Hacker GitHub

← All repos

zizmorcore/zizmor

View on GitHub ↗ ★ 6,856 Rust

Static analysis for GitHub Actions (and more)

16 mentions on Hacker News by 13 people: 3 stories, 13 comments · first 2024-12-08 · latest 2026-08-17

Mentions per year 16 mentions · busiest year 2026 (11)
20082026
AllStoriesComments NewestTopOldest
  1. …mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion -->…
    comment by inahga · 2026-08-17 · in AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
  2. also been a huge fan of zizmor ( https://github.com/zizmorcore/zizmor ) lately, basically: "am I going to footgun myself?"
    comment by thejosh · 2026-08-17 · in AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
  3. …- use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes…
    comment by vldszn · 2026-05-20 · in GitHub confirms breach of 3,800 repos via malicious VSCode extension
  4. Maybe zizmor could catch this https://github.com/zizmorcore/zizmor but not sure 100%
    comment by vldszn · 2026-05-20 · in GitHub is investigating unauthorized access to their internal repositories
  5. - Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers…
    comment by vldszn · 2026-05-20 · in GitHub is investigating unauthorized access to their internal repositories
  6. Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration. It is however unfortunate, that such footguns aren't harder to fire.
    comment by lknuth · 2026-05-12 · in Postmortem: TanStack NPM supply-chain compromise
  7. Oh, I guess I didn't document it explicitly. My bad! You can see it in the source here[1]. [1]: https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8...
    comment by woodruffw · 2026-04-28 · in GitHub Actions is the weakest link
  8. Not sure that Trivy was doing that itself but zizmor is probably better than starting with an LLM : https://github.com/zizmorcore/zizmor
    comment by jimmySixDOF · 2026-03-24 · in Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised
  9. zizmor ( https://github.com/zizmorcore/zizmor ) and actionlint (runs shellcheck on run: | blocks) provide some bandaid. zizmor detects quite a few typical injection patterns like branch names and shellcheck enforces quoeting rules in the…
    comment by whopdrizzard · 2026-03-06 · in A GitHub Issue Title Compromised 4k Developer Machines
  10. Zizmor has a check for this. https://github.com/woodruffw/zizmor
    comment by cedws · 2025-05-08 · in How to harden GitHub Actions
  11. …and weaknesses. [1] https://cookie.engineer/weblog/articles/malware-insights-git... [2] https://github.com/woodruffw/zizmor
    comment by cookiengineer · 2025-03-20 · in The Pain That Is GitHub Actions
  12. Good recommendations, including a neat tool to audit your GHAs: https://github.com/woodruffw/zizmor , “A static analysis tool for GitHub Actions”.
    comment by ronjouch · 2024-12-14 · in Analysis of supply-chain attack on Ultralytics
  13. I named it explicitly for Dr. Zizmor :-) https://github.com/woodruffw/zizmor#the-name
    comment by woodruffw · 2024-12-08 · in Zizmor would have caught the Ultralytics workflow vulnerability