Fix Macaron workflow

Author: Ela689

.github/workflows/macaron-analysis.yaml

@@ -1,7 +1,7 @@
-# Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2026 - 2026, Oracle and/or its affiliates. All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
 
-# Run Macaron policies and generate supply-chain security analysis reports.
+# Run Macaron's policies and generate Verification Summary Attestation reports.
 # See https://github.com/oracle/macaron
 
 name: Run Macaron to check supply chain security issues
@@ -11,17 +11,12 @@ on:
     branches:
       - main
     paths:
-      - ".github/workflows/**"
-      - "Dockerfile"
-      - "**/*.sh"
+      - .github/workflows/**
   pull_request:
     paths:
-      - ".github/workflows/**"
-      - "Dockerfile"
-      - "**/*.sh"
+      - .github/workflows/**
   schedule:
-    - cron: "20 15 * * 3"
-  workflow_dispatch:
+    - cron: 20 15 * * 3
 
 permissions:
   contents: read
@@ -37,13 +32,12 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      # Check the GitHub Actions workflows in the repository for vulnerabilities.
+      - name: Run Macaron action
+        id: run_macaron
+        uses: oracle/macaron@4ddb55e3c9ef2c77b548be55c557078c4476fd9c # v0.24.0
         with:
-          python-version: "3.12"
-
-      - name: Install Macaron
-        run: python -m pip install --upgrade macaron
-
-      - name: Run Macaron analysis
-        run: macaron analyze -purl pkg:github/oracle-devrel/cd3-automation-toolkit
+          repo_path: ./
+          policy_file: check-github-actions
+          policy_purl: pkg:github.com/oracle-devrel/cd3-automation-toolkit@.*
+          reports_retention_days: 3