step-security/zizmor-action

Run zizmor from GitHub Actions 🌈

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
inputs	The inputs to pass to `zizmor`. This should be a whitespace-separated list of inputs. Inputs will be split with shell splitting rules.	no	.
online-audits	Whether to run online audits.	no	true
persona	The auditing persona to use. This can be 'regular' (default), 'pedantic', or 'auditor'.	no	regular
min-severity	The minimum severity to report findings for. This can be 'unknown', 'informational', 'low', 'medium', or 'high'.	no	—
min-confidence	The minimum confidence to report findings for. This can be 'unknown', 'low', 'medium', or 'high'.	no	—
version	The version of zizmor to use	no	latest
token	The GitHub API token to use for zizmor online-audits (if enabled).	no	${{ github.token }}
advanced-security	Whether to enable GitHub Advanced Security for zizmor's results. This will use the SARIF output format under the hood and will upload the results to the repository's security tab.	no	true
color	Whether zizmor should output colorized CLI output.	no	true
annotations	Whether to emit GitHub annotations for zizmor's results. This will use GitHub's workflow commands under the hood. This option is mutually exclusive with `advanced-security: true`. You must explicitly set `advanced-security: false` to enable this option.	no	false
config	Path to a custom zizmor configuration file Path (e.g., zizmor.yml).	no	—
fail-on-no-inputs	Whether the action should fail if no inputs are collected by zizmor. By default, zizmor will fail if it couldn't collect any inputs to audit. Setting this option to `false` will make the action succeed in such cases, with a warning message instead. This input only works with zizmor v1.21.0 and later. Earlier versions will always fail on no inputs.	no	true

Outputs

name	description
output-file	Filepath to static analysis results in SARIF format"