ensurePoutineConfig creates .poutine.yml to configure allowed runners if it doesn't exist
(gitRoot string)
| 44 | |
| 45 | // ensurePoutineConfig creates .poutine.yml to configure allowed runners if it doesn't exist |
| 46 | func ensurePoutineConfig(gitRoot string) error { |
| 47 | configPath := filepath.Join(gitRoot, ".poutine.yml") |
| 48 | |
| 49 | // Check if config already exists |
| 50 | if fileutil.FileExists(configPath) { |
| 51 | // Config exists, do not update it |
| 52 | poutineLog.Print(".poutine.yml already exists, skipping creation") |
| 53 | return nil |
| 54 | } |
| 55 | |
| 56 | // Create the config file |
| 57 | configContent := `# Configure poutine security scanner |
| 58 | # See: https://github.com/boostsecurityio/poutine |
| 59 | |
| 60 | # Set rule configuration options |
| 61 | rulesConfig: |
| 62 | pr_runs_on_self_hosted: |
| 63 | allowed_runners: |
| 64 | - ubuntu-slim # GitHub's new built-in runner (not self-hosted) |
| 65 | ` |
| 66 | |
| 67 | // Write the config file |
| 68 | if err := os.WriteFile(configPath, []byte(configContent), constants.FilePermPublic); err != nil { |
| 69 | return fmt.Errorf("failed to write .poutine.yml: %w", err) |
| 70 | } |
| 71 | |
| 72 | poutineLog.Printf("Created .poutine.yml at %s", configPath) |
| 73 | return nil |
| 74 | } |
| 75 | |
| 76 | // runPoutineOnDirectory runs the poutine security scanner on a directory containing workflows |
| 77 | func runPoutineOnDirectory(workflowDir string, verbose bool, strict bool) error { |