CheckOps home

Tools directory

Z

CheckOps

zizmor

zizmor is an MIT static analysis tool for GitHub Actions that finds security problems such as template injection, excessive permissions, credential persistence and unpinned actions.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

zizmor is a static analysis tool for GitHub Actions focused on security. It audits workflows and composite actions for weaknesses that attackers use to compromise CI pipelines and the secrets they hold.

Audits include template injection from untrusted event data, overly broad permissions, actions/checkout persisting credentials, dangerous triggers such as pull_request_target, unpinned or impostor action references, known-vulnerable actions, cache poisoning risks and more. Findings carry severity and confidence, and it can produce SARIF for GitHub code scanning. Some audits can use the GitHub API for online checks.

In the quality loop it is a security gate for the delivery pipeline itself.

The source code is at zizmorcore/zizmor on GitHub under the MIT licence, with about 7,000 stars; the most recent commit was on 11 November 2026.

Features

  1. Injection detection: Template injection from untrusted inputs.
  2. Permission audits: Flags broad or missing permission blocks.
  3. Pinning audits: Unpinned and impostor action references.
  4. Online audits: Optional GitHub API checks for known-vulnerable actions.
  5. SARIF output: Upload to code scanning.
  6. Auto-fix: Fixes for some findings.

Pros

  1. Pipeline security: Targets a frequently overlooked attack surface.
  2. Free to use: Open source under the MIT licence, so the core tool costs nothing to use.
  3. Actively maintained: The repository had commits as recent as 11 November 2026.
  4. Community: About 7,000 GitHub stars.

Cons

  1. GitHub-specific: Other CI systems are out of scope.
  2. Noise on legacy workflows: Older workflows may need many changes.
  3. Fast-moving: Frequent releases change audits.
pipx install zizmor
zizmor .github/workflows/
zizmor --format sarif . > zizmor.sarif

Resources:

Pricing

zizmor is free and open source under the MIT licence.

  1. Open-source maintainers whose workflows handle untrusted pull requests.
  2. Security teams hardening CI pipelines.

Conclusion

zizmor fills an important gap by treating CI workflows as attack surface.

Pair it with actionlint: one for correctness, one for security.

On CheckOps, zizmor is filed under the Release & CI gates and Security testing stages. Related tools listed here include act, actionlint, OpenSSF Scorecard, pre-commit, Super-Linter and Gitleaks. Before standardising on one, compare recent maintenance activity, the pricing model as your usage grows, and the integrations you rely on today. Information on this page was verified against the official website, documentation and repository on 11 November 2026.

Compare

CheckOps pages that put zizmor next to related tools. There is no paid placement on these lists.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with zizmor side by side.