---
id: zizmor
version: "1.29.0"
license: MIT
license_treatment: permissive
maintenance: active
---

# zizmor — Static analysis for GitHub Actions

License: permissive · Maintenance: active · Downloads: 5.0M/mo

## What it is and what it does

zizmor is a static analysis tool designed to audit CI/CD pipelines for security misconfigurations. It examines GitHub Actions workflows, Dependabot configurations, and pre-commit hooks to detect vulnerabilities including template injection that could lead to code execution, accidental credential persistence, overly broad permission grants, and git reference spoofing. The tool runs locally as a command-line utility with no external dependencies, making it straightforward to integrate into development workflows or CI systems themselves.

The package is actively maintained, recently released, and backed by established security organizations. It targets modern Python (3.10+) and ships as pre-built wheels for common platforms, eliminating compilation friction. With no runtime dependencies and permissive MIT licensing, it presents minimal adoption barriers for teams seeking to harden their CI/CD security posture.

Use it for:

- Audit GitHub Actions workflows before merging to catch template injection and credential exposure risks.
- Scan Dependabot configurations to ensure dependency updates don't grant excessive permissions.
- Validate pre-commit hook setups to prevent compromised hooks from executing arbitrary code.
- Integrate into CI pipelines to enforce security checks on workflow file changes.
- Review existing workflow repositories for historical misconfigurations and permission creep.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

zizmor is a static analysis tool that scans CI/CD configurations—GitHub Actions, Dependabot, and pre-commit—to identify and fix security vulnerabilities like template injection, credential leakage, and excessive permission grants.

Yes. zizmor addresses a genuine gap in CI/CD security tooling with active maintenance, zero runtime dependencies, permissive licensing, and broad platform support. It is worth installing if you use GitHub Actions, Dependabot, or pre-commit and want to catch configuration-level security issues before they reach production.

## Install

pip install zizmor
uv add zizmor
poetry add zizmor

## Installing zizmor

Before you install: Medium install friction due to platform-specific wheels across multiple architectures (macOS, Linux, Windows, ARM variants). Active maintenance with a recent release and no runtime dependencies simplifies deployment once installed.

License in practice: MIT license permits unrestricted use, modification, and distribution with minimal obligations—suitable for both commercial and open-source projects.

Quickstart:

pip install zizmor
zizmor lint .github/workflows/

Requires Python 3.10 or later.

Verify before relying:

- Specific categories of security issues detected beyond those listed (template injection, credential leakage, permission scopes, impostor commits).
- Whether zizmor can automatically fix identified issues or only report them.
- Performance characteristics on large workflow repositories or complex configurations.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: medium
- Maintenance: active
- Downloads: 5.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

github actions security scanner, ci/cd static analysis tool, workflow vulnerability detection, github actions linter, ci/cd security audit, dependabot security check, workflow configuration analysis, ci-cd-security, static-analysis, github-actions

[View on SkillFed](https://skillfed.io/packages/zizmor) · [View on PyPI](https://pypi.org/project/zizmor/)