zizmorcore/zizmor

zizmorcore/zizmor has 6,937 GitHub stars and 280 forks. GitHot measured +7 stars in 24 hours and +82 in 7 days. Last checked 2026-11-08 16:54 UTC. Last push 2026-11-02.

How these counts are measured

Static analysis for GitHub Actions (and more)

6,937 stars 280 forks +7 in 24h

Measured star growth

in 24h: +7
in 7 days: +82
in 15 days: Update delayed
in 1 month: Update delayed

Net star changes over overlapping periods, not daily totals. Missing measurements are left blank. Stars measure attention, not software quality.

README.md

Original

🌈 zizmor

zizmor is a static analysis tool for CI/CD systems.

It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds:

Template injection vulnerabilities, leading to attacker-controlled code execution
Accidental credential persistence and leakage
Excessive permission scopes and credential grants to runners
Impostor commits and confusable git references
...and much more!

zizmor demo

See zizmor's documentation for installation steps, as well as a quickstart and detailed usage recipes.

License

zizmor is licensed under the MIT License.

Contributing

See our contributing guide!

The name?

Now you can have beautiful clean workflows!

Logo-level sponsors
Grafana Labs	Trail of Bits	Kusari	Tracebit
	Coder	glueckkanja AG	prospex

Name-level sponsors
Alexander Riccio	Carol Willing

Star History

Explore related projects

trimstray/the-book-of-secret-knowledge

A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

257,046 stars

Hack-with-Github/Awesome-Hacking

A collection of various awesome lists for hackers, pentesters and security researchers

125,014 stars

swisskyrepo/PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

82,508 stars

caddyserver/caddy

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

78,910 stars