
        write_job_summary: 'false'

    - name: Run Macaron (verify policy - github_actions_vulns for repo)
      id: verify_github_actions_vulns_repo_tutorial
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/detect_vulnerable_github_actions/check_github_actions_vuln_repo.dl
        output_dir: macaron_output/detect_vulnerable_github_actions
        upload_reports: 'true'
        reports_artifact_name: macaron-reports-vulnerable-actions-repo
        write_job_summary: 'true'

    - name: Run Macaron (analyze purl - log4j-core example)
      uses: ./
      with:
        package_url: pkg:maven/org.apache.logging.log4j/log4j-core@2.25.3
        output_dir: macaron_output/detect_vulnerable_github_actions
        upload_reports: 'false'
        write_job_summary: 'false'

    - name: Run Macaron (verify policy - github_actions_vulns for purl)
      id: verify_github_actions_vulns_purl_tutorial
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/detect_vulnerable_github_actions/check_github_actions_vuln_purl.dl
        output_dir: macaron_output/detect_vulnerable_github_actions
        upload_reports: 'true'
        reports_artifact_name: macaron-reports-vulnerable-actions-purl
        write_job_summary: 'true'

  tutorial-provenance:
    name: Provenance discovery, extraction, and verification
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar
    - name: Run Macaron (analyze semver 7.7.2)
      uses: ./
      with:
        package_url: pkg:npm/semver@7.7.2
        output_dir: macaron_output/provenance
        upload_reports: 'false'

    - name: Run Macaron (verify provenance - semver)
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_semver.dl
        output_dir: macaron_output/provenance
        upload_reports: 'false'

    - name: Run Macaron (analyze toga 0.5.1 - PyPI provenance)
      uses: ./
      with:
        package_url: pkg:pypi/toga@0.5.1
        output_dir: macaron_output/provenance
        upload_reports: 'false'

    - name: Run Macaron (verify provenance - toga PyPI)
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_toga.dl
        output_dir: macaron_output/provenance
        upload_reports: 'false'

    - name: Run Macaron (analyze toga 0.4.8 - GitHub attestation)
      uses: ./
      with:
        package_url: pkg:pypi/toga@0.4.8
        output_dir: macaron_output/provenance
        upload_reports: 'false'

    - name: Run Macaron (verify provenance - toga GitHub)
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_toga.dl
        output_dir: macaron_output/provenance
        upload_reports: 'false'

    - name: Run Macaron (analyze urllib3 2.0.0a1 - GitHub attestation)
      uses: ./
      with:
        package_url: pkg:pypi/urllib3@2.0.0a1
        output_dir: macaron_output/provenance
        upload_reports: 'false'

    - name: Run Macaron (verify provenance - urllib3)
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/provenance/has-verified-provenance_urllib3.dl
        output_dir: macaron_output/provenance
        upload_reports: 'false'

  tutorial-detect-malicious-java-dep:
    name: Detecting Java dependencies manually uploaded to Maven Central
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar
    - name: Run Macaron (analyze example-maven-app with SBOM)
      uses: ./
      with:
        package_url: pkg:maven/io.github.behnazh-w.demo/example-maven-app@2.0?type=jar
        repo_path: https://github.com/behnazh-w/example-maven-app
        output_dir: macaron_output/detect_malicious_java_dep
        sbom_path: ./tests/tutorial_resources/detect_malicious_java_dep/example-sbom.json
        deps_depth: '1'
        upload_reports: 'false'

    - name: Run Macaron (verify policy - detect-malicious-upload)
      uses: ./
      with:
        policy_file: ./tests/tutorial_resources/detect_malicious_java_dep/example-maven-app.dl
        output_dir: macaron_output/detect_malicious_java_dep
        upload_reports: 'false'

  tutorial-exclude-include-checks:
    name: Exclude and include checks in Macaron
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar

    - name: Run Macaron (analyze micronaut-core with default checks)
      uses: ./
      with:
        package_url: pkg:maven/io.micronaut/micronaut-core@4.3.10
        output_dir: macaron_output/exclude_include_checks/normal
        upload_reports: 'false'

    - name: Run Macaron (analyze micronaut-core excluding witness check via defaults.ini)
      uses: ./
      with:
        package_url: pkg:maven/io.micronaut/micronaut-core@4.3.10
        defaults_path: ./tests/tutorial_resources/exclude_include_checks/defaults_exclude_witness.ini
        output_dir: macaron_output/exclude_include_checks/excluded
        upload_reports: 'false'

  test-detect-vulnerable-actions:
    name: How to detect vulnerable GitHub Actions
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar

    - name: Run Macaron (analyze github_actions_vulns for https://github.com/oracle/coherence-js-client)
      id: verify_github_actions_vulns_repo_test
      # This integration target is intentionally vulnerable; failure is expected.
      continue-on-error: true
      uses: ./
      with:
        repo_path: https://github.com/oracle/coherence-js-client
        digest: 39166341bc31f75b663ff439dae36170fb3e99a9
        policy_file: check-github-actions
        policy_purl: pkg:github.com/oracle/coherence-js-client@.*
        output_dir: macaron_output/detect_vulnerable_github_actions
        upload_reports: 'true'
        reports_artifact_name: macaron-vulnerable-actions-fail-diagnosis
        write_job_summary: 'true'
    - name: Assert expected failure (github_actions_vulns for repo test)
      if: ${{ always() }}
      run: |
        # Explicitly assert failure so regressions are visible in CI results.
        if [ "${{ steps.verify_github_actions_vulns_repo_test.outcome }}" != "failure" ]; then
          echo "Expected verify step to fail, but it did not."
          exit 1
        fi

  test-detect-potential-injection:
    name: How to detect vulnerable GitHub Actions
    runs-on: ubuntu-latest
    env:
      MACARON_IMAGE_TAG: ${{ inputs.macaron_image_tag }}
      DOCKER_PULL: never
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Download test Docker image artifact
      if: ${{ inputs.docker_image_artifact_name != '' }}
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: ${{ inputs.docker_image_artifact_name }}
        path: /tmp
    - name: Load test Docker image
      if: ${{ inputs.docker_image_artifact_name != '' }}
      run: docker load --input /tmp/macaron-test-image.tar

    - name: Run Macaron (analyze github_actions_vulns for https://github.com/oracle/coherence-js-client)
      id: verify_github_actions_vulns_repo_test
      # This integration target is intentionally vulnerable; failure is expected.
      continue-on-error: true
      uses: ./
      with:
        repo_path: https://github.com/oracle/graalpython
        digest: f5f7e67823a699213ab06c86440da94ead672467
        policy_file: check-github-actions
        policy_purl: pkg:github.com/oracle/graalpython@.*
        output_dir: macaron_output/detect_vulnerable_github_actions
        upload_reports: 'false'
        reports_artifact_name: macaron-injection-actions-fail-diagnosis
        write_job_summary: 'true'
    - name: Assert expected failure (github_actions_vulns for repo test)
      if: ${{ always() }}
      run: |
        # Explicitly assert failure so regressions are visible in CI results.
        if [ "${{ steps.verify_github_actions_vulns_repo_test.outcome }}" != "failure" ]; then
          echo "Expected verify step to fail, but it did not."
          exit 1
        fi