zizmor

What it is

A Rust CLI and GitHub Action that audits CI/CD configs offline, including GitHub Actions workflows plus Dependabot and pre-commit files. Typical findings include template injection, credential persistence, overly broad token permissions, and impostor commits.

What it helps with

- Spotting dangerous patterns in workflow YAML before they ship
- Tightening runner permissions and credential handling in CI
- Checking Dependabot and pre-commit configs alongside Actions files

Who it's for

Developers, open-source maintainers, and DevSecOps teams reviewing CI/CD configs in repositories they own or maintain.

Worth knowing

Findings map to documented audit rules on the project site.

Does it need GitHub API access to scan a checkout?
No, it can analyze workflow files from a local tree without calling the GitHub API.

Can it change workflows, or only report problems?
It can suggest or apply fixes for many findings, not only print alerts.

How does it compare with OpenSSF Scorecard, Gitleaks, and Semgrep?
In our view OpenSSF Scorecard scores repository hygiene, Gitleaks hunts committed secrets, and Semgrep scans application code, while zizmor focuses on CI/CD workflow and related config security.