zizmor

name	zizmor
description	Audit the repository's GitHub Actions workflows for common security issues (credential mishandling, untrusted inputs, template injection, overly permissive tokens) and convert findings to scrutineer's shape. Use on any repo with a .github/workflows directory.
license	MIT
compatibility	Requires `zizmor` (https://github.com/zizmorcore/zizmor) and `python3` on PATH.
metadata	{"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"findings"}

zizmor

Run zizmor against ./src/.github/workflows and map each issue into scrutineer's findings shape.

Workspace

• ./src — the cloned repository
• ./scripts/scan.py — the wrapper
• ./report.json — write the findings report here
• ./schema.json — output shape

Available scripts

• scripts/scan.py — invokes zizmor --format json .github/workflows and converts the output. If the repo has no workflows directory, it writes an empty result so the scan succeeds cleanly. zizmor's severity values are mapped to scrutineer's: // → , → , → , → .