What the developer wrote
Authored by Jose Storopoli
ci: add zizmor checks on PRs
What changed, and why it matters
This commit adds a new automated security scanner called zizmor to the project's GitHub Actions CI pipeline. It only runs when pull requests modify files under the .github/ directory. There is no code change to the library itself and no vulnerability is being fixed or introduced.
No security action required. This is a defensive CI hardening addition. Reviewers may verify the pinned action hashes and empty permissions are correct.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit introduces .github/workflows/zizmor.yml, which runs the zizmor static analyzer against the repository’s GitHub Actions workflows when PRs touch .github/**. It uses actions/checkout with persist-credentials: false and minimal permissions. The README is updated to document the new check. No application code, cryptographic logic, or dependency changes are present.
Changed components
.github/workflows/zizmor.yml.github/workflows/README.mdInspect captured patch +28 / −0
diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index a7b54d00..38a6340e 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -34,3 +34,6 @@ Run from rust.yml unless stated otherwise. Unfortunately we are now exceeding th
20. `release` - run by `release.yml`
21. `labeler` - run by `manage-pr.yml`
22. `Shellcheck` - run by `shellcheck.yml`
+
+If any change touches the `.github/` directory then the `zizmor`, run by `zizmor.yml`, will be
+triggered for that PR.
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..0aba6efa
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,25 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+ pull_request:
+ branches: ["**"]
+ paths:
+ - '.github/**'
+
+permissions: {}
+
+jobs:
+ zizmor:
+ name: zizmor latest via PyPI
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+ with:
+ persist-credentials: false
+
+ - name: Install the latest version of uv
+ uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v5
+
+ - name: Run zizmor 🌈
+ run: uvx zizmor .
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.