Fix local scanner version detection and test isolation

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
pelikhan · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
commit 6270c641a4cdb05128a4302dd66cb93068d9d177
diff --git a/docs/src/content/docs/setup/cli.md b/docs/src/content/docs/setup/cli.md
@@ -339,7 +339,7 @@ gh aw compile --dependabot                 # Generate dependency manifests
 gh aw compile --purge                      # Remove orphaned .lock.yml files
 ```
 
-For `--zizmor` and `--poutine`, compilation automatically uses a binary on `PATH` when its `--version` is at least 1.30.1 or 1.1.6, respectively. If the binary is missing, too old, or its version cannot be determined, the scanner uses the pinned Docker image instead. Other Docker-based checks still require Docker.
+For `--zizmor` and `--poutine`, compilation automatically uses a binary on `PATH` when its version is at least 1.30.1 or 1.1.6, respectively. The version is checked with `zizmor --version` or `poutine version --disable-version-check`. If the binary is missing, too old, or its version cannot be determined, the scanner uses the pinned Docker image instead. Other Docker-based checks still require Docker.
 
 If the repository root contains an [`aw.yml` manifest](/gh-aw/reference/aw-yml-package-manifest/), `gh aw compile` validates it before compiling workflows.
 

diff --git a/pkg/cli/docker_images_test.go b/pkg/cli/docker_images_test.go
@@ -10,6 +10,11 @@ import (
 	"time"
 )
 
+func useDockerFallback(t *testing.T) {
+	t.Helper()
+	t.Setenv("PATH", t.TempDir())
+}
+
 func TestCheckAndPrepareDockerImages_NoToolsRequested(t *testing.T) {
 	// Reset state before test
 	ResetDockerPullState()
@@ -22,6 +27,7 @@ func TestCheckAndPrepareDockerImages_NoToolsRequested(t *testing.T) {
 }
 
 func TestCheckAndPrepareDockerImages_ImageAlreadyDownloading(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 
@@ -138,6 +144,7 @@ func TestDockerImageConstants(t *testing.T) {
 }
 
 func TestCheckAndPrepareDockerImages_MultipleImages(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 
@@ -169,6 +176,7 @@ func TestCheckAndPrepareDockerImages_MultipleImages(t *testing.T) {
 }
 
 func TestCheckAndPrepareDockerImages_RetryMessageFormat(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 
@@ -203,6 +211,7 @@ func TestCheckAndPrepareDockerImages_RetryMessageFormat(t *testing.T) {
 }
 
 func TestCheckAndPrepareDockerImages_StartedDownloadingMessage(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 
@@ -229,6 +238,7 @@ func TestCheckAndPrepareDockerImages_StartedDownloadingMessage(t *testing.T) {
 }
 
 func TestCheckAndPrepareDockerImages_ImageAlreadyAvailable(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 
@@ -618,6 +628,7 @@ func TestStartDockerImageDownload_NilContext(t *testing.T) {
 }
 
 func TestCheckAndPrepareDockerImages_DockerUnavailable(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 
@@ -656,6 +667,7 @@ func TestCheckAndPrepareDockerImages_DockerUnavailable(t *testing.T) {
 }
 
 func TestCheckAndPrepareDockerImages_DockerUnavailable_MultipleTools(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 
@@ -751,6 +763,7 @@ func TestCheckAndPrepareDockerImages_DockerUnavailable_ReturnsTypedError(t *test
 }
 
 func TestCheckAndPrepareDockerImages_RunnerGuardImageDownloading(t *testing.T) {
+	useDockerFallback(t)
 	// Reset state before test
 	ResetDockerPullState()
 

diff --git a/pkg/cli/scanner_local.go b/pkg/cli/scanner_local.go
@@ -37,7 +37,11 @@ func localScannerPath(ctx context.Context, name string) string {
 	}
 	versionCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
-	output, err := exec.CommandContext(versionCtx, path, "--version").CombinedOutput()
+	versionArgs := []string{"--version"}
+	if name == "poutine" {
+		versionArgs = []string{"version", "--disable-version-check"}
+	}
+	output, err := exec.CommandContext(versionCtx, path, versionArgs...).CombinedOutput()
 	if err != nil {
 		return ""
 	}

diff --git a/pkg/cli/scanner_local_test.go b/pkg/cli/scanner_local_test.go
@@ -16,10 +16,20 @@ import (
 func installTestScanner(t *testing.T, dir, name, version string) string {
 	t.Helper()
 	path := filepath.Join(dir, name)
-	if err := os.WriteFile(path, []byte("#!/bin/sh\necho '"+version+"'\n"), 0o755); err != nil {
+	script := "#!/bin/sh\n" +
+		"case \"${0##*/}\" in\n" +
+		"  zizmor) [ \"$#\" -eq 1 ] && [ \"$1\" = \"--version\" ] || exit 2 ;;\n" +
+		"  poutine) [ \"$#\" -eq 2 ] && [ \"$1\" = \"version\" ] && [ \"$2\" = \"--disable-version-check\" ] || exit 2 ;;\n" +
+		"esac\n" +
+		"printf '%s\\n' '" + version + "'\n"
+	if err := os.WriteFile(path, []byte(script), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	return path
+	resolvedPath, err := filepath.EvalSymlinks(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return resolvedPath
 }
 
 func TestLocalScannerPathVersionSelection(t *testing.T) {
@@ -88,7 +98,10 @@ func TestLocalScannerCommandsAndDockerFallback(t *testing.T) {
 	if err := os.Remove(poutine); err != nil {
 		t.Fatal(err)
 	}
+	path := os.Getenv("PATH")
+	t.Setenv("PATH", dir)
 	cmd, args, err = buildPoutineCommand(root)
+	t.Setenv("PATH", path)
 	if err != nil || cmd.Path != docker || cmd.Dir != root || !strings.Contains(strings.Join(args, " "), PoutineImage) {
 		t.Fatalf("docker poutine command: %v, %v, %v", cmd, args, err)
 	}