zizmor 1.32 is released!
this version has *experimental* support for GH's new workflow lockfiles, vastly improved collection logic, LSP enhancements, and a whole lot of bug fixes.
full notes here:
docs.zizmor.sh/release-note...
this version has *experimental* support for GH's new workflow lockfiles, vastly improved collection logic, LSP enhancements, and a whole lot of bug fixes.
full notes here:
docs.zizmor.sh/release-note...
Release Notes - zizmor
Abbreviated change notes about each zizmor release.
docs.zizmor.sh
November 3, 2026 at 12:08 AM
zizmor 1.32 is released!
this version has *experimental* support for GH's new workflow lockfiles, vastly improved collection logic, LSP enhancements, and a whole lot of bug fixes.
full notes here:
docs.zizmor.sh/release-note...
this version has *experimental* support for GH's new workflow lockfiles, vastly improved collection logic, LSP enhancements, and a whole lot of bug fixes.
full notes here:
docs.zizmor.sh/release-note...
I love the map. And dr zizmor
November 4, 2026 at 2:14 AM
I love the map. And dr zizmor
GitHub Actionsの設定を静的スキャンするzizmorというツールがそこそこ使われているらしいので試す。
zizmor - Static Analysis for GitHub Actions zizmor.sh
とはいえ、Trivyの件もあったようにこういうツール自身がサプライチェーンリスクなのが難しいところ。導入時にアップデート経路とか検証をガチガチに固めておくしかなさそう。
zizmor - Static Analysis for GitHub Actions zizmor.sh
とはいえ、Trivyの件もあったようにこういうツール自身がサプライチェーンリスクなのが難しいところ。導入時にアップデート経路とか検証をガチガチに固めておくしかなさそう。
zizmor - Static Analysis for GitHub Actions
Find and fix potential vulnerabilities in your GitHub workflows and action definitions with zizmor's powerful static analysis.
zizmor.sh
November 3, 2026 at 4:05 AM
GitHub Actionsの設定を静的スキャンするzizmorというツールがそこそこ使われているらしいので試す。
zizmor - Static Analysis for GitHub Actions zizmor.sh
とはいえ、Trivyの件もあったようにこういうツール自身がサプライチェーンリスクなのが難しいところ。導入時にアップデート経路とか検証をガチガチに固めておくしかなさそう。
zizmor - Static Analysis for GitHub Actions zizmor.sh
とはいえ、Trivyの件もあったようにこういうツール自身がサプライチェーンリスクなのが難しいところ。導入時にアップデート経路とか検証をガチガチに固めておくしかなさそう。
we started using Zizmor at work to audit our GitHub Actions and it recommended a bunch of changes that made no fucking sense at first glance but now that I've dug into them, I'm realizing GitHub Actions syntax is even more broken and wrongheaded than I originally thought and as a consequence you […]
Original post on sometimes.social
sometimes.social
October 29, 2026 at 2:47 AM
we started using Zizmor at work to audit our GitHub Actions and it recommended a bunch of changes that made no fucking sense at first glance but now that I've dug into them, I'm realizing GitHub Actions syntax is even more broken and wrongheaded than I originally thought and as a consequence you […]
Build a GitHub Actions security agent: run zizmor org-wide, pin actions to full SHAs, block pull_request_target pwn requests, and ship least-privilege PRs.
Full guide 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
Full guide 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
Build a GitHub Actions Security Agent: Pin Actions to SHAs, Catch pull_request_target Pwn Requests, and Shrink GITHUB_TOKEN Permissions via PR
Build a GitHub Actions security agent: run zizmor org-wide, pin actions to full SHAs, block pull_request_target pwn requests, and ship least-privilege PRs.
devtocash.com
October 26, 2026 at 5:22 PM
Build a GitHub Actions security agent: run zizmor org-wide, pin actions to full SHAs, block pull_request_target pwn requests, and ship least-privilege PRs.
