mirror of https://github.com/zizmorcore/zizmor.git synced 2025-12-23 08:47:33 +00:00

Static analysis for GitHub Actions http://docs.zizmor.sh/

github-actions security security-tools static-analysis

Find a file

William Woodruff e202bd4ea2 Some checks failed CI / Lint (push) Has been cancelled Details zizmor wheel builds for PyPI 🐍 / Build Windows wheels (push) Has been cancelled Details zizmor wheel builds for PyPI 🐍 / Build macOS wheels (push) Has been cancelled Details zizmor wheel builds for PyPI 🐍 / Build source distribution (push) Has been cancelled Details Deploy zizmor documentation site 🌐 / Deploy zizmor documentation to GitHub Pages 🌐 (push) Has been cancelled Details CI / Test (push) Has been cancelled Details CI / Test site build (push) Has been cancelled Details Benchmark baseline / Continuous Benchmarking with Bencher (push) Has been cancelled Details zizmor wheel builds for PyPI 🐍 / Build Linux wheels (manylinux) (push) Has been cancelled Details zizmor wheel builds for PyPI 🐍 / Build Linux wheels (musllinux) (push) Has been cancelled Details GitHub Actions Security Analysis with zizmor 🌈 / Run zizmor 🌈 (push) Has been cancelled Details zizmor wheel builds for PyPI 🐍 / Release (push) Has been cancelled Details CI / All tests pass (push) Has been cancelled Details feat: yamlpath: anchor support (#1266 )		2025-10-20 21:30:23 -04:00
.cargo	ci: experiment with a binary release build (#828 )	2025-05-20 14:29:51 -04:00
.github	feat: track anchors in yamlpath (#1263 )	2025-10-19 16:38:33 -04:00
bench	feat: use git2 and improve HTTP caching (#1257 )	2025-10-16 22:00:44 -04:00
crates	feat: yamlpath: anchor support (#1266 )	2025-10-20 21:30:23 -04:00
docs	feat: yamlpath: anchor support (#1266 )	2025-10-20 21:30:23 -04:00
support	chore: misc repo cleanup (#1154 )	2025-09-14 23:58:10 +00:00
.gitignore	Handle flow and block style values properly (#904 )	2025-06-10 17:31:06 -04:00
Cargo.lock	chore(deps): bump the cargo group with 5 updates (#1268 )	2025-10-20 10:33:48 -04:00
Cargo.toml	chore(deps): bump the cargo group with 5 updates (#1268 )	2025-10-20 10:33:48 -04:00
CONTRIBUTING.md	chore(docs): the great @zizmorcore renaming (#776 )	2025-05-09 20:08:45 -04:00
Dockerfile	ci: convert Dockerfile to Wolfi (#667 )	2025-04-14 19:09:48 +00:00
LICENSE	chore: add LICENSE	2024-10-27 12:42:49 -04:00
Makefile	bench: add support for online benchmarks (#1258 )	2025-10-15 20:46:13 -04:00
mise.toml	chore(docs): `make pinact` (#1103 )	2025-08-21 11:07:07 -04:00
mkdocs.yml	chore(docs): remove external links section, add crates.io link to footer (#1137 )	2025-09-03 22:58:36 -04:00
pyproject.toml	chore: misc repo cleanup (#1154 )	2025-09-14 23:58:10 +00:00
README.md	docs: bump sponsors list (#1167 )	2025-09-18 22:47:38 +00:00
uv.lock	chore: misc repo cleanup (#1154 )	2025-09-14 23:58:10 +00:00

README.md

🌈 zizmor

zizmor is a static analysis tool for GitHub Actions.

It can find many common security issues in typical GitHub Actions CI/CD setups, including:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!