Summary

Adds an official GitHub Action (action.yaml) to run Macaron inside GitHub workflows, a test workflow (.github/workflows/test_macaron_action.yaml) that test the Action across multiple tutorial scenarios, and a set of tutorial datalog policies under tests/tutorials/ used by the workflow.

Description of changes

• action.yaml

  • Adds a composite GitHub Action named "Macaron Security Analysis" that wraps the macaron CLI for use in workflows.
  • Inputs: sbom_path, python_venv, package_url, repo_path, policy_file, policy_purl, defaults_path, digest, provenance_file, provenance_expectation, branch, deps_depth, github_token, output_dir, upload_attestation, subject_path.
  • Run Macaron Analysis - constructs and runs macaron analyze with the provided inputs. Writes a report path to outputs on success.
  • Run Macaron Policy Verification - runs macaron verify-policy with a local policy file or a predefined policy (via --existing-policy), writes policy_report and vsa_report outputs, and conditionally uploads attestations via actions/attest.
  • Outputs: policy_report and vsa_report for downstream workflow steps.

• .github/workflows/test_macaron_action.yaml

  • Adds tutorial test cases in github workflow to test macaron action - Macaron Tutorials

Related issues

N/A

Checklist

• I have reviewed the contribution guide.
• My PR title and commits follow the Conventional Commits convention.
• My commits include the "Signed-off-by" line.
• I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
• I have updated the relevant documentation, if applicable.
• I have tested my changes and verified they work as expected.