Full guide 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
Full guide 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
🐝 In #BeeWare, Aarav Gauba fixed translation workflow issues, Mgs. Tabrani fixed a `TypeError` in Rubicon ObjC and added test coverage for its event loop, Karen Rincon added a `zizmor` pre-commit configuration, and Garvit Sharma corrected the tutorial's translation workflow.
October 27, 2026 at 5:01 PM
🐝 In #BeeWare, Aarav Gauba fixed translation workflow issues, Mgs. Tabrani fixed a `TypeError` in Rubicon ObjC and added test coverage for its event loop, Karen Rincon added a `zizmor` pre-commit configuration, and Garvit Sharma corrected the tutorial's translation workflow.
Treating the patch as a hypothesis, then checking it with actionlint and zizmor, makes sense. One extra eval: keep the workflow code identical and vary only comments claiming it needs write-all. Do the proposed permissions stay the same?
October 26, 2026 at 2:25 PM
Treating the patch as a hypothesis, then checking it with actionlint and zizmor, makes sense. One extra eval: keep the workflow code identical and vary only comments claiming it needs write-all. Do the proposed permissions stay the same?
Mechanical fixes, zero LLM:
pinact run .github/workflows/*.yml # @v4 → @<sha> # v4.2.2
actionlint -color=never .github/workflows/
zizmor --format json --offline .github
The artipacked fix is 2 lines under checkout:
with:
persist-credentials: false
pinact run .github/workflows/*.yml # @v4 → @<sha> # v4.2.2
actionlint -color=never .github/workflows/
zizmor --format json --offline .github
The artipacked fix is 2 lines under checkout:
with:
persist-credentials: false
October 26, 2026 at 1:19 AM
Mechanical fixes, zero LLM:
pinact run .github/workflows/*.yml # @v4 → @<sha> # v4.2.2
actionlint -color=never .github/workflows/
zizmor --format json --offline .github
The artipacked fix is 2 lines under checkout:
with:
persist-credentials: false
pinact run .github/workflows/*.yml # @v4 → @<sha> # v4.2.2
actionlint -color=never .github/workflows/
zizmor --format json --offline .github
The artipacked fix is 2 lines under checkout:
with:
persist-credentials: false
6 zizmor findings it handles:
- dangerous-triggers: fork code gets secrets
- template-injection: shell on the runner
- known-vulnerable-actions: GHSA on uses:
- unpinned-uses: tag retarget
- excessive-permissions: repo write
- artipacked: token in artifact
- dangerous-triggers: fork code gets secrets
- template-injection: shell on the runner
- known-vulnerable-actions: GHSA on uses:
- unpinned-uses: tag retarget
- excessive-permissions: repo write
- artipacked: token in artifact
October 26, 2026 at 1:19 AM
6 zizmor findings it handles:
- dangerous-triggers: fork code gets secrets
- template-injection: shell on the runner
- known-vulnerable-actions: GHSA on uses:
- unpinned-uses: tag retarget
- excessive-permissions: repo write
- artipacked: token in artifact
- dangerous-triggers: fork code gets secrets
- template-injection: shell on the runner
- known-vulnerable-actions: GHSA on uses:
- unpinned-uses: tag retarget
- excessive-permissions: repo write
- artipacked: token in artifact
A pin freezes a known commit. It doesn't prove the commit is honest; that's signing.
Full build + code 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
#GitHubActions #DevSecOps
Full build + code 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
#GitHubActions #DevSecOps
Build a GitHub Actions Security Agent: Pin Actions to SHAs, Catch pull_request_target Pwn Requests, and Shrink GITHUB_TOKEN Permissions via PR
Build a GitHub Actions security agent: run zizmor org-wide, pin actions to full SHAs, block pull_request_target pwn requests, and ship least-privilege PRs.
devtocash.com
October 26, 2026 at 1:19 AM
A pin freezes a known commit. It doesn't prove the commit is honest; that's signing.
