{
  "id": "poutine",
  "name": "Poutine",
  "homepage": "https://github.com/boostsecurityio/poutine",
  "description": "Supply-chain vulnerability scanner for build pipelines.",
  "executables": [
    "poutine"
  ],
  "dotfiles": {
    "paths": [
      "~/.poutine/config.yaml"
    ],
    "exclude": [],
    "secret": [],
    "side_effect": false
  },
  "commands": {
    "format": 1,
    "label": "Scan CI pipelines",
    "description": "Analyze a local repository, a remote repository or an organization for CI/CD supply-chain issues. Rule skipping beyond --skip and config-file options are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": false,
      "short_attached": false,
      "short_bundles": false
    },
    "subcommand": [
      {
        "path": [
          "analyze_local"
        ],
        "label": "Analyze a local repository",
        "source": [
          {
            "id": "readme",
            "kind": "manual",
            "url": "https://github.com/boostsecurityio/poutine/blob/main/README.md",
            "revision": "2026-10-27",
            "evidence": "poutine analyze_local .\npoutine analyze_local . --config my-config.yml\n--format             Output format (default: pretty, json, sarif)\n--config             Path to the configuration file (default: .poutine.yml in the working directory, or .github/poutine.yml)\n--skip               Add rules to the skip list for the current run (can be specified multiple times)\n--fail-on-violation  Exit with a non-zero code (10) when violations are found\n"
          }
        ],
        "field": [
          {
            "id": "path",
            "label": "Repository path",
            "type": "path",
            "position": 0,
            "min": 1,
            "path": {
              "kind": "directory",
              "role": "input"
            },
            "sources": [
              "readme"
            ]
          },
          {
            "id": "format",
            "label": "Output format",
            "type": "enum",
            "option": [
              "--format"
            ],
            "choices": [
              {
                "value": "pretty",
                "label": "Pretty"
              },
              {
                "value": "json",
                "label": "JSON"
              },
              {
                "value": "sarif",
                "label": "SARIF"
              }
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "config",
            "label": "Config file",
            "type": "path",
            "option": [
              "--config"
            ],
            "path": {
              "kind": "file",
              "role": "input"
            },
            "sources": [
              "readme"
            ]
          },
          {
            "id": "skip",
            "label": "Skip rules",
            "type": "string",
            "option": [
              "--skip"
            ],
            "multiple": true,
            "sources": [
              "readme"
            ]
          },
          {
            "id": "fail_on_violation",
            "label": "Fail on violation",
            "type": "boolean",
            "option": [
              "--fail-on-violation"
            ],
            "sources": [
              "readme"
            ]
          }
        ],
        "task": [
          {
            "id": "scan",
            "label": "Scan current directory",
            "fields": [
              "path",
              "format",
              "fail_on_violation"
            ],
            "required": [
              "path"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "path",
              "format",
              "fail_on_violation",
              "config",
              "skip"
            ]
          }
        ]
      },
      {
        "path": [
          "analyze_repo"
        ],
        "label": "Analyze a remote repository",
        "source": [
          {
            "id": "readme",
            "kind": "manual",
            "url": "https://github.com/boostsecurityio/poutine/blob/main/README.md",
            "revision": "2026-10-27",
            "evidence": "poutine analyze_repo org/repo --token \"$GH_TOKEN\"\npoutine analyze_org my-org/project --token \"$GL_TOKEN\" --scm gitlab --scm-base-url https://gitlab.example.com\n--token              SCM access token (required for the commands analyze_repo, analyze_org) (env: GH_TOKEN)\n--format             Output format (default: pretty, json, sarif)\n--scm                SCM platform (default: github, gitlab)\n--scm-base-url       Base URI of the self-hosted SCM instance\n--skip               Add rules to the skip list for the current run (can be specified multiple times)\n"
          }
        ],
        "field": [
          {
            "id": "repo",
            "label": "Repository",
            "description": "org/repo",
            "type": "string",
            "position": 0,
            "min": 1,
            "sources": [
              "readme"
            ]
          },
          {
            "id": "token",
            "label": "Access token",
            "description": "Prefer the GH_TOKEN environment variable over typing a token here.",
            "type": "string",
            "option": [
              "--token"
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "scm",
            "label": "SCM platform",
            "type": "enum",
            "option": [
              "--scm"
            ],
            "choices": [
              {
                "value": "github",
                "label": "GitHub"
              },
              {
                "value": "gitlab",
                "label": "GitLab"
              }
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "scm_base_url",
            "label": "SCM base URL",
            "type": "url",
            "option": [
              "--scm-base-url"
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "format",
            "label": "Output format",
            "type": "enum",
            "option": [
              "--format"
            ],
            "choices": [
              {
                "value": "pretty",
                "label": "Pretty"
              },
              {
                "value": "json",
                "label": "JSON"
              },
              {
                "value": "sarif",
                "label": "SARIF"
              }
            ],
            "sources": [
              "readme"
            ]
          }
        ],
        "task": [
          {
            "id": "scan-repo",
            "label": "Scan a GitHub repository",
            "fields": [
              "repo",
              "token",
              "format"
            ],
            "required": [
              "repo"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "repo",
              "token",
              "format",
              "scm",
              "scm_base_url"
            ]
          }
        ]
      }
    ]
  }
}