GitHub Explorer

by Alexey Ratnikov

GitHub Explorer

GitHub Explorer|TRENDING COMPARE|FEEDBACK

Back to search

Copyright (c) 2026 Alexey Ratnikov

oracle/macaron - GitHub Explorer | GitHub Explorer | Trending | Compare

macaron

oracle•PUBLIC

Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services. It can be used to prevent supply chain attacks, detect malicious Python packages, or check conformance to frameworks, such as SLSA. Documentation:

build-systemcicddockergradleintegrity-protectionmalware-analysis

Universal Permissive License v1.0

Created on Dec 5, 2022

Updated on Apr 10, 2026

Stars

190

Forks

33

Watchers

190

Open Issues

139

Repository Health Score

🧡

56/100

Fair

Overall repository health assessment

Score Breakdown

Activity

Active development - updated this week

30/30

100%

malware-detection

maven

npm

python

sbom

slsa

supply-chain-security

Community

190 stars, 33 forks

1/30

3%

Documentation

Has description, wiki, license

20/20

100%

Maintenance

73.2% issue ratio

5/20

25%

Health score is calculated based on activity, community engagement, documentation quality, and maintenance practices

Languages

Python

91.1%

HTML

5.0%

Shell

2.2%

Go

0.8%

Makefile

0.7%

CUE

0.1%

Dockerfile

0.0%

Issues Analytics

9

Total Issues

All time

7

Open

78% of total

2

Closed

22% of total

5d

Avg Close Time

Fast response ✅

Issues Activity: Last 6 months

Top Labels

Hottest Issues

1

#1354 Review pylint plugins and their notes.

0

open

2

#1353 [Feature Request] - [Improve buildspec generation and error handling for missing metadata]

enhancementfeaturebuild_spec_generation

0

open

3

#1351 [Feature Request] - [Add a skill for Macaron Action and improve failure guidance]

enhancementfeaturemacaron_action

0

open

4

#1328 [Feature Request] - [Macaron should report root project GAV]

enhancementfeaturebuild_spec_generation

0

open

5

#1307 [Enhancement Request] - [Build specs overwriting and path sanitization overlaps due to incomplete purl/version handling]

enhancementbuild_spec_generation

0

open

Dependencies

No package.json found

This might not be a Node.js project

Top Contributors

1

behnazh-w

User

270

commits

2

dependabot[bot]

dependabot[bot]

Bot

159

commits

3

benmss

User

68

commits

4

art1f1c3R

User

31

commits

5

nathanwn

User

28

commits

6

nicallen

User

16

commits

7

jenstroeger

User

14

commits

8

AbhinavPradeep

User

14

commits

9

Demolus13

User

6

commits

10

mabdollahpour-ol

mabdollahpour-ol

User

5

commits

Recent Commits

chore: fix a few missing Makefile phonies, Makefile recipe indentation, and improve and update package metadata (#1357)

Jens Tröger•1 day ago

3a4e8ddView on GitHub

chore: update Flake8 plugins, add flake8-logging, and fix code according to the issues (#1352)

Jens Tröger•2 days ago

f71d152View on GitHub

chore: update Macaron version in docs and test action (#1346)

Behnaz Hassanshahi•4 days ago

8d2fd36View on GitHub

bump: release 0.22.0 → 0.23.0

behnazh-w•1 week ago

b31acfeView on GitHub

fix: improve URL validation to avoid unexpected redirects (#1344)

Behnaz Hassanshahi•1 week ago

d07edd4View on GitHub

feat!: add more inputs to Macaron Action and improve GitHub Action analysis (#1339)

Behnaz Hassanshahi•1 week ago

d902a14View on GitHub

fix: allow parsing of github expressions containing non-breaking-space characters, and allow dataflow analysis to fail (#1340)

Nicholas Allen•1 week ago

011e21aView on GitHub

chore(deps): bump actions/setup-java from 4.4.0 to 5.2.0 (#1286)

dependabot[bot]•1 week ago

016ef83View on GitHub

chore(deps): bump actions/setup-python from 5.4.0 to 6.2.0 (#1284)

dependabot[bot]•1 week ago

9247e6dView on GitHub

chore(deps): bump actions/download-artifact from 6.0.0 to 8.0.1 (#1330)

dependabot[bot]•2 weeks ago

5f01e82View on GitHub

chore(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 (#1318)

dependabot[bot]•2 weeks ago

87bd0ffView on GitHub

feat: change dockerfile generation for Python rebuild to always default to standard build command (#1336)

Abhinav Pradeep•2 weeks ago

f7634e5View on GitHub

ci: run Macaron as a GitHub Action to check workflows (#1327)

Behnaz Hassanshahi•2 weeks ago

15bc2abView on GitHub

fix: improve has_binary flag condition for Python buildspec generation (#1333)

Abhinav Pradeep•2 weeks ago

7db6d9bView on GitHub

feat: adjusted max_download_size to 30MB (#1337)

Abhinav Pradeep•2 weeks ago

09cf40bView on GitHub

View all commits