zizmor
Zizmor is a static analysis tool for CI/CD systems such as GitHub Actions, Dependabot and pre-commit. It detects vulnerabilities, template injections, identity information leaks, and overauthorizations. It is distributed under the MIT license.
zizmor
80zizmorcore · Code Quality & Review
Common commercial products in this category: SonarCloud, Codacy, DeepSource
- You detect vulnerabilities in GitHub Actions and similar CI/CD installations.
- You find risks such as template injection and a leak of identity information.
- You examine the over-permission scopes and authorization assignments given to the handlers.
- • NeutralHacker News
Zizmor would have caught the Ultralytics workflow vulnerability
“This post has left me wondering: what is zizmor? What is ultralytics? Are these words actually real or is someone having a stroke? Not all nerds know all projects so I decided to educate myself and followed OP’s links to learn about Ultralytics: > Ultralytics YOLO11 is a…”
- • NeutralGitHub Issue
[META] Fix mode features
“See #28 for original context. This is a meta-issue for tracking some of the features/goals for a fix mode in `zizmor`. - [x] Build the groundwork for a fix mode: #858 - [x] Confirm the basic functionality of a fix mode with an initial set of audits - [x] #858 includes…”