zizmor

https://github.com/zizmorcore/zizmor
Admin
zizmor is a static analysis tool for GitHub Actions that finds common security issues in CI/CD...
Tokens:105,732
Snippets:859
Trust Score:7.3
License:MIT
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install cargo-insta for snapshot testing

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Install cargo-insta, the easiest way to use insta for snapshot testing.

```bash
cargo install --locked cargo-insta
```

--------------------------------

### Dependabot execution: before and after configuration

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after examples for the `dependabot-execution` audit. The before example shows the insecure `insecure-external-code-execution: allow` setting, while the after example shows the recommended `deny` value. Both are for a `dependabot.yml` file with a pip ecosystem.

```yaml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    insecure-external-code-execution: allow
```

```yaml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    insecure-external-code-execution: deny
```

--------------------------------

### Install zizmor from PyPI with pip, pipx, or uv

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Install zizmor from PyPI using pip, pipx, or uv. The uvx command runs zizmor without a permanent install. Python wheels are provided on a best-effort basis.

```bash
# with pip
pip install zizmor

# with pipx
pipx install zizmor

# with uv
uv tool install zizmor

# or, shortcut:
uvx zizmor --help
```

--------------------------------

### adhoc-packages audit: before and after remediation

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after examples for the adhoc-packages audit. The before example uses `gem install rake` which is flagged as an ad-hoc package installation. The after example uses `bundle install` which installs from a lockfile and is the recommended remediation.

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.0.0
      - run: gem install rake
```

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.0.0
      - run: bundle install
```

--------------------------------

### Enable zizmor LSP in Neovim (init.lua)

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/integrations.md

Add this line to your init.lua after installing nvim-lspconfig to enable the zizmor LSP server. Requires zizmor to be installed separately.

```lua
vim.lsp.enable('zizmor')
```

--------------------------------

### insecure-commands remediation: before and after

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after examples for the insecure-commands audit. The before example shows the insecure use of the deprecated ::add-path workflow command with ACTIONS_ALLOW_UNSECURE_COMMANDS set to true. The after example replaces it with the GITHUB_PATH environment file.

```yaml
- name: Setup my-bin
  run: |
    echo "::add-path::$HOME/.local/my-bin"
  env:
    ACTIONS_ALLOW_UNSECURE_COMMANDS: true

```

```yaml
- name: Setup my-bin
  run: |
    echo "$HOME/.local/my-bin" >> "$GITHUB_PATH"

```

--------------------------------

### dependabot-cooldown remediation: before and after dependabot.yml

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after examples for the dependabot-cooldown audit. The before example lacks a cooldown setting, while the after example adds cooldown with default-days: 7 to remediate the finding.

```yaml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"

```

```yaml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    cooldown:
      default-days: 7

```

--------------------------------

### Install pinact with Homebrew

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Installs the pinact tool locally via Homebrew, which is used to update `uses:` clauses in zizmor's documentation.

```bash
brew install pinact
```

--------------------------------

### Run live development server

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Start a development server that monitors for changes to the docs. The output shows the server URL and watching paths.

```bash
make site-live
```

--------------------------------

### Install zizmor with Homebrew

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Installs zizmor via Homebrew on macOS or Linux.

```bash
brew install zizmor
```

--------------------------------

### Live development server output

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Example output from make site-live, showing the server URL and watching paths.

```console
INFO    -  Building documentation...
INFO    -  Cleaning site directory
INFO    -  Documentation built in 0.40 seconds
INFO    -  [22:18:39] Watching paths for changes: 'docs', 'mkdocs.yml'
INFO    -  [22:18:39] Serving on http://127.0.0.1:9999/zizmor/
INFO    -  [22:18:40] Browser connected: http://127.0.0.1:9999/zizmor/development/
```

--------------------------------

### Install zizmor on Chimera Linux with apk

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Installs zizmor on Chimera Linux from the user repository. First enables the user repo if not already enabled, then installs zizmor. This is a community-maintained package.

```bash
# If you don't have the 'user' repo enabled yet, do that first
apk add chimera-repo-user

apk add zizmor
```

--------------------------------

### misfeature audit: pip-install before and after

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after examples for the misfeature audit. The before block uses the pip-install input on actions/setup-python, which is flagged as a misfeature. The after block replaces it with a venv-based install.

