Skip to main content
zizmor is a static analysis tool for GitHub Actions. It finds common security issues in GitHub Actions CI/CD setups, such as template injection, excessive permissions, unpinned actions, and dangerous use of untrusted input. CodeRabbit runs zizmor v1.30.1.

​
Files

zizmor runs on changed GitHub Actions workflow files in the following locations:
  • .github/workflows/**/*.yml
  • .github/workflows/**/*.yaml

​
Configuration

​
boolean
default:true
Enable zizmor
.coderabbit.yaml
CodeRabbit uses the first non-empty zizmor configuration file in this order:
  • .github/zizmor.yml
  • .github/zizmor.yaml
  • zizmor.yml
  • zizmor.yaml
When no configuration file is found, CodeRabbit uses the defaults for the active review profile described below.

​
Security policy and restrictions

CodeRabbit runs zizmor offline inside the sandbox. Its YAML configuration does not load repository-provided plugins or execute repository code.

​
Profile behavior

  • Chill uses zizmor’s regular persona. Without a repository configuration, CodeRabbit sets the unpinned-uses policy to ref-pin for all action references.
  • Assertive uses zizmor’s pedantic persona and runs without a generated configuration when the repository provides none.
A repository configuration takes precedence over the generated configuration. CodeRabbit does not suppress any additional rule IDs; findings marked as ignored by zizmor are omitted.

​
When we skip zizmor

CodeRabbit will skip running zizmor when:
  • zizmor is disabled in CodeRabbit settings or .coderabbit.yaml.
  • No GitHub Actions workflow files matching the supported paths are changed in the pull request.
  • zizmor is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

​
What’s next

actionlint

Lint GitHub Actions workflow files for syntax errors and common misconfigurations.

All supported tools

Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.

Configuration reference

Full reference for all available options, including how to enable, disable, and tune individual tools.