Sponsorship is appreciated!

New Features 🌈🔗

• zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱🔗

• zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the input collection documentation for more information. (#2454)

• zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

• zizmor's LSP now audits pre-commit inputs (#2485)

• zizmor now provides Windows ARM64 wheels on PyPI (#2424)

  Many thanks to @ndabas for proposing and implementing this improvement!

Bug Fixes 🐛🔗

• Fixed a bug where the bot-conditions audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

• Fixed a bug where the obfuscation audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

• Fixed a class of bugs in the obfuscation audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

• Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

• Fixed a bug where zizmor would not honor some ignore comments for the stale-action-refs audit (#2494)

• Fixed a bug where zizmor would not honor some ignore comments for the ref-version-mismatch audit (#2494)

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

• Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)
  Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#2256)

• The forbidden-uses audit now supports pre-commit config inputs (#2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#2272)

• The ref-confusion audit now supports pre-commit config inputs (#2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)

• The archived-uses audit now detects several more archived repositories (#2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)

• Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)

• Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#2295)

  Many thanks to @dmbuil for proposing and implementing this improvement!

• Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#2330)

• Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#2337)

• Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#2339)

• Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#2247)

  Many thanks to @potiuk for proposing and implementing this improvement!

• Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#2349)

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153)
  Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#2185)