zizmor

zizmor is a static analysis tool for GitHub Actions workflows that also checks Dependabot and pre-commit configurations. It flags misconfigurations attackers can exploit, including template injection, overly broad permissions and actions pinned to mutable tags as well as the use of risky triggers such as pull_request_target. It can also fix some findings automatically.

This year, attackers [exploited a pull_request_targetworkflow in the Trivy repository, then rewrote the tags of its GitHub Action so pipelines referencing those tags ran the attackers' code. Our teams have used zizmor on client work, running it from the command line and as a pre-commit hook while writing workflows. Coding agents can run it too, providing quick feedback on the pipelines they write.

Amid the attention on AI-powered security scanning, we like having a deterministic tool for this job. Snyk and Wiz cover some of the same ground commercially and general linters catch some of these issues, but zizmor is free and open source. Its drawback is scope: it doesn’t cover any other CI platforms beyond GitHub Actions. Teams using GitHub Actions should evaluate zizmor alongside zero trust security for CI/CD.