zizmor: security audit of GitHub Actions

Security · CI/CD

Not studied

Added 2026-10-29.

Problem

The workflow is syntactically valid, but it runs fork code with secrets via pull_request_target, takes actions by tag and grants the token excessive permissions. This kind of configuration is how Trivy was compromised in 2026.

Solution

zizmor is "a static analysis tool for CI/CD systems". It "can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit": template injection leading to attacker-controlled code execution, accidental credential persistence and leakage, excessive permission scopes, dangerous triggers, unpinned uses and images. It doesn't replace actionlint: actionlint looks for mistakes, zizmor for vulnerabilities.

Example

zizmor .github/workflows/
zizmor --offline .github/workflows/   # no GitHub API requests

.pre-commit-config.yaml:

repos:
  - repo: https://github.com/zizmorcore/zizmor-pre-commit
    rev: v1.31.1
    hooks:
      - id: zizmor

With a token in GH_TOKEN, zizmor runs in online mode and performs additional checks.

When to use

In any repository with GitHub Actions — including mirrors. Not applicable to GitLab CI.

Source

• zizmorcore/zizmor
• Usage modes and inputs
• pre-commit integration

How to apply it yourself

1. Run it against one repository with workflows.
2. Fix the high findings: pin actions by SHA, narrow permissions.
3. Add the hook to pre-commit next to actionlint.
4. Mark it "Studied" once there have been no new high findings for two weeks.