Skip to content

Verification · Static analysis · CI workflow linting

Workflow security audit

Flag template injection, pull_request_target misuse, unpinned third-party actions and write-all permissions.

How to build it

Run zizmor over .github/workflows in CI.
Move untrusted ${{ github.event... }} values into environment variables before they reach run: steps.
Pin third-party actions to full commit SHAs and set permissions per job.

Signals in a repository

A zizmor step in a workflow or a zizmor configuration file in the repository.
Third-party uses: lines pinned to 40-character commit SHAs.

In practice

33 repositories run a tool for this check in the scanned set.

zizmor · 33 repos

Examples

axios/axios · zizmor
```
uses zizmorcore/zizmor-action
```
neovim/neovim · zizmor
```
uses zizmorcore/zizmor-action
```
fastapi/fastapi · zizmor
```
zizmor .
```
django/django · zizmor
```
uses zizmorcore/zizmor-action
```
home-assistant/core · zizmor
```
pre-commit hook zizmor
```