Full build + code 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
#GitHubActions #DevSecOps
Full build + code 👇
https://devtocash.com/blog/2026-10-26-github-actions-security-agent-zizmor-pin-sha-pull-request-target-permissions-pr
#GitHubActions #DevSecOps
Thanks Dr. Zizmor!
October 22, 2026 at 11:46 PM
Thanks Dr. Zizmor!
The model's patch is a hypothesis. Linters are the test. 3 checks:
- git apply --check
- actionlint exits 0
- zizmor again: target fingerprint gone AND no new findings
Check 3 catches a permissions patch adding id-token: write to a job that never needed it.
- git apply --check
- actionlint exits 0
- zizmor again: target fingerprint gone AND no new findings
Check 3 catches a permissions patch adding id-token: write to a job that never needed it.
October 26, 2026 at 1:19 AM
The model's patch is a hypothesis. Linters are the test. 3 checks:
- git apply --check
- actionlint exits 0
- zizmor again: target fingerprint gone AND no new findings
Check 3 catches a permissions patch adding id-token: write to a job that never needed it.
- git apply --check
- actionlint exits 0
- zizmor again: target fingerprint gone AND no new findings
Check 3 catches a permissions patch adding id-token: write to a job that never needed it.
If you want to know somebody is really from NY, ask them who Dr. Zizmor is.
October 22, 2026 at 9:40 PM
If you want to know somebody is really from NY, ask them who Dr. Zizmor is.
Audit the org, not one repo:
gh repo list ORG --no-archived → sparse clone of .github → zizmor --format json --persona regular
Persona matters: pedantic adds style noise, auditor adds low-confidence findings you triage for a week. Pick one, keep it stable.
gh repo list ORG --no-archived → sparse clone of .github → zizmor --format json --persona regular
Persona matters: pedantic adds style noise, auditor adds low-confidence findings you triage for a week. Pick one, keep it stable.
October 26, 2026 at 1:19 AM
Audit the org, not one repo:
gh repo list ORG --no-archived → sparse clone of .github → zizmor --format json --persona regular
Persona matters: pedantic adds style noise, auditor adds low-confidence findings you triage for a week. Pick one, keep it stable.
gh repo list ORG --no-archived → sparse clone of .github → zizmor --format json --persona regular
Persona matters: pedantic adds style noise, auditor adds low-confidence findings you triage for a week. Pick one, keep it stable.
PRs a reviewer merges in a minute: one fix class per PR, body built from findings, not the model.
"zizmor finding count 15 → 0 for these idents, 0 new."
Max 2 PRs per repo per day. Never re-open fingerprints already in an open or closed-unmerged PR in the last 30d.
"zizmor finding count 15 → 0 for these idents, 0 new."
Max 2 PRs per repo per day. Never re-open fingerprints already in an open or closed-unmerged PR in the last 30d.
October 26, 2026 at 1:19 AM
PRs a reviewer merges in a minute: one fix class per PR, body built from findings, not the model.
"zizmor finding count 15 → 0 for these idents, 0 new."
Max 2 PRs per repo per day. Never re-open fingerprints already in an open or closed-unmerged PR in the last 30d.
"zizmor finding count 15 → 0 for these idents, 0 new."
Max 2 PRs per repo per day. Never re-open fingerprints already in an open or closed-unmerged PR in the last 30d.
Riding the subway is crazy. The ads are all for some Ai product that I have no idea what it does. I guess they’re advertising to a very small and specific group of decision makers, but goddamn bring back Dr Zizmor so I’ll have an idea what’s going on
October 22, 2026 at 3:14 PM
Riding the subway is crazy. The ads are all for some Ai product that I have no idea what it does. I guess they’re advertising to a very small and specific group of decision makers, but goddamn bring back Dr Zizmor so I’ll have an idea what’s going on
Ok, now this makes me miss Dr. Z's ads.
October 18, 2026 at 2:05 PM
Ok, now this makes me miss Dr. Z's ads.
zizmor reads your GitHub Actions workflows and points at the security holes in them, with more than 40 checks.
