zizmor Integration Guide

Integrate zizmor with Vulnetix. Scan GitHub Actions workflows for security vulnerabilities like injection attacks, excessive permissions, and unsafe patterns.

Install & scan

$ uv run --with zizmor zizmor --version
$ uv run --with zizmor zizmor --format sarif .github/workflows/ > zizmor.sarif

Run zizmor in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run zizmor
  run: |
    pip install zizmor
    zizmor --format sarif .github/workflows/ > zizmor.sarif

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: zizmor
    path: zizmor.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under zizmor's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace zizmor. Keep running it. Vulnetix sits on top of zizmor (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

zizmor is strongest at its core category and also carries features in Secret Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What zizmor does well

• Specialist CI/CD security: static analysis purpose-built for GitHub Actions workflows and composite actions, a class most SAST tools ignore
• Deep, well-maintained audit set: template-injection, excessive-permissions, unpinned/unhashed uses, artipacked (persisted checkout credentials), dangerous triggers, with clear remediation guidance
• v1.20+ defaults to requiring hash-pinning on all actions, directly hardening the supply-chain attack surface of workflows
• Rust-fast, SARIF output, and pre-commit/IDE/online modes; adopted by large OSS projects (scipy, etc.) for CI hardening

Where Vulnetix adds to it: zizmor is scoped to GitHub Actions workflow security and has no SCA, container, IaC, SBOM, malware, cross-scanner dedup, exploit-intel, reachability, VEX or SSVC. Vulnetix ingests zizmor's SARIF and folds its CI/CD findings into a unified prioritised queue with EPSS/KEV/LEV scoring and versioned VEX across all scanner types, augmenting rather than replacing zizmor's specialist Actions auditing.

No migration, no rip-and-replace. zizmor keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise zizmor results in Vulnetix

Upload zizmor SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

zizmor documentation ↗  ·  Source repository ↗

Wire zizmor into your CI/CD pipeline →