Github Actions -- zizmor

[dcampbell24]

I found out about this utility to check your Github Actions files for security flaws and it complains about your files a lot.

cargo install zizmor
zizmor .github/workflows/*.yml

[sylvestre]

Could you please share the output ? :)

[dcampbell24]

There are 278 findings, how do I share that? It makes for a long file.

[dcampbell24]

Can you just install and run zizmor? It is a Rust project.

[sylvestre]

sure

[dcampbell24]

You may want to run it as zizmor --min-severity high .github/workflows/*.yml to start and work your way down from there, as there are a lot of errors and warnings.

[dcampbell24]

I posted all of the errors via a pull request: #6968. Click on the Details of zizmor.