v1.4.1

This is a small corrective release for v1.4.0.

Bug Fixes 🐛🔗

• Findings produced by (unredacted-secrets) now use the correct ID and link to the correct URL in the audit documentation (#566)

v1.4.0

This release comes with one new audit (unredacted-secrets), plus a handful of bugfixes and analysis improvements to existing audits. It also comes with improvements to SARIF presentation, ignore comments, as well as an official Docker image!

New Features 🌈🔗

• zizmor now has official Docker images! You can find them on the GitHub Container Registry under ghcr.io/woodruffw/zizmor (#532)
• New audit: unredacted-secrets detects secret accesses that are not redacted in logs (#549)

Improvements 🌱🔗

• SARIF outputs are now slightly more aligned with GitHub Code Scanning expectations (#528)
• # zizmor: ignore[rule] comments can now have trailing explanations, e.g. # zizmor: ignore[rule] because reasons (#531)
• The bot-conditions audit now detects github.triggering_actor as another spoofable actor check (#559)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail to parse workflows with workflow_dispatch triggers that contained non-string inputs (#563)

Upcoming Changes 🚧🔗

• The next minor release of zizmor will be built with Rust 2024. This should have no effect on most users, but may require users who build zizmor from source to update their Rust toolchain.

v1.3.1

Improvements 🌱🔗

• Passing both --offline and a GitHub token (either implicitly with GH_TOKEN or explicitly with --gh-token) no longer results in an error. --offline is now given precedence, regardless of any other flags or environment settings (#519)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail to parse composite actions with inputs/outputs that are missing descriptions (#502)
• Expressions that contain indices with non-semantic whitespace are now parsed correctly (#511)
• Fixed a false positive in [ref-confusion] where partial tag matches were incorrectly considered confusable (#519)
• Fixed a bug where zizmor would fail to parse workflow definitions with an expression inside strategy.max-parallel (#522)

v1.3.0

This release comes with one new audit (overprovisioned-secrets), plus a handful of bugfixes and analysis improvements to existing audits. It also comes with a special easter egg for those who wish to kvell about their audit results.

New Features 🌈🔗

• New audit: overprovisioned-secrets detects uses of the secrets context that result in excessive secret provisioning (#485)
• Added a special naches mode for when you're feeling particularly proud of your audit results (#490)

Improvements 🌱🔗

• zizmor produces slightly more informative error messages when given an invalid input file (#482)
• Case insensitivity in contexts is now handeled more consistently and pervasively (#491)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would fail to discover actions within subdirectories of .github/workflows (#477)
• Fixed a bug where zizmor would fail to parse composite action definitions with no name field (#487)

v1.2.2

Bug Fixes 🐛🔗

• The excessive-permissions audit is now more precise about both reusable workflows and reusable workflow calls (#473)

Improvements 🌱🔗

• Fetch failures when running zizmor org/repo are now more informative (#475)

v1.2.1

This is a small corrective release for some SARIF behavior that changed with v1.2.0.

Bug Fixes 🐛🔗

• SARIF outputs now use relative paths again, but more correctly than before v1.2.0 (#469)

v1.2.0

This release comes with one new audit (bot-conditions), plus a handful of bugfixes and analysis improvements to existing audits.

One bugfix in this release is also a slight behavior change: zizmor now emits SARIF outputs with absolute paths. This should not affect most users, but may make it slightly harder to share SARIF outputs between machines without fully reproducing exact file paths. If this affects you, please let us know!

New Features 🌈🔗

• New audit: bot-conditions detects spoofable uses of github.actor within dangerous triggers (#460)

Improvements 🌱🔗

• The unpinned-uses audit no longer flags local reusable workflows or actions as unpinned/unhashed (#439)
• The excessive-permissions audit has been refactored, and better captures both true positive and true negative cases (#441)
• The SARIF output mode (--format=sarif) now always returns absolute paths in its location information, rather than attempting to infer a (sometimes incorrect) repository-relative path (#453)
• zizmor now provides manylinux wheel builds for aarch64 (#457)

Bug Fixes 🐛🔗

• The template-injection audit no longer considers github.event.pull_request.base.sha dangerous (#445)
• The artipacked audit now correctly handles the strings 'true' and 'false' as their boolean counterparts (#448)
• Expressions that span multiple source lines are now parsed correctly (#461)
• Workflows that contain timeout-minutes: ${{ expr }} are now parsed correctly (#462)

v1.1.1

Fixed

• Fixed a regression where workflows with calls to unpinned reusable workflows
  would fail to parse (#437)

v1.1.0

This release comes with one new audit (secrets-inherit), plus a slew of bugfixes and internal refactors that unblock future improvements!

Added🔗

• New audit: secrets-inherit detects use of secrets: inherit with reusable workflow calls (#408)

Improved🔗

• The template-injection audit now detects injections in calls to azure/cli and azure/powershell (#421)

Fixed🔗

• The template-injection audit no longer consider github.server_url dangerous (#412)
• The template-injection audit no longer crashes when evaluating the static-ness of an environment for a uses: step (#420)

v1.0.1

v1.0.1

This is a small quality and bugfix release. Thank you to everybody