[TOOL_PROFILE]
zizmor
Static security analyzer for GitHub Actions workflows.
cisecurity lang: yaml platform: local
[USE_WHEN]ALLOW
- ✓ Scan GitHub Actions workflows for security risks and hardening opportunities
- ✓ Review CI changes that affect tokens, permissions, or third-party actions
[AVOID_WHEN]BLOCK
- ✕ The repository does not use GitHub Actions
- ✕ Findings would expose sensitive workflow details in shared logs
[GUARDRAILS]MANDATORY
- ⚠ Redact repository-specific secrets and internal URLs from shared findings.
- ⚠ Review workflow permissions and third-party actions before applying suggested fixes.
[DETAILS]RAW_META
- Binary
- zizmor
- Effects
- read_files, secret_exposure
- Documentation
- https://docs.zizmor.sh/
[SIMILAR_TOOLS]03