zizmor

Static analysis for GitHub Actions

🌈 zizmor zizmor is a static analysis tool for GitHub Actions. It can find many common security issues in typical GitHub Actions CI/CD setups, including: Template injection vulnerabilities, leading to attacker controlled code execution Accidental credential persistence and leakage Excessive permission scopes and crede It has reached 5,307 GitHub stars, written primarily in Rust.

Why now: Sustained developer attention keeps it in the tracked pool; GitHub activity is the current lead signal.

• 5,307 GitHub stars, 205 forks — verifiable at github.com/zizmorcore/zizmor.
• Primary language Rust; topics: github-actions, security, security-tools, static-analysis.
• Licensed MIT.

Considerations: Solid adoption (5,307 stars) but quiet cross-source signal right now — established utility more than a current breakout.

EARLY MOMENTUM · Research: Adoption is real but cross-source confirmation is thin — a short hands-on trial (Rust) will tell you more than the metrics.

Sources: zizmorcore/zizmor on GitHub · Project homepage