id          = "poutine"
name        = "Poutine"
homepage    = "https://github.com/boostsecurityio/poutine"
description = "Supply-chain vulnerability scanner for build pipelines."
executables      = ["poutine"]

[dotfiles]

# The upstream README documents the anonymous instance identifier and
# invocation counter at ~/.poutine/config.yaml.  Repository .poutine.yml and
# .github/poutine.yml files are project configuration and are intentionally
# outside this user-dotfile entry.
# https://github.com/boostsecurityio/poutine#version-check-telemetry
paths = ["~/.poutine/config.yaml"]
exclude = []
secret = []

side_effect = false


[commands]
format = 1
label = "Scan CI pipelines"
description = "Analyze a local repository, a remote repository or an organization for CI/CD supply-chain issues. Rule skipping beyond --skip and config-file options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }

[[commands.subcommand]]
path = ["analyze_local"]
label = "Analyze a local repository"

[[commands.subcommand.source]]
id = "readme"
kind = "manual"
url = "https://github.com/boostsecurityio/poutine/blob/main/README.md"
revision = "2026-10-27"
evidence = """
poutine analyze_local .
poutine analyze_local . --config my-config.yml
--format             Output format (default: pretty, json, sarif)
--config             Path to the configuration file (default: .poutine.yml in the working directory, or .github/poutine.yml)
--skip               Add rules to the skip list for the current run (can be specified multiple times)
--fail-on-violation  Exit with a non-zero code (10) when violations are found
"""

[[commands.subcommand.field]]
id = "path"
label = "Repository path"
type = "path"
position = 0
min = 1
path = { kind = "directory", role = "input" }
sources = ["readme"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["--format"]
choices = [{ value = "pretty", label = "Pretty" }, { value = "json", label = "JSON" }, { value = "sarif", label = "SARIF" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "config"
label = "Config file"
type = "path"
option = ["--config"]
path = { kind = "file", role = "input" }
sources = ["readme"]

[[commands.subcommand.field]]
id = "skip"
label = "Skip rules"
type = "string"
option = ["--skip"]
multiple = true
sources = ["readme"]

[[commands.subcommand.field]]
id = "fail_on_violation"
label = "Fail on violation"
type = "boolean"
option = ["--fail-on-violation"]
sources = ["readme"]

[[commands.subcommand.task]]
id = "scan"
label = "Scan current directory"
fields = ["path", "format", "fail_on_violation"]
required = ["path"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["path", "format", "fail_on_violation", "config", "skip"]

[[commands.subcommand]]
path = ["analyze_repo"]
label = "Analyze a remote repository"

[[commands.subcommand.source]]
id = "readme"
kind = "manual"
url = "https://github.com/boostsecurityio/poutine/blob/main/README.md"
revision = "2026-10-27"
evidence = """
poutine analyze_repo org/repo --token "$GH_TOKEN"
poutine analyze_org my-org/project --token "$GL_TOKEN" --scm gitlab --scm-base-url https://gitlab.example.com
--token              SCM access token (required for the commands analyze_repo, analyze_org) (env: GH_TOKEN)
--format             Output format (default: pretty, json, sarif)
--scm                SCM platform (default: github, gitlab)
--scm-base-url       Base URI of the self-hosted SCM instance
--skip               Add rules to the skip list for the current run (can be specified multiple times)
"""

[[commands.subcommand.field]]
id = "repo"
label = "Repository"
description = "org/repo"
type = "string"
position = 0
min = 1
sources = ["readme"]

[[commands.subcommand.field]]
id = "token"
label = "Access token"
description = "Prefer the GH_TOKEN environment variable over typing a token here."
type = "string"
option = ["--token"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "scm"
label = "SCM platform"
type = "enum"
option = ["--scm"]
choices = [{ value = "github", label = "GitHub" }, { value = "gitlab", label = "GitLab" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "scm_base_url"
label = "SCM base URL"
type = "url"
option = ["--scm-base-url"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["--format"]
choices = [{ value = "pretty", label = "Pretty" }, { value = "json", label = "JSON" }, { value = "sarif", label = "SARIF" }]
sources = ["readme"]

[[commands.subcommand.task]]
id = "scan-repo"
label = "Scan a GitHub repository"
fields = ["repo", "token", "format"]
required = ["repo"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["repo", "token", "format", "scm", "scm_base_url"]