| name | zizmor |
| description | Audit the repository's GitHub Actions workflows for common security issues (credential mishandling, untrusted inputs, template injection, overly permissive tokens) and convert findings to scrutineer's shape. Use on any repo with a .github/workflows directory. |
| license | MIT |
| compatibility | Requires `zizmor` (https://github.com/zizmorcore/zizmor) and `python3` on PATH. |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"findings"} |
zizmor
Run zizmor against ./src/.github/workflows and map each issue into scrutineer's findings shape.
Workspace
./src — the cloned repository./scripts/scan.py — the wrapper./report.json — write the findings report here./schema.json — output shape
Available scripts
scripts/scan.py — invokes zizmor --format json .github/workflows and converts the output. If the repo has no workflows directory, it writes an empty result so the scan succeeds cleanly. zizmor's severity values are mapped to scrutineer's: unknown/informational/low → Low, medium → Medium, high → High, critical → Critical.
What to do
python3 scripts/scan.py > ./report.json
The script handles missing workflows directories, a missing zizmor binary, and zizmor's non-zero "I found something" exit code gracefully — don't add retry or error handling on top. If stderr is noisy that's fine, scrutineer only reads the JSON on stdout.
