mirror of https://github.com/zizmorcore/zizmor.git synced 2025-12-23 08:47:33 +00:00

Static analysis for GitHub Actions http://docs.zizmor.sh/

Find a file

William Woodruff 83297264aa feat: rewrite unpinned-uses, fold in forbidden-uses (#663 ) Co-authored-by: Jan Holthuis <jan.holthuis@ruhr-uni-bochum.de>		2025-04-13 16:00:55 -04:00
.github	ci: pypi: bump to macos-15 (#618 )	2025-04-08 10:54:59 -04:00
docs	feat: rewrite unpinned-uses, fold in forbidden-uses (#663 )	2025-04-13 16:00:55 -04:00
src	feat: rewrite unpinned-uses, fold in forbidden-uses (#663 )	2025-04-13 16:00:55 -04:00
tests/integration	feat: rewrite unpinned-uses, fold in forbidden-uses (#663 )	2025-04-13 16:00:55 -04:00
.gitignore	feat: unsecure-commands-allowed audit (#176 )	2024-11-19 21:11:10 +00:00
Cargo.lock	feat: rewrite unpinned-uses, fold in forbidden-uses (#663 )	2025-04-13 16:00:55 -04:00
Cargo.toml	feat: rewrite unpinned-uses, fold in forbidden-uses (#663 )	2025-04-13 16:00:55 -04:00
CONTRIBUTING.md	doc: mention conventional commits	2024-11-01 10:13:15 -04:00
Dockerfile	docker: use ZIZMOR_VERSION correctly (#567 )	2025-02-25 12:38:09 -05:00
LICENSE	chore: add LICENSE	2024-10-27 12:42:49 -04:00
Makefile	docs: try to fix the site (#466 )	2025-01-18 15:37:15 -05:00
mkdocs.yml	docs: move changelog to website (#374 )	2025-01-02 09:43:28 +00:00
pyproject.toml	docs: try to fix the site (#466 )	2025-01-18 15:37:15 -05:00
README.md	README: more details (#504 )	2025-01-30 19:09:47 +00:00
uv.lock	docs: try to fix the site (#466 )	2025-01-18 15:37:15 -05:00

🌈 zizmor

zizmor is a static analysis tool for GitHub Actions.

It can find many common security issues in typical GitHub Actions CI/CD setups, including:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!