zizmor

To audit GitHub Actions workflows for security issues, you can scan any repository with a .github/workflows directory to detect credential mishandling, untrusted inputs, template injection, and overly permissive tokens. Results are output as a JSON findings structure.

Common security vulnerabilities in GitHub Actions workflows include credential mishandling, untrusted inputs, template injection, and overly permissive tokens. Scanning workflow files identifies these configuration risks and converts them into actionable findings.

Yes, you can integrate GitHub Actions security findings into dashboards or alerts by mapping identified issues into scrutineer's findings schema. This JSON format streamlines security reviews and enables downstream monitoring.

Yes, you need Python 3 on PATH to run a GitHub Actions workflow security scan. The scanning process also requires the zizmor tool available to analyze workflow files and emit findings to a report.json file.

Yes, you can use this GitHub Actions security audit in CI pipelines or manual reviews. Running the provided script surfaces actionable security signals from workflow configurations directly within your automated pipeline.

The best way to detect overly permissive tokens in GitHub Actions is to run an automated scan of your workflow files. The scan evaluates token configurations and translates identified permission risks into a structured JSON findings format.