zizmor
Audits GitHub Actions workflows for template injection, dangerous triggers, over-broad permissions and unpinned actions.
Why install it
Section titled “Why install it”A workflow runs with the repository’s secrets and a token that can write to it, and a pull request can change the workflow itself. zizmor knows how GitHub Actions expands expressions and which triggers run untrusted code with privileges, so a review catches the injectable run: step or the pull_request_target job before it merges. It also checks Dependabot and pre-commit config.
At a glance
Section titled “At a glance”| Finds | CI/CD |
| Reads | GitHub Actions |
| Trust level | Safe on untrusted input |
| Official image | Included |
| Licence | MIT |
| Argus tool | run_zizmor |
Install
Section titled “Install”The official Argus container image already ships zizmor. Anywhere else, install this binary on the daemon host:
zizmor:brew install zizmor (or pipx install zizmor)
For other platforms, follow the official install guide. Argus looks for scanners once, when the daemon starts: restart it after installing, and argus doctor shows zizmor as installed.