# zizmor

> Static analysis tool that finds and fixes security issues in CI/CD configurations, including GitHub Actions workflows, Dependabot, and pre-commit.

Stars: 6.8k · Language: Rust · License: MIT · Categories: Dev Tools

- Repository: https://github.com/zizmorcore/zizmor
- Website: http://docs.zizmor.sh/
- Page: https://www.trmn.sh/tools/zizmor

## Overview

zizmor is a static analysis tool for CI/CD systems. It scans CI/CD configuration files for security problems and can fix some of them. Supported targets are GitHub Actions, Dependabot, and pre-commit setups. It is a command-line tool published on crates.io and licensed under MIT.

It reports several classes of issues: template injection vulnerabilities that can lead to attacker-controlled code execution, accidental credential persistence and leakage, excessive permission scopes and credential grants to runners, and impostor commits and confusable git references. The README says this list is partial. The full set of audits is documented at docs.zizmor.sh/audits.

The intended users are developers, security engineers, and maintainers who write or review GitHub Actions workflows and want to find security misconfigurations before they ship. The README points to the project documentation for installation steps, a quickstart, and detailed usage recipes.

![zizmor demo](https://media.trmn.sh/cached/a32feb11049047a38aeb195c4a2df5bd340397a8f6ac7f5e434eefef56c9a939.gif)

## Alternatives

- [tealdeer](https://www.trmn.sh/tools/tealdeer.md): Fast Rust implementation of tldr providing simplified, example-based manual pages for command-line tools (Rust, 6.6k stars)
- [pastel](https://www.trmn.sh/tools/pastel.md): Command-line tool to generate, analyze, convert and manipulate colors across multiple formats and color spaces (Rust, 6.5k stars)
- [jscpd](https://www.trmn.sh/tools/jscpd.md): Copy/paste detector for 224 source formats with a Rust engine. Also reports dead code, complexity, git-history duplication trends, and a health score. (Rust, 6.5k stars)
- [watchexec](https://www.trmn.sh/tools/watchexec.md): File watcher that runs commands when files change, with .gitignore support and cross-platform filesystem monitoring (Rust, 7.3k stars)
- [sd](https://www.trmn.sh/tools/sd.md): Find and replace CLI tool with regex support, string-literal mode, and faster performance than sed (Rust, 7.4k stars)

## Guides

- [Best CLI Tools for Working on GitHub Actions](https://www.trmn.sh/best/github-actions-development-tools): Compare act, zizmor, gh: workflows, strengths and tradeoffs.

---

Canonical: https://www.trmn.sh/tools/zizmor