Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Static Code Analysis

Scan CI pipeline definitions for security findings

poutine-scan is an offline build-pipeline security scanner using poutine analyze_local.

Agent
Find pipeline injection patternsKeep dependency contextApply repository scan settings

overview

What poutine-scan does

Scan CI/CD pipeline definitions (GitHub Actions, GitLab CI, Azure Pipelines, Tekton) for build-pipeline supply-chain vulnerabilities with BoostSecurity poutine analyze_local. Native JSON findings and rule catalog; offline, nothing runs.

Analyze repository pipeline definitions with poutine 1.1.6 analyze_local. Native JSON contains findings with rule_id, package URL and location/event metadata, packages seen in the definitions, and the rule catalog. Repository .poutine.yml or .github/poutine.yml settings apply.

Supply a repository with .github, .gitlab-ci.yml, azure-pipelines.yml or .tekton. A folder containing only top-level YAML workflows is staged as .github/workflows. scm selects github by default or gitlab event semantics. Version checks are disabled and SCM token variables cleared. Findings are successful output; parse/runtime failures or no pipelines fail.

Packaged version: 1.1.6. Upstream license: Apache-2.0.

source github.com/boostsecurityio/poutine/tree/8918c66db19ecfd12b2f8379e445c3da4589e599

use cases

Where poutine-scan fits

Find pipeline injection patterns

Receive located findings for unsafe event-expression handling.

Keep dependency context

Inspect native package URLs and the rule catalog with findings.

Apply repository scan settings

Use supplied poutine configuration for local analysis.

reference

poutine-scan inputs and flags

2 inputs
NameTypeFlagDescription
sourceFOLDER--sourceRepository folder with .github, .gitlab-ci.yml, azure-pipelines.yml or .tekton, or a folder of GitHub workflow .yml/.yaml files.
scmSTRING--scmgithub (default) or gitlab, the platform whose event semantics apply.

Showing key inputs. poutine-scan exposes 2 inputs in total.

example

Run poutine-scan

poutine-scan · command
/app/run.sh --source ./source ./output

guidance

Choosing poutine-scan

Use poutine-scan for supported local pipeline rules. Remote stale-branch and organization checks are unavailable. Zizmor overlaps on GitHub Actions injection findings but uses a different rule set; actionlint checks workflow syntax. The saved fixture here validates GitHub semantics, not every supported provider.

faq

poutine-scan questions

source: Repository folder with .github, .gitlab-ci.yml, azure-pipelines.yml or .tekton, or a folder of GitHub workflow .yml/.yaml files. scm: github (default) or gitlab, the platform whose event semantics apply.

Analyze repository pipeline definitions with poutine 1.1.6 analyze_local. Native JSON contains findings with rule_id, package URL and location/event metadata, packages seen in the definitions, and the rule catalog. Repository .poutine.yml or .github/poutine.yml settings apply.

Supply a repository with .github, .gitlab-ci.yml, azure-pipelines.yml or .tekton. A folder containing only top-level YAML workflows is staged as .github/workflows. scm selects github by default or gitlab event semantics. Version checks are disabled and SCM token variables cleared. Findings are successful output; parse/runtime failures or no pipelines fail.

Use poutine-scan for supported local pipeline rules. Remote stale-branch and organization checks are unavailable. Zizmor overlaps on GitHub Actions injection findings but uses a different rule set; actionlint checks workflow syntax. The saved fixture here validates GitHub semantics, not every supported provider.

The public image repository gives immutable image and ORAS download commands, the expected source/notices bundle checksum and pinned upstream source directions. The accompanying OCI bundle retains the original build recipe, runtime sources and full installed notices. The Git recipe keeps primary notices and an exact layer/hash index; it does not duplicate the full installed notice tree or mirror every upstream source archive. Image, source and license notice downloads.

related

More Static Code Analysis tools

  1. bandit

    Python source in, JSON security findings out.

  2. gitleaks

    Detect hardcoded secrets in git repos and plain directories.

  3. gosec

    Go AST security scanner for credentials, crypto, and injection.

  4. guarddog

    A package coordinate in, indicator hits out.

  5. malcontent-scan

    A package coordinate in, behavior findings out.

  6. osv-malicious

    A package coordinate in, malware advisory rows out.

Run poutine-scan yourself

The saved GitHub fixture verifier confirmed injection at .github/workflows/ci.yml line 8 and default_permissions_on_risky_events, with no findings for safe.yml. The complete native findings/packages/rules report was not retained. The command shows the container entrypoint with example paths.

Open poutine-scan in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.