Skip to content

Zizmor: CI Security Static Analysis

Tool: zizmor

zizmor is a static security analysis tool for GitHub Actions CI/CD workflows written in Rust by William Woodruff.

What It Does

zizmor parses GitHub Actions YAML workflow manifests to detect security vulnerabilities, insecure patterns, and potential attack vectors. It identifies unescaped context interpolations that expose steps to script injection, flags workflows lacking explicit minimal permission blocks, and warns against unpinned third-party actions referencing mutable branch heads.

By checking for patterns where fork pull requests or untrusted triggers could exfiltrate secrets, zizmor secures CI pipelines before changes are deployed.

Why It's in Zenith

Continuous integration pipelines represent high-value attack surfaces because they hold deployment credentials, PyPI release tokens, and code signing keys. AI coding assistants frequently introduce insecure CI patterns, such as unquoted GitHub event contexts in run steps.

Zenith runs zizmor as an automated security quality gate in both prek hooks and scheduled CI pipelines, guaranteeing that infrastructure-as-code remains hardened against supply-chain and injection attacks.

Configuration in Zenith

Configured in .zizmor.yml at the project root:

# ==============================================================================
# Zizmor Configuration (.zizmor.yml)
#
# Tool: Zizmor (https://github.com/zizmorcore/zizmor)
# Purpose: High-performance static security analysis for GitHub Actions CI/CD.
# Why it's in Zenith: Audits CI workflows for script injection vulnerabilities,
# untrusted code execution, cache poisoning, and dangerous trigger configurations.
# ==============================================================================

rules:
    unpinned-uses:
        disable: true

And integrated into prek.toml:

[[repos]]
repo = "https://github.com/woodruffw/zizmor-pre-commit"
rev = "v1.4.1"
hooks = [
    { id = "zizmor", name = "🛡️ zizmor · Audit GitHub Actions workflows" },
]

Key Invocations

uv run zizmor .github/workflows/   # Run static security audit on CI workflows
uv run prek run zizmor -a          # Run zizmor via prek

Upstream Documentation