Project Links

Meta

Requires Python: >=3.10

Classifiers

🌈 zizmor

zizmor is a static analysis tool for CI/CD systems.

It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!

zizmor demo

See zizmor's documentation for installation steps, as well as a quickstart and detailed usage recipes.

License

zizmor is licensed under the MIT License.

Contributing

See our contributing guide!

The name?

Now you can have beautiful clean workflows!

Logo-level sponsors
Grafana Labs	Trail of Bits	Kusari	Tracebit

Name-level sponsors
Alexander Riccio	Carol Willing

Star History

1.30.1 Sep 09, 2026

1.30.0 Aug 30, 2026

1.30.0rc2 Aug 29, 2026

1.30.0rc1 Aug 13, 2026

1.24.0rc3 Apr 13, 2026

1.24.0rc2 Apr 13, 2026

1.23.1 Mar 08, 2026

1.23.0 Mar 08, 2026

1.23.0rc7 Mar 08, 2026

1.23.0rc6 Mar 08, 2026

1.23.0rc5 Feb 25, 2026

1.23.0rc1 Feb 23, 2026

1.18.0rc3 Nov 29, 2025

1.18.0rc2 Nov 29, 2025

1.11.1rc1 Jul 02, 2025

1.8.0rc2 May 20, 2025

1.8.0rc1 May 20, 2025

Wheel compatibility matrix

Platform	Python 3
macosx_10_12_x86_64
macosx_11_0_arm64
manylinux_2_24_aarch64
manylinux_2_28_armv7l
manylinux_2_28_x86_64
musllinux_1_2_aarch64
musllinux_1_2_armv7l
musllinux_1_2_x86_64
win32
win_amd64