# github-actions/zizmor

> Audits GitHub Actions workflows and composite actions with zizmor for template injection, excessive permissions, and dangerous triggers.

Audits GitHub Actions workflows and composite actions with zizmor for template injection, excessive permissions, and dangerous triggers.

Part of the [`github-actions`](/reference/configurations/github-actions/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), per file. It runs zizmor.

## Why

A workflow runs with the repository’s credentials; an injectable expression can hand them to a stranger.

## What to do

Apply the fix zizmor names, or turn one audit off with `gspot ignore github-actions/zizmor --rule <audit> --reason "<why>"`.

## Example

A workflow that puts pull request text straight into a shell command reports `template-injection`. Pass the text through a step environment variable, and quote its expansion.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore github-actions/zizmor --paths "<glob>" --reason "<why>"
gspot ignore github-actions/zizmor --rule <rule> --reason "<why>"
```