mirror of https://github.com/zizmorcore/zizmor.git synced 2025-12-23 08:47:33 +00:00

Static analysis for GitHub Actions http://docs.zizmor.sh/

github-actions security security-tools static-analysis

Find a file

William Woodruff 1e25953cdd Some checks are pending CI / Lint (push) Waiting to run Details CI / Test (push) Waiting to run Details CI / Test site build (push) Waiting to run Details CI / All tests pass (push) Blocked by required conditions Details zizmor wheel builds for PyPI 🐍 / Build Linux wheels (manylinux) (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build Linux wheels (musllinux) (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build Windows wheels (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build macOS wheels (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build source distribution (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Release (push) Blocked by required conditions Details Deploy zizmor documentation site 🌐 / Deploy zizmor documentation to GitHub Pages 🌐 (push) Waiting to run Details GitHub Actions Security Analysis with zizmor 🌈 / Run zizmor 🌈 (push) Waiting to run Details perf: eliminate more low-level allocations (#1412 )		2025-12-07 20:21:55 -05:00
.cargo	ci: experiment with a binary release build (#828 )	2025-05-20 14:29:51 -04:00
.github	chore(ci): allow CI to run on undrafting of PRs (#1404 )	2025-12-01 22:47:07 -05:00
bench	feat: use git2 and improve HTTP caching (#1257 )	2025-10-16 22:00:44 -04:00
crates	perf: eliminate more low-level allocations (#1412 )	2025-12-07 20:21:55 -05:00
docs	feat: add an `archived-uses` audit (#1411 )	2025-12-04 22:15:33 -05:00
support	feat: add an `archived-uses` audit (#1411 )	2025-12-04 22:15:33 -05:00
.gitignore	Handle flow and block style values properly (#904 )	2025-06-10 17:31:06 -04:00
Cargo.lock	perf: eliminate more low-level allocations (#1412 )	2025-12-07 20:21:55 -05:00
Cargo.toml	perf: eliminate more low-level allocations (#1412 )	2025-12-07 20:21:55 -05:00
CONTRIBUTING.md	chore(docs): the great @zizmorcore renaming (#776 )	2025-05-09 20:08:45 -04:00
Dockerfile	ci: convert Dockerfile to Wolfi (#667 )	2025-04-14 19:09:48 +00:00
LICENSE	chore: add LICENSE	2024-10-27 12:42:49 -04:00
Makefile	feat: add an `archived-uses` audit (#1411 )	2025-12-04 22:15:33 -05:00
mise.toml	chore(docs): `make pinact` (#1103 )	2025-08-21 11:07:07 -04:00
mkdocs.yml	docs: add troubleshooting page (#1296 )	2025-10-28 20:49:51 -04:00
pyproject.toml	chore: attempt to fix sdist metadata, prep another RC (#1388 )	2025-11-29 03:29:18 +00:00
README.md	chore(docs): refresh sponsor list (#1301 )	2025-10-30 13:33:27 +00:00
uv.lock	chore: bump zensical, site deps (#1397 )	2025-11-30 16:22:15 -05:00

README.md

🌈 zizmor

zizmor is a static analysis tool for GitHub Actions.

It can find many common security issues in typical GitHub Actions CI/CD setups, including:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!