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          pip-install: '.[dev]'

```

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Python
        uses: actions/setup-python@v6

      - name: Install package
        run: |
          python -m venv .env
          ./.env/bin/pip install .[dev]

```

--------------------------------

### Run zizmor on multiple repositories

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md

Example of running zizmor on multiple repositories, which now triggers independent configuration discovery for each path.

```sh
# OLD: would discover config in $CWD
# NEW: will discover two different configs, one in each of the repos
zizmor ./repoA ./repoB
```

--------------------------------

### superfluous-actions remediation: replace dtolnay/rust-toolchain with rustup

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after examples for the superfluous-actions audit. The before example uses the dtolnay/rust-toolchain action pinned to a SHA, while the after example replaces it with the pre-installed runner tool rustup.

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Install Rust v1.93.1
        uses: dtolnay/rust-toolchain@086dfa4efe372cfb6b375460a56e26a62a873d2e # 1.93.1

```

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Install Rust v1.93.1
        run: rustup toolchain install 1.93.1

```

--------------------------------

### After: unsound-ternary.yml with case()

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

After example showing the fixed workflow using the `case()` function to handle falsy values correctly, preventing the fallthrough behavior.

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo "value=${VALUE}"
        env:
          VALUE: ${{ case(foo, '', 'bar') }}

```

--------------------------------

### Install zizmor from source with cargo

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Installs the latest unstable zizmor directly from the GitHub source repository using cargo. Most users should not use this method; no stability or correctness guarantees are made.

```bash
cargo install --locked --git https://github.com/zizmorcore/zizmor
```

--------------------------------

### Run zizmor on local directories

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md

Examples of running zizmor on the current directory or a specific GitHub directory, maintaining previous configuration discovery behavior.

```sh
zizmor .
zizmor .github/
```

--------------------------------

### Install zizmor with Nix (with and without flakes)

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Installs zizmor via Nix, either without flakes using nix-env or with flakes using nix profile. This is a community-maintained package.

```bash
# without flakes
nix-env -iA nixos.zizmor

# with flakes
nix profile install nixpkgs#zizmor
```

--------------------------------

### artipacked.yml after remediation (persist-credentials: false)

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Example workflow using @actions/checkout with persist-credentials: false to avoid persisting credentials on disk. This is the 'after' example marked as correct.

```yaml
on: push

jobs:
  artipacked:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

```

--------------------------------

### Install zizmor on Alpine Linux with apk

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Installs zizmor on Alpine Linux using apk. This is a community-maintained package.

```bash
apk add zizmor
```

--------------------------------

### artipacked.yml before remediation (persist-credentials not set)

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Example workflow using @actions/checkout without setting persist-credentials, which may persist credentials on disk. This is the 'before' example flagged with a warning.

```yaml
on: push

jobs:
  artipacked:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

```

--------------------------------

### Run zizmor in LSP mode (--lsp flag)

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/integrations.md

Use this command to start zizmor in LSP mode. It takes no other arguments and communicates with the editor over stdin and stdout; no other transports are supported.

```bash
zizmor --lsp
```

--------------------------------

### Install zizmor on Arch Linux with pacman

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Installs zizmor from the Arch Linux repositories using pacman. The zizmor-git package is also available in the AUR. This is a community-maintained package.

```bash
# zizmor-git is also available in the AUR
pacman -S zizmor
```

--------------------------------

### Before: vulnerable workflow

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before example from unsound-contains.yml showing the vulnerable condition in a workflow.

