#zizmor — Public Fediverse posts

Finished scanning all the github projects in my venv for #zizmor vulnerabilities now scanning all the venv on my entire computer.

One vulnerability anywhere and I figure my machine is pwned

People got the message about #pwnRequest and have updated their code... sort of.

`pull_request_target: # zizmor: ignore[dangerous-triggers]`

#zizmor

I don't know, the security model is all maximum surprise, maybe it isn't possible to repro cache poisoning for reasons (maybe some other job needs caching)

https://github.com/fastapi/typer/pull/1705/changes#diff-57e4d7577ff69fee5cc483d249c5177ced68eb26c996cd6230d5d23d0dd0019aR4

Just in the venv for the app that scans the dependency tree for #zizmor flaws, there are 88 repos that I'd need to file Pull Request to fix my supply chain. This is going to take years.

(this runs zizmor against every repo for every dependency to find out who is likely to turn into a malicious artifact next)

If you run #zizmor on your on repo and fix the github actions there, you gain just about nothing if your entire dependency tree doesn't do the same. Malicious actors will stop targeting your app and target the 200+ softer targets in the dependency tree.

RE: https://mastodon.social/@sethmlarson/116478299133984513

Dear #Python ecosystem, please follow @yossarian's recommendations through #Zizmor and secure your @github Actions workflows wisely!

I like this touch to #zizmor:

❯ zizmor --thanks
zizmor's development is sustained by our generous sponsors:
🌈 Grafana Labs
🌈 Kusari

WTF?? #Zizmor is a GitHub actions security linting tool, and their own action basically pull the latest version by default...

🤡

https://github.com/zizmorcore/zizmor-action/issues/52

One year of zizmor

https://blog.yossarian.net/2025/09/14/one-year-of-zizmor

#devblog #programming #rust #zizmor

Fun with finite state transducers

https://blog.yossarian.net/2025/08/14/Fun-with-finite-state-transducers

#devblog #programming #rust #zizmor

A Discord server and new GitHub organization for zizmor

https://blog.yossarian.net/2025/05/07/zizmor-discord-server-github-org

#security #oss #devblog #programming #rust #zizmor

Taking a first poke at auditing my #GitHub Actions with #zizmor

There's a lot to digest here, for me. Pretty much shows me how little I understand the actions I've had in place for quite a while (that's bad).

But, I've gotten it's tests to pass with remediation! (that's good, right???)
I'm a damned cut-and-paste savage (that's bad). *sigh*

https://woodruffw.github.io/zizmor/

#Security

I'm pretty sure @yossarian can tell every time I run #zizmor against a new repo by watching for my pull requests to exclude something else from the template injection audit.