{"id":3859,"library":"zizmor","title":"Zizmor","description":"Zizmor is a static analysis tool for GitHub Actions, designed to identify common security vulnerabilities in CI/CD setups. It detects issues such as template injection, accidental credential leakage, excessive permission scopes, and impostor commits. Currently at version 1.23.1, the project maintains an active development pace with frequent releases.","status":"active","version":"1.23.1","language":"python","source_language":"en","source_url":"https://github.com/zizmorcore/zizmor","tags":["static-analysis","github-actions","security","ci-cd"],"install":[{"cmd":"pip install zizmor","lang":"bash","label":"Install via pip"}],"dependencies":[],"imports":[],"quickstart":{"code":"import subprocess\nimport os\n\n# Ensure zizmor is installed via 'pip install zizmor' and in your PATH.\n# A GitHub token (GH_TOKEN) is often required for full functionality,\n# especially for 'online audits' or resolving remote actions.\ngithub_token = os.environ.get('GH_TOKEN', '')\n\ntry:\n    # Run zizmor audit on the current directory ('.')\n    # Replace '.' with your target GitHub Actions workflow directory if different.\n    command = [\n        \"zizmor\",\n        \"audit\",\n        \"--target\",\n        \".\"\n    ]\n    if github_token:\n        command.extend([\"--github-token\", github_token])\n\n    print(f\"Running command: {' '.join(command)}\")\n    process = subprocess.run(\n        command,\n        capture_output=True,\n        text=True,\n        check=False  # Set to True if you want an exception on non-zero exit codes\n    )\n\n    print(\"\\n--- Zizmor Output ---\")\n    print(process.stdout)\n    if process.stderr:\n        print(\"\\n--- Zizmor Errors ---\")\n        print(process.stderr)\n\n    if process.returncode != 0:\n        print(f\"\\nZizmor exited with non-zero status code: {process.returncode}\")\n    else:\n        print(\"\\nZizmor completed successfully.\")\n\nexcept FileNotFoundError:\n    print(\"Error: 'zizmor' command not found. Please ensure zizmor is installed and in your system's PATH.\")\nexcept Exception as e:\n    print(f\"An unexpected error occurred: {e}\")","lang":"python","description":"This quickstart demonstrates how to run `zizmor` as a command-line tool from Python using `subprocess`. The `--target .` flag scans the current directory for GitHub Actions workflows. A GitHub token (GH_TOKEN) is often necessary for `zizmor` to perform comprehensive 'online audits' and resolve remote actions without hitting GitHub API rate limits."},"warnings":[{"fix":"Refer to release notes when upgrading from versions prior to 1.0.0. For later versions, breaking changes are confined to major version increments.","message":"Zizmor adopted Semantic Versioning starting with v1.0.0. While major versions guarantee breaking changes, pre-1.0.0 releases may have introduced them without strict adherence to semver.","severity":"breaking","affected_versions":"<1.0.0"},{"fix":"Provide a GitHub token (e.g., via `GH_TOKEN` environment variable or `--github-token` flag) to authenticate requests and increase the rate limit. Consider running `zizmor` with `--offline-audits` if online checks are not critical or rate limits are a concern.","message":"GitHub API rate limiting can be an issue when `zizmor` performs extensive 'online checks' (e.g., fetching tags and branches for actions) at scale on large projects. It can quickly hit the 15,000 calls per hour limit.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Ensure your repository meets the GitHub Advanced Security requirements for full integration, or use `advanced-security: false` (if using `zizmor-action`) or rely on console output.","message":"Integrating `zizmor` with GitHub Advanced Security (recommended mode) requires your repository to be public or to have Advanced Security as a paid feature on private repositories. Otherwise, results are printed to the console rather than uploaded to Advanced Security.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Adjust any automation or tooling that consumes SARIF reports from `zizmor` to account for the updated severity mapping if precise categorization is critical.","message":"In version 1.23.1, SARIF (Static Analysis Results Interchange Format) categories were regraded. Specifically, `zizmor`'s 'medium' severity now maps to SARIF's 'low' severity.","severity":"breaking","affected_versions":">=1.23.1"}],"env_vars":null,"search_vec":"'1.23.1':39 'accident':27 'action':10,55 'activ':44 'analysi':6,52 'cd':59 'ci':58 'ci-cd':57 'ci/cd':18 'commit':35 'common':14 'credenti':28 'current':36 'design':11 'detect':21 'develop':45 'excess':30 'frequent':48 'github':9,54 'github-act':53 'identifi':13 'impostor':34 'inject':26 'issu':22 'leakag':29 'maintain':42 'pace':46 'permiss':31 'project':41 'releas':49 'scope':32 'secur':15,56 'setup':19 'static':5,51 'static-analysi':50 'templat':25 'tool':7 'version':38 'vulner':16 'zizmor':1,2","created_at":"2026-04-11T17:47:46.220138+00:00","updated_at":"2026-04-17T01:17:07.955196+00:00","problems":[{"fix":"Ensure `pip install zizmor` completed successfully and add pip's script directory (e.g., `~/.local/bin` on Linux/macOS or `C:\\Users\\User\\AppData\\Roaming\\Python\\Scripts` on Windows) to your system's PATH, or run it using `python -m zizmor`.","cause":"The directory where pip installed the zizmor executable is not in your system's PATH environment variable, or the package was not installed correctly.","error":"zizmor: command not found"},{"fix":"Install the package using `pip install zizmor`. If running from the command line, ensure you are in the correct environment or use `python -m zizmor`.","cause":"The `zizmor` package is not installed in your currently active Python environment, or you are attempting to import it as a library when it's primarily designed as a command-line tool.","error":"ModuleNotFoundError: No module named 'zizmor'"},{"fix":"Provide the necessary argument, for example: `zizmor scan .` to analyze the current directory, or `zizmor scan github.com/owner/repo` for a remote repository.","cause":"The `zizmor` command was executed without providing a required argument, such as the path to the repository or the URL of the GitHub repository to be analyzed.","error":"Error: Missing argument 'REPOSITORY_PATH_OR_URL'."},{"fix":"Review and correct the YAML syntax in your configuration file or GitHub Actions workflow. Use a YAML linter or validator to pinpoint the exact location of the error.","cause":"The `zizmor` configuration file (e.g., `.zizmor.yml` or a GitHub Actions workflow YAML) contains a syntax error, such as incorrect indentation, missing colons, or invalid characters.","error":"yaml.scanner.ScannerError: while scanning for the next token"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"zizmor","cli_version":"zizmor 1.25.2","type":"library","homepage":"https://docs.zizmor.sh","github":"https://github.com/zizmorcore/zizmor","docs":"https://docs.zizmor.sh","changelog":null,"pypi":"https://pypi.org/project/zizmor/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["devops","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-04-11","next_check":"2026-07-10","install_tag":null}}