zizmor audits workflow files for injection vulnerabilities, overly permissive permissions, and other security issues specific to GitHub Actions.
pip install zizmor
zizmor .github/workflows/
Especially relevant because the CI handles secrets (CODECOV_TOKEN, GITHUB_TOKEN). Run locally first, fix any findings, then add to the lint CI job.
zizmoraudits workflow files for injection vulnerabilities, overly permissive permissions, and other security issues specific to GitHub Actions.Especially relevant because the CI handles secrets (CODECOV_TOKEN, GITHUB_TOKEN). Run locally first, fix any findings, then add to the lint CI job.