```yaml
on: push

jobs:
  tf-deploy:
    runs-on: ubuntu-latest
    steps:
      - run: terraform init -input=false
      - run: terraform plan -out=tfplan -input=false
      - run: terraform apply -input=false tfplan
        if: contains('refs/heads/main refs/heads/develop', github.ref)
```

--------------------------------

### Example workflow using a private action

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/troubleshooting.md

A workflow snippet showing a uses clause referencing a private repository, which can cause access errors when zizmor runs online.

```yaml
- uses: example/repoB/some-internal-action@v1.0.0
```

--------------------------------

### After: fixed workflow

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

After example from unsound-contains.yml showing the fixed condition using fromJSON().

```yaml
on: push

jobs:
  tf-deploy:
    runs-on: ubuntu-latest
    steps:
      - run: terraform init -input=false
      - run: terraform plan -out=tfplan -input=false
      - run: terraform apply -input=false tfplan
        if: contains(fromJSON('["refs/heads/main", "refs/heads/develop"]'), github.ref)
```

--------------------------------

### zizmor operating mode CLI flags

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md

Command-line examples for forcing offline mode with --offline, enabling online mode with --gh-token, and using --no-online-audits to fetch inputs online while keeping audits offline.

```bash
# force offline, even if GH_TOKEN/GITHUB_TOKEN/ZIZMOR_GITHUB_TOKEN is present
# this disables all online actions, including repository fetches
zizmor --offline workflow.yml

# passing a token explicitly will enable online mode
# in this case, we use the `gh` CLI token
zizmor --gh-token $(gh auth token) workflow.yml

# online for the purpose of fetching the input (example/example),
# but all audits themselves are offline
zizmor --no-online-audits --gh-token $(gh auth token) example/example
```

--------------------------------

### Before: unsound-ternary.yml with pseudo-ternary

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before example showing the vulnerable pseudo-ternary in a workflow step. The `VALUE` environment variable is set to the result of the expression, which can fall through to `'bar'` when `foo` is falsy.

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo "value=${VALUE}"
        env:
          VALUE: ${{ foo && '' || 'bar' }}

```

--------------------------------

### Plain output example

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md

Default cargo-style diagnostic output for a template-injection finding. Shows the audit name, file location, code excerpt, and confidence note. Colorized when sent to a terminal, uncolorized when piped, and can be disabled with NO_COLOR=1.

```console
error[template-injection]: code injection via template expansion
  --> ./tests/integration/test-data/template-injection/pr-425-backstop/action.yml:31:56
   |
29 |       uses: azure/powershell@whatever
   |       ------------------------------- action accepts arbitrary code
30 |       with:
31 |         inlineScript: Get-AzVM -ResourceGroupName "${{ inputs.expandme }}"
   |         ------------ via this input                    ^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
```

--------------------------------

### Configure zizmor LSP in Sublime Text (Server Configurations)

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/integrations.md

Add this JSON to Preferences > Package Settings > LSP > Server Configurations to enable zizmor LSP. Requires the LSP and YamlPipelines packages and a separate zizmor installation.

```json
{
    "zizmor": {
        "enabled": true,
        "command": ["zizmor", "--lsp"],
        "selector": "source.yaml.pipeline.github-actions"
    }
}
```

--------------------------------

### Provide custom PAT to zizmor GitHub Action

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/troubleshooting.md

Example of configuring the zizmor-action with a token input using a repository secret, granting only the necessary read access.

```yaml
- uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
  with:
    token: ${{ secrets.ZIZMOR_GH_TOKEN }}
```

--------------------------------

### Build the website locally

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Build a local copy of the website in the site_html directory. Requires uv and make.

```bash
make site
```

--------------------------------

### secrets-outside-env remediation before and after

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after remediation examples for the secrets-outside-env audit. The before example shows a job using a secret without an environment, which triggers the audit. The after example adds an environment to the job, which is the recommended remediation.

