Stout: the registry that refuses known-bad code at the gate

Overview

When Stout detects a stout.yaml in your project root, it uses the manifest to customize the build pipeline. Without it, Stout runs the default ecosystem strategy for your package type.

Place a stout.yaml file at your repo root to customize how Stout builds your package.

Modes

Extend Mode

Add pre/post build steps around the default ecosystem strategy. Good for adding linting, code generation, or post-build verification without replacing the standard build.

mode: extend

Replace Mode

Define the entire build yourself. The ecosystem strategy is ignored. You control every step, and must specify where the artifact is.

mode: replace

Full Spec Reference

The complete stout.yaml schema with all available fields:

stout.yaml

version: 1
mode: extend  # "extend" or "replace"

build:
  pre:                              # Run before ecosystem build (extend mode)
    - name: generate
      run: go generate ./...
  steps:                            # The entire build (replace mode only)
    - name: build
      run: make build
  post:                             # Run after ecosystem build (extend mode)
    - name: verify
      run: sha256sum artifact.tar.gz

env:                                # Environment variables for all steps
  CGO_ENABLED: "0"
  GOOS: linux

artifact:                           # Override artifact location and type
  path: artifact.tar.gz
  media_type: application/gzip

resources:                          # Resource hints for K8s builds
  cpu: "4"
  memory: 8Gi
  storage: 20Gi

Examples

Go with pre-build linting

extend

stout.yaml

version: 1
mode: extend
build:
  pre:
    - name: lint
      run: golangci-lint run
    - name: generate
      run: go generate ./...

C++ project with cmake

replace

stout.yaml

version: 1
mode: replace
build:
  steps:
    - name: configure
      run: cmake -B build -DCMAKE_BUILD_TYPE=Release
    - name: build
      run: cmake --build build --parallel
    - name: package
      run: tar czf artifact.tar.gz -C build .
artifact:
  path: artifact.tar.gz
  media_type: application/gzip

Node.js with code generation

extend

stout.yaml

version: 1
mode: extend
build:
  pre:
    - name: codegen
      run: npx prisma generate
    - name: typecheck
      run: npx tsc --noEmit
env:
  NODE_ENV: production

Multi-step Rust build with custom flags

extend

stout.yaml

version: 1
mode: extend
build:
  pre:
    - name: fmt-check
      run: cargo fmt -- --check
    - name: clippy
      run: cargo clippy -- -D warnings
env:
  RUSTFLAGS: "-C target-cpu=native"

Security

Commands in stout.yaml are validated against the sandbox allowlist.
An LLM-based guard analyzes your manifest commands in the context of your project type and file structure.
The guard is fail-closed: if it can't verify commands are safe, the build is rejected.
Shell metacharacters (pipes, redirects, &&) are supported -- commands are automatically wrapped in sh -c.

Allowed Commands

Only commands on the allowlist can be used in build steps. Grouped by category:

Core

shbashmaketarzipunzipgzipbzip2cpmvmkdirrmfindxargsechosha256sumcurlwget

gogolangci-lint

Node.js

npmyarnpnpmnodenpx

Python

pythonpip

Ruby

rubygembundle

Rust

cargorustc

Java / .NET

mvngradlejavacdotnet

C / C++

gccg++ccc++cmake

Other

swiftcomposerdarthelmgitzip

Resource Hints

The resources block is advisory for local builds.
For K8s builds, it directly controls pod resource limits.
Defaults if not specified: 2 CPU, 2Gi memory, 10Gi storage.
Higher defaults for resource-intensive ecosystems: 4 CPU, 8Gi memory for Rust, Maven, Swift, and Docker.