Static analysis for GitHub Actions workflows and action.yml files, written in Rust.
github.com/zizmorcore/zizmor ↗The most thorough open-source scanner for Actions workflows, fast, offline by default and actively released.
zizmor parses every workflow under .github/workflows, composite action definitions (action.yml) and Dependabot config, and runs a set of named audits over the parsed YAML. Each audit knows the semantics of Actions: which triggers run with secrets, which expression contexts an outsider controls, and what a uses: reference resolves to.
Most audits are offline: template-injection, dangerous-triggers, excessive-permissions, unpinned-uses, artipacked (credentials left by actions/checkout), cache-poisoning, secrets-inherit and self-hosted-runner. Online audits such as impostor-commit, ref-confusion and known-vulnerable-actions call the GitHub API with a token to check that a pinned SHA really belongs to the action's repository and that the version has no advisory.
Findings carry a severity and a confidence. Personas (regular, pedantic, auditor) control how noisy it is, a zizmor.yml file or an inline '# zizmor: ignore[audit]' comment suppresses findings, and output is plain text, JSON, SARIF or GitHub annotations.
pipx install zizmor
zizmor .
# CI-friendly: no network, SARIF out
zizmor --no-online-audits --format sarif . > zizmor.sarifOffline audits send nothing. Online audits call the GitHub API with GH_TOKEN; --no-online-audits turns them off.
Template injection via a crafted branch name against a format.yml workflow using pull_request_target. Secrets including secrets._GITHUB_TOKEN were exfiltrated and the build cache poisoned to inject a cryptominer into v8.3.41 and v8.3.42. The read from researchers was that the attackers had write access but preferred extracting CI/CD secrets, then used them to poison the cache and ship malicious releases.
Click to open →The structural flaw behind most of the incidents on this page. pull_request deliberately withholds write permissions and secrets; pull_request_target was created to restore them, and becomes hazardous the moment maintainers treat it as a normal CI trigger. workflow_run carries the same risk and gets far less attention: the triggered workflow can access secrets and write tokens even when the workflow that triggered it could not. One industry scan found 38% of organizations have a workflow vulnerable to script injection or dangerous triggers. Since 8 December 2025, pull_request_target always runs the workflow file from the default branch and checks out the default branch, whatever branch the pull request targets. That closes attacks through an old, vulnerable workflow left on another branch. It does not help when the default branch workflow itself checks out and runs the pull request's code.
Click to open →actions/checkout persists the GitHub token into .git/config by default; uploading the whole checkout directory as an artifact exposes it. Researchers observed leakage of both GITHUB_TOKEN and the undocumented ACTIONS_RUNTIME_TOKEN, which lives about six hours and can be used to swap an artifact for a malicious version. The token-theft path is a race condition: download the artifact mid-run and create a branch before expiry. It requires the workflow to hold contents: write.
Click to open →GitHub stats as of 10 Oct 2026. How ratings work.