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh
        env:
          API_KEY: ${{ secrets.API_KEY }}

```

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: ./deploy.sh
        env:
          API_KEY: ${{ secrets.API_KEY }}

```

--------------------------------

### Build zizmor locally with cargo build

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Clone the repository and build zizmor with cargo build. The resulting binary is at ./target/debug/zizmor; cargo run -- --help is an alternative to invoking the binary directly.

```bash
git clone https://github.com/zizmorcore/zizmor && cd zizmor
cargo build
# cargo run -- --help also works
./target/debug/zizmor --help
```

--------------------------------

### Build developer documentation with cargo doc

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Build the developer-only documentation with cargo doc. Use cargo doc --open to build and open the documentation in the local browser.

```bash
# build only
cargo doc

# build and open in the local browser
cargo doc --open
```

--------------------------------

### Install zizmor with conda from conda-forge

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/installation.md

Installs zizmor from the conda-forge channel. This is a community-maintained package.

```bash
conda install conda-forge::zizmor
```

--------------------------------

### Run offline benchmarks

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Build the release binary and run all offline benchmarks. Requires a Rust toolchain and make.

```bash
# run all offline benchmarks
cargo build --release
make bench
```

--------------------------------

### Fix typosquatted uses reference

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after examples for fixing a typosquatted action reference. The before example uses 'action/checkout' which is a close textual variant of the legitimate 'actions/checkout' and would be flagged by the audit. The after example corrects the reference to the intended action.

```yaml
- name: checkout
  uses: action/checkout@v4
```

```yaml
- name: checkout
  uses: actions/checkout@v4
```

--------------------------------

### Run and review snapshots with cargo insta test --review

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Shortcut to run tests and review snapshots in one command. The second variant also runs online tests and requires GH_TOKEN.

```bash
cargo insta test --review

# or, with online tests
GH_TOKEN=$(gh auth token) cargo insta test --review --features online-tests
```

--------------------------------

### Pass a custom configuration file with --config

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md

Pass a configuration file explicitly with the --config flag. The file can be named anything, but only a single configuration file is used, so this is generally not recommended unless auditing a single input source.

```bash
zizmor --config my-zizmor-config.yml /dir/to/audit
```

--------------------------------

### Format and lint with cargo fmt and cargo clippy --fix

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/development.md

Run the auto-formatter and linter locally. CI enforces both, so running them locally minimizes unnecessary review cycles.

```bash
cargo fmt
cargo clippy --fix
```

--------------------------------

### Remediation for unredacted-secrets: before and after

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after remediation for the unredacted-secrets audit. The 'Before' example uses fromJSON to extract fields from a single secret, which is not redacted; the 'After' example stores each field as a separate secret and references them directly.

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh
        env:
          USERNAME: ${{ fromJSON(secrets.MY_SECRET).username }}
          PASSWORD: ${{ fromJSON(secrets.MY_SECRET).password }}
```

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh
        env:
          USERNAME: ${{ secrets.MY_SECRET_USERNAME }}
          PASSWORD: ${{ secrets.MY_SECRET_PASSWORD }}
```

--------------------------------

### Remediation example for unpinned-images audit (before and after)

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Before and after workflow examples for remediating the unpinned-images audit. The 'Before' version uses an unpinned image reference, while the 'After' version pins the image to a specific SHA256 digest.

```yaml
name: unpinned-images
on: [push]

jobs:
  unpinned-image:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example
    steps:
      - run: "echo unpinned container!"
```

```yaml
name: unpinned-images
on: [push]

jobs:
  unpinned-image:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example@sha256:01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
    steps:
      - run: "echo pinned container!"
```

--------------------------------

### Remediate hardcoded-container-credentials with encrypted secrets

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

The 'Before' example shows hardcoded Docker credentials in the container and service definitions, which the audit flags. The 'After' example replaces the passwords with the encrypted secret reference ${{ secrets.REGISTRY_PASSWORD }}. The footnote notes that the two service credentials may or may not be the same secret depending on configuration.

```yaml
on:
  push:

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example
      credentials:
        username: user
        password: hackme
    services:
      service-1:
        image: fake.example.com/anotherexample
        credentials:
          username: user
          password: hackme
    steps:
      - run: echo 'hello!'

