Skip to content

Release Notes🔗

This page contains abbreviated, user-focused release notes for each version of zizmor.

Next (UNRELEASED)🔗

Nothing to see here (yet!)

Improvements 🌱🔗

  • zizmor produces slightly more informative error messages when given an invalid input file (#482)

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would fail to discover actions within subdirectories of .github/workflows (#477)

v1.2.2🔗

Bug Fixes 🐛🔗

Improvements 🌱🔗

  • Fetch failures when running zizmor org/repo are now more informative (#475)

v1.2.1🔗

This is a small corrective release for some SARIF behavior that changed with v1.2.0.

Bug Fixes 🐛🔗

  • SARIF outputs now use relative paths again, but more correctly than before v1.2.0 (#469)

v1.2.0🔗

This release comes with one new audit (bot-conditions), plus a handful of bugfixes and analysis improvements to existing audits.

One bugfix in this release is also a slight behavior change: zizmor now emits SARIF outputs with absolute paths. This should not affect most users, but may make it slightly harder to share SARIF outputs between machines without fully reproducing exact file paths. If this affects you, please let us know!

New Features 🌈🔗

  • New audit: bot-conditions detects spoofable uses of github.actor within dangerous triggers (#460)

Improvements 🌱🔗

  • The unpinned-uses audit no longer flags local reusable workflows or actions as unpinned/unhashed (#439)
  • The excessive-permissions audit has been refactored, and better captures both true positive and true negative cases (#441)
  • The SARIF output mode (--format=sarif) now always returns absolute paths in its location information, rather than attempting to infer a (sometimes incorrect) repository-relative path (#453)
  • zizmor now provides manylinux wheel builds for aarch64 (#457)

Bug Fixes 🐛🔗

  • The template-injection audit no longer considers github.event.pull_request.base.sha dangerous (#445)
  • The artipacked audit now correctly handles the strings 'true' and 'false' as their boolean counterparts (#448)
  • Expressions that span multiple source lines are now parsed correctly (#461)
  • Workflows that contain timeout-minutes: ${{ expr }} are now parsed correctly (#462)

v1.1.1🔗

Bug Fixes 🐛🔗

  • Fixed a regression where workflows with calls to unpinned reusable workflows would fail to parse (#437)

v1.1.0🔗

This release comes with one new audit (secrets-inherit), plus a slew of bugfixes and internal refactors that unblock future improvements!

New Features 🌈🔗

  • New audit: secrets-inherit detects use of secrets: inherit with reusable workflow calls (#408)

Improvements 🌱🔗

Bug Fixes 🐛🔗

v1.0.1🔗

This is a small quality and bugfix release. Thank you to everybody who helped by reporting and shaking out bugs from our first stable release!

Improvements 🌱🔗

  • The github-env audit now detects dangerous writes to GITHUB_PATH, is more precise, and can produce multiple findings per run block (#391)

Bug Fixes 🐛🔗

  • workflow_call.secrets keys with missing values are now parsed correctly (#388)
  • The cache-poisoning audit no longer incorrectly treats docker/build-push-action as a publishing workflow is push: false is explicitly set (#389)
  • The template-injection audit no longer considers github.action_path to be a potentially dangerous expansion (#402)
  • The github-env audit no longer skips run: steps with non-trivial shell: stanzas (#403)

v1.0.0🔗

This is the first stable release of zizmor!

Starting with this release, zizmor will use Semantic Versioning for its versioning scheme. In short, this means that breaking changes will only happen with a new major version.

This stable release comes with a large number of new features as well as stability commitments for existing features; read more below!

New Features 🌈🔗

  • Composite actions (i.e. action.yml where the action is not a Docker or JavaScript action) are now supported, and are audited by default when running zizmor on a directory or remote repository (#331)

    Tip

    Composite action discovery and auditing can be disabled by passing --collect=workflows-only. Conversely, workflow discovery and auditing can be disabled by passing --collect=actions-only.

    See #350 for the status of each audit's support for analyzing composite actions.

  • The GitHub host to connect to can now be configured with --gh-hostname or GH_HOST in the environment (#371)

    This can be used to connect to a GitHub Enterprise (GHE) instance instead of the default github.com instance.

Improvements 🌱🔗

Bug Fixes 🐛🔗

  • The excessive-permissions audit is now less noisy on single-job workflows (#337)
  • Expressions like function().foo.bar are now parsed correctly (#340)
  • The cache-poisoning defaults for setup-go were fixed (#343)
  • uses: matching is now case-insensitive where appropriate (#353)
  • Quoted YAML keys (like 'on': foo) are now parsed correctly (#368)

v0.10.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.9.2...v0.10.0

New Features 🌈🔗

Bug Fixes 🐛🔗

Performance Improvements 🚄🔗

  • refactor: use http-cache for caching, optimize network calls by @woodruffw in #304

Documentation Improvements 📖🔗

New Contributors🔗

v0.9.2🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.9.1...v0.9.2

Bug Fixes 🐛🔗

  • fix: template-injection: consider runner.tool_cache safe by @woodruffw in #297

Documentation Improvements 📖🔗

v0.9.1🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.9.0...v0.9.1

Bug Fixes 🐛🔗

v0.9.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.8.0...v0.9.0

New Features 🌈🔗

Bug Fixes 🐛🔗

Performance Improvements 🚄🔗

Documentation Improvements 📖🔗

New Contributors🔗

v0.8.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.7.0...v0.8.0

New Features 🌈🔗

Bug Fixes 🐛🔗

  • fix: template-injection: ignore issue/PR numbers by @woodruffw in #238

Documentation Improvements 📖🔗

New Contributors🔗

v0.7.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.6.0...v0.7.0

New Features 🌈🔗

Bug Fixes 🐛🔗

Documentation Improvements 📖🔗

v0.6.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.5.0...v0.6.0

This is one of zizmor's bigger recent releases! Key enhancements include:

  • A new github-env audit that detects dangerous GITHUB_ENV writes, courtesy of @ubiratansoares
  • The --min-severity and --min-confidence flags for filtering results, courtest (in part) of @Ninja3047
  • Support for # zizmor: ignore[rule] comments, courtesy of @ubiratansoares

New Features 🌈🔗

Documentation Improvements 📖🔗

New Contributors🔗

v0.5,0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.4.0...v0.5.0

New Features 🌈🔗

Documentation Improvements 📖🔗

New Contributors🔗

v0.4.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.3.2...v0.4.0

New Features 🌈🔗

Bug Fixes 🐛🔗

  • Fix typos including github.repostoryUrl -> github.repositoryUrl by @hugovk in #164

v0.3,2🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.3.1...v0.3.2

What's Changed🔗

v0.3.1🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.3.0...v0.3.1

What's Changed🔗

New Contributors🔗

v0.3.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.2.1...v0.3.0

What's Changed🔗

v0.2.1🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.2.0...v0.2.1

What's Changed🔗

v0.2.0🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.1.6...v0.2.0

What's Changed🔗

New Contributors🔗

v0.1.6🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.1.5...v0.1.6

What's Changed🔗

v0.1.5🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.1.4...v0.1.5

What's Changed🔗

New Contributors🔗

v0.1.4🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.1.3...v0.1.4

What's Changed🔗

New Contributors🔗

v0.1.3🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.1.2...v0.1.3

What's Changed🔗

  • fix: use relative workflow paths in SARIF output by @woodruffw in #77

v0.1.2🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.1.1...v0.1.2

What's Changed🔗

New Contributors🔗

v0.1.1🔗

Full Changelog: https://github.com/woodruffw/zizmor/compare/v0.1.0...v0.1.1

What's Changed🔗

New Contributors🔗