zizmor
CLIStatic security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.
🌈 zizmor
zizmor is a static analysis tool for CI/CD systems.
It can find and fix security issues in common CI/CD setups, including GitHub Actions,
Dependabot, and pre-commit. Some of the things zizmor finds:
- Template injection vulnerabilities, leading to attacker-controlled code execution
- Accidental credential persistence and leakage
- Excessive permission scopes and credential grants to runners
- Impostor commits and confusable
gitreferences - ...and much more!
See zizmor's documentation
for installation steps, as well as a quickstart and
detailed usage recipes.
License
zizmor is licensed under the MIT License.
Contributing
The name?
Now you can have beautiful clean workflows!
Sponsors
zizmor's development is supported by these amazing sponsors!
Grafana Labs |
Trail of Bits |
Kusari |
Tracebit | ||||
Coder |
glueckkanja AG |
prospex | |||||
| Alexander Riccio | Carol Willing |
Want to see your name or logo above? Consider becoming a sponsor through one of the following:
- GitHub Sponsors (preferred)
- thanks.dev
- ko-fi
Star History
関連リソース
act
CLIRuns GitHub Actions workflows locally in Docker, so you can test .github/workflows changes without repeated commits and pushes, or use workflows as a local task runner. Needs Docker installed.
nektos/act72.3k
GitHub Agentic Workflows
CLIGitHub's official gh extension for writing Actions workflows in Markdown that AI agents execute, compiled into standard Actions. Choose engines like Copilot, Claude Code or Codex; runs in a read-only sandbox by default. Requires gh.
github/gh-aw5.4k
TruffleHog
CLIFinds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives.
trufflesecurity/trufflehog28.5k
Agentic Actions Auditor
SkillTrail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.
trailofbits/skills7.6k
GitHub CLI
CLIGitHub's official CLI: manage pull requests, issues, releases and Actions workflows from the terminal. Most commands support --json output that agents can parse, and an official agent skill is available. Run gh auth login first.
cli/cli46.7k
Semgrep
CLISemantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in.
semgrep/semgrep17.1k