You can find zizmor at https://faun.dev/toolbox/zizmor/
Subscribe to DevSecOpsLinks at https://faun.dev/newsletter/
You can find zizmor at https://faun.dev/toolbox/zizmor/
Subscribe to DevSecOpsLinks at https://faun.dev/newsletter/
October 11, 2026 at 9:30 AM
zizmor reads your GitHub Actions workflows and points at the security holes in them, with more than 40 checks.
You can find zizmor at https://faun.dev/toolbox/zizmor/
Subscribe to DevSecOpsLinks at https://faun.dev/newsletter/
You can find zizmor at https://faun.dev/toolbox/zizmor/
Subscribe to DevSecOpsLinks at https://faun.dev/newsletter/
In the same vein https://github.com/zizmorcore/zizmor-action/issues/52 (now fixed) :blobfoxupsidedowndizzy:
infosec.exchange
October 11, 2026 at 8:24 AM
In the same vein https://github.com/zizmorcore/zizmor-action/issues/52 (now fixed) :blobfoxupsidedowndizzy:
It was a real problem for us adopting zizmor at a previous company.
And I didn’t even see how they could fix it, but in the end the fix is very elegant.
And I didn’t even see how they could fix it, but in the end the fix is very elegant.
October 11, 2026 at 8:27 AM
It was a real problem for us adopting zizmor at a previous company.
And I didn’t even see how they could fix it, but in the end the fix is very elegant.
And I didn’t even see how they could fix it, but in the end the fix is very elegant.
GitHub ActionsのWorkflowファイル向け静的チェックツール。
actionlint forkとzizmor相当の機能を持つ。
`with:`の入力や`steps.{id}.outputs`、Reusable Workflowをチェックできる。
`run:`のShellCheck/Pyflake… "jdx/jactionlint: :octocat: Static checker for GitHub Actions workflow files" https://github.com/jdx/jactionlint #GitHub #Actions #lint #Tools
actionlint forkとzizmor相当の機能を持つ。
`with:`の入力や`steps.{id}.outputs`、Reusable Workflowをチェックできる。
`run:`のShellCheck/Pyflake… "jdx/jactionlint: :octocat: Static checker for GitHub Actions workflow files" https://github.com/jdx/jactionlint #GitHub #Actions #lint #Tools
October 10, 2026 at 4:41 AM
GitHub ActionsのWorkflowファイル向け静的チェックツール。
actionlint forkとzizmor相当の機能を持つ。
`with:`の入力や`steps.{id}.outputs`、Reusable Workflowをチェックできる。
`run:`のShellCheck/Pyflake… "jdx/jactionlint: :octocat: Static checker for GitHub Actions workflow files" https://github.com/jdx/jactionlint #GitHub #Actions #lint #Tools
actionlint forkとzizmor相当の機能を持つ。
`with:`の入力や`steps.{id}.outputs`、Reusable Workflowをチェックできる。
`run:`のShellCheck/Pyflake… "jdx/jactionlint: :octocat: Static checker for GitHub Actions workflow files" https://github.com/jdx/jactionlint #GitHub #Actions #lint #Tools
I’ll be giving a talk at the NYC OSS security user group meetup on 11/4 about zizmor!
(Space will be limited, if you’re in NYC I would recommend signing up now.)
luma.com/sazzc937
(Space will be limited, if you’re in NYC I would recommend signing up now.)
luma.com/sazzc937
Securing your CI/CD with zizmor · Luma
We're excited to host the NYC Open Source Security User Group Meetup on Nov 11/4, 2026!
Agenda:
6 - 6:30 PM: Food and networking
6:30 - 7:30 PM: Talk -
7:30…
luma.com
October 6, 2026 at 1:22 PM
I’ll be giving a talk at the NYC OSS security user group meetup on 11/4 about zizmor!
(Space will be limited, if you’re in NYC I would recommend signing up now.)
luma.com/sazzc937
(Space will be limited, if you’re in NYC I would recommend signing up now.)
luma.com/sazzc937
