lfreleng-actions/Zizmor security audit
Audit GitHub Actions workflows with the zizmor static analyser.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| persona | zizmor persona: regular, pedantic, or auditor. | no | auditor |
| min-severity | Lowest severity reported: unknown, informational, low, medium, high. | no | informational |
| min-confidence | Lowest confidence reported: low, medium, or high. Empty audits all confidences. | no | "" |
| working-directory | Path within the workspace to audit. | no | . |
| zizmor-version | Override the bundled pin with an explicit tag (e.g. v1.25.2). | no | "" |
| extra-args | Additional raw arguments appended to the zizmor call. | no | "" |
| upload-sarif | Upload the SARIF to code scanning from within this action. | no | false |
| summary-repository | owner/repo label for step-summary links; defaults to the repository running the workflow. Set when the workspace holds a checkout of a different repository. Applies only together with summary-sha: a partial or malformed pair is ignored with a warning. | no | "" |
| summary-sha | Commit SHA (7-40 hex digits) for step-summary links; defaults to the workflow commit. Applies only together with summary-repository: a partial or malformed pair is ignored with a warning. | no | "" |
Outputs
| name | description |
|---|---|
| sarif-file | Absolute path to the generated SARIF file. |