iac.zizmorzizmor
Runs zizmor over GitHub Actions workflows and composite actions: template injection, dangerous triggers, excessive permissions, credential persistence, unpinned actions. Runs offline (static audits only); when GH_TOKEN or GITHUB_TOKEN is set it also runs zizmor's online audits, which query the GitHub API for the actions referenced.
- Engine
- Wrapped scanner
- Wraps
zizmor- Targets
- Infrastructure as code
- Areas
- Security, Supply chain
- Runs
- By default, when the target applies
- Network
- Only the target itself
Run only this auditor
bunx openaudit . --only iac.zizmorWraps zizmor. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.