github-actions/zizmor
Audits GitHub Actions workflows and composite actions with zizmor for template injection, excessive permissions, and dangerous triggers.
Part of the github-actions configuration, at the recommended level. It runs at the commit stage, per file. It runs zizmor.
A workflow runs with the repository’s credentials; an injectable expression can hand them to a stranger.
What to do
Section titled “What to do”Apply the fix zizmor names, or turn one audit off with gspot ignore github-actions/zizmor --rule <audit> --reason "<why>".
Example
Section titled “Example”A workflow that puts pull request text straight into a shell command reports template-injection. Pass the text through a step environment variable, and quote its expansion.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore github-actions/zizmor --paths "<glob>" --reason "<why>"gspot ignore github-actions/zizmor --rule <rule> --reason "<why>"