mirror of https://github.com/zizmorcore/zizmor.git synced 2025-12-23 08:47:33 +00:00

Static analysis for GitHub Actions http://docs.zizmor.sh/

github-actions security security-tools static-analysis

Find a file

William Woodruff eaa30b07c0 Some checks are pending Benchmark baseline / Continuous Benchmarking with Bencher (push) Waiting to run Details CI / Lint (push) Waiting to run Details CI / Test (push) Waiting to run Details CI / Test site build (push) Waiting to run Details CI / All tests pass (push) Blocked by required conditions Details zizmor wheel builds for PyPI 🐍 / Build macOS wheels (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build Linux wheels (manylinux) (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build Linux wheels (musllinux) (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build Windows wheels (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Build source distribution (push) Waiting to run Details zizmor wheel builds for PyPI 🐍 / Release (push) Blocked by required conditions Details Deploy zizmor documentation site 🌐 / Deploy zizmor documentation to GitHub Pages 🌐 (push) Waiting to run Details GitHub Actions Security Analysis with zizmor 🌈 / Run zizmor 🌈 (push) Waiting to run Details fix(docs): fix missing link to GitHub docs (#1155 )		2025-09-15 00:03:43 +00:00
.cargo	ci: experiment with a binary release build (#828 )	2025-05-20 14:29:51 -04:00
.github	chore(deps): bump github/codeql-action in the github-actions group (#1140 )	2025-09-08 10:16:41 -04:00
bench	feat: CLI benchmarking harness (#1038 )	2025-07-24 20:13:35 -04:00
crates	fix: handle another cache setting in setup-node (#1153 )	2025-09-14 09:09:41 -04:00
docs	fix(docs): fix missing link to GitHub docs (#1155 )	2025-09-15 00:03:43 +00:00
support	chore: misc repo cleanup (#1154 )	2025-09-14 23:58:10 +00:00
.gitignore	Handle flow and block style values properly (#904 )	2025-06-10 17:31:06 -04:00
Cargo.lock	chore: prep for v1.13.0 release (#1147 )	2025-09-12 19:25:00 -04:00
Cargo.toml	refactor: move expr call APIs to a new module (#1143 )	2025-09-11 21:34:07 -04:00
CONTRIBUTING.md	chore(docs): the great @zizmorcore renaming (#776 )	2025-05-09 20:08:45 -04:00
Dockerfile	ci: convert Dockerfile to Wolfi (#667 )	2025-04-14 19:09:48 +00:00
LICENSE	chore: add LICENSE	2024-10-27 12:42:49 -04:00
Makefile	chore: misc repo cleanup (#1154 )	2025-09-14 23:58:10 +00:00
mise.toml	chore(docs): `make pinact` (#1103 )	2025-08-21 11:07:07 -04:00
mkdocs.yml	chore(docs): remove external links section, add crates.io link to footer (#1137 )	2025-09-03 22:58:36 -04:00
pyproject.toml	chore: misc repo cleanup (#1154 )	2025-09-14 23:58:10 +00:00
README.md	chore(docs): bump sponsors, trophies (#1054 )	2025-08-03 01:57:58 +00:00
uv.lock	chore: misc repo cleanup (#1154 )	2025-09-14 23:58:10 +00:00

README.md

🌈 zizmor

zizmor is a static analysis tool for GitHub Actions.

It can find many common security issues in typical GitHub Actions CI/CD setups, including:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!