chore: update Macaron version in docs and test action

.github/workflows/macaron-analysis.yaml

@@ -35,7 +35,7 @@ jobs:
     # Note: adjust the policy_purl to refer to your repository URL.
     - name: Run Macaron action
       id: run_macaron
-      uses: oracle/macaron@fda4dda04aa7228fcaba162804891806cf5a1375 # v0.22.0
+      uses: oracle/macaron@b31acfe389133a5587d9639063ec70cb84e7bc47 # v0.23.0
       with:
         repo_path: ./
         policy_file: check-github-actions

README.md

@@ -14,11 +14,11 @@ Use Macaron as a GitHub Action
 To use the Macaron GitHub Action, add the following step to your workflow (adjust the version as needed). In this example, we use an example policy. For detailed instructions and a comprehensive list of available options, please refer to the [Macaron GitHub Action documentation](https://oracle.github.io/macaron/pages/macaron_action.html).
 
 ```yaml
-- uses: oracle/macaron@v0.22.0
+- uses: oracle/macaron@b31acfe389133a5587d9639063ec70cb84e7bc47 # v0.23.0
   with:
     repo_path: 'https://github.com/example/project'
     policy_file: check-github-actions
-    policy_purl: 'pkg:github.com/example/project'
+    policy_purl: 'pkg:github.com/example/project@.*'
     output_dir: 'macaron-output'
     upload_attestation: true
 ```

docs/source/pages/macaron_action.rst

@@ -19,11 +19,11 @@ When you use this action, you can reference it directly in your workflow. For a
       steps:
         - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         - name: Run Macaron Security Analysis Action
-          uses: oracle/macaron@fda4dda04aa7228fcaba162804891806cf5a1375 # v0.22.0
+          uses: oracle/macaron@b31acfe389133a5587d9639063ec70cb84e7bc47 # v0.23.0
           with:
             repo_path: 'https://github.com/example/project'
             policy_file: check-github-actions
-            policy_purl: 'pkg:github.com/example/project'
+            policy_purl: 'pkg:github.com/example/project@.*'
             reports_retention_days: 90
 
 By default, the action posts a human-friendly results summary to the GitHub Actions run page (job summary). If you upload the results like in this `workflow <https://github.com/oracle/macaron/blob/main/.github/workflows/macaron-analysis.yaml>`_, check this :ref:`documentation <detect-vuln-gh-actions-results>` to see how to read and understand them.