```

```yaml
on:
  push:

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example
      credentials:
        username: user
        password: ${{ secrets.REGISTRY_PASSWORD }}
    services:
      service-1:
        image: fake.example.com/anotherexample
        credentials:
          username: user
          password: ${{ secrets.REGISTRY_PASSWORD }} # (1)!
    steps:
      - run: echo 'hello!'

```

--------------------------------

### Run zizmor on local repositories

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/quickstart.md

Run zizmor on one or more local repositories, treating each directory as a repository and attempting to find workflows and other auditable inputs. Pass --collect=workflows to avoid collecting anything except workflow definitions.

```bash
# repo-a/ contains .github/workflows/{ci,tests}.yml
# as well as custom-action/action.yml
zizmor repo-a/

# or with multiple directories
zizmor repo-a/ ../../repo-b/

# collect only workflows
zizmor --collect=workflows repo-a/
```

--------------------------------

### Manual GitHub Actions workflow with --format=sarif

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/integrations.md

Manual integration using --format=sarif with Advanced Security. The env block is optional; remove it to run only offline audits. The uvx command installs a pinned zizmor package from PyPI. Note that with --format=sarif, zizmor always exits with code 0 even if findings are present, so the workflow always succeeds.

```yaml
name: GitHub Actions Security Analysis with zizmor 🌈

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["**"]

env:
  ZIZMOR_VERSION: 1.30.1

permissions: {}

jobs:
  zizmor:
    name: zizmor via PyPI
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
      contents: read         # Only needed for private repos. Needed to clone the repo.
      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

      - name: Run zizmor 🌈
        run: uvx "zizmor@${ZIZMOR_VERSION}" --format=sarif . > results.sarif # (2)!
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # (1)!

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          sarif_file: results.sarif
          category: zizmor
```

--------------------------------

### secrets-outside-env allow configuration

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md

Configuration example for the secrets-outside-env audit. This configuration allows the listed secrets to be used outside of an environment without being flagged.

```yaml
rules:
  secrets-outside-env:
    config:
      allow:
        - CI_COVERAGE_TOKEN
        - NOT_VERY_SENSITIVE

```

--------------------------------

### Enable fish tab completion

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/integrations.md

Creates a fish completion file for zizmor. Restart your shell or source the configuration file after running.

```bash
echo 'zizmor --completions fish | source' > ~/.config/fish/completions/zizmor.fish
```

--------------------------------

### zizmor output showing auto-fixable finding

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md

Example output from zizmor showing an auto-fixable finding. The note 'this finding has an auto-fix' indicates that the finding can be automatically fixed.

```console
error[template-injection]: code injection via template expansion
  --> example.yml:18:36
   |
17 |       - run: |
   |         ^^^ this run block
18 |           echo "doing a thing: ${{ inputs.test }}"
   |                                    ^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
```

--------------------------------

### Use GitHub Enterprise with --gh-hostname or GH_HOST

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md

Runs zizmor against a GitHub Enterprise instance. Pass the instance's domain with --gh-hostname or set the GH_HOST environment variable. Support for custom GitHub Enterprise instances is best-effort.

```bash
zizmor --gh-hostname custom.example.com ...

# or, with GH_HOST
GH_HOST=custom.ghe.com zizmor ...
```

--------------------------------

### cargo install --locked zizmor

Source: https://github.com/zizmorcore/zizmor/blob/main/docs/troubleshooting.md

Use the --locked flag to force cargo to use the exact dependencies from zizmor's Cargo.lock, overriding yanked versions.

```bash
cargo install --locked zizmor
```
Tokens:
Raw