Project Links

Meta

Author: William Woodruff <william@yossarian.net>

Requires Python: >=3.10

Classifiers

🌈 zizmor

zizmor is a static analysis tool for GitHub Actions.

It can find many common security issues in typical GitHub Actions CI/CD setups, including:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!

zizmor demo

See zizmor's documentation for installation steps, as well as a quickstart and detailed usage recipes.

License

zizmor is licensed under the MIT License.

Contributing

See our contributing guide!

The name?

Now you can have beautiful clean workflows!

Logo-level sponsors
Grafana Labs	Trail of Bits	Shipfox	Kusari

Name-level sponsors
Alexander Riccio

Star History

1.23.1 Mar 08, 2026

1.23.0 Mar 08, 2026

1.23.0rc7 Mar 08, 2026

1.23.0rc6 Mar 08, 2026

1.23.0rc5 Feb 25, 2026

1.23.0rc1 Feb 23, 2026

1.18.0rc3 Nov 29, 2025

1.18.0rc2 Nov 29, 2025

1.11.1rc1 Jul 02, 2025

1.8.0rc2 May 20, 2025

1.8.0rc1 May 20, 2025

Wheel compatibility matrix

Platform	Python 3
macosx_10_12_x86_64
macosx_11_0_arm64
manylinux_2_24_aarch64
manylinux_2_28_armv7l
manylinux_2_28_x86_64
musllinux_1_2_aarch64
musllinux_1_2_armv7l
musllinux_1_2_x86_64
win32
win_amd64