mirror of https://github.com/zizmorcore/zizmor.git synced 2025-12-23 08:47:33 +00:00

Static analysis for GitHub Actions http://docs.zizmor.sh/

Find a file

William Woodruff 53bac39869 update repro case Signed-off-by: William Woodruff <william@yossarian.net>		2025-05-12 11:53:30 -04:00
.github	chore(docs): constrain permissions in workflow example (#781 )	2025-05-11 02:24:57 -04:00
docs	chore(docs): bump trophies (#782 )	2025-05-12 01:21:12 +00:00
src	chore(deps): bump the cargo group with 5 updates (#786 )	2025-05-12 11:12:02 -04:00
tests/integration	update repro case	2025-05-12 11:53:30 -04:00
.gitignore	feat: unsecure-commands-allowed audit (#176 )	2024-11-19 21:11:10 +00:00
Cargo.lock	chore(deps): bump the cargo group with 5 updates (#786 )	2025-05-12 11:12:02 -04:00
Cargo.toml	chore(deps): bump the cargo group with 5 updates (#786 )	2025-05-12 11:12:02 -04:00
CONTRIBUTING.md	chore(docs): the great @zizmorcore renaming (#776 )	2025-05-09 20:08:45 -04:00
Dockerfile	ci: convert Dockerfile to Wolfi (#667 )	2025-04-14 19:09:48 +00:00
LICENSE	chore: add LICENSE	2024-10-27 12:42:49 -04:00
Makefile	chore(ci): fix makefile target (#721 )	2025-04-30 04:46:26 +00:00
mkdocs.yml	chore(docs): the great @zizmorcore renaming (#776 )	2025-05-09 20:08:45 -04:00
pyproject.toml	docs: try to fix the site (#466 )	2025-01-18 15:37:15 -05:00
README.md	chore(docs): the great @zizmorcore renaming (#776 )	2025-05-09 20:08:45 -04:00
uv.lock	docs: try to fix the site (#466 )	2025-01-18 15:37:15 -05:00

🌈 zizmor

zizmor is a static analysis tool for GitHub Actions.

It can find many common security issues in typical GitHub Actions CI/CD setups, including:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!