iframe-proxy | Sunbelt Computer Software

Repository navigation

# Configure poutine security scanner

# See: https://github.com/boostsecurityio/poutine

# Set rule configuration options

rulesConfig:

pr_runs_on_self_hosted:

allowed_runners:

- ubuntu-slim # GitHub's new built-in runner (not self-hosted)

# Acknowledge findings that do not apply to gh-aw generated workflows.

# poutine has no inline ignore comment mechanism; skips must be declared here.

skip:

# The generated "activation" job runs helper scripts from

# "$RUNNER_TEMP/gh-aw/actions/*.sh". Those scripts are extracted from the

# pinned gh-aw action, not from the repository checkout, so they cannot be

# controlled by an untrusted contributor. The rule still fires because the

# workflow declares an untrusted trigger (for example workflow_call).

- rule: untrusted_checkout_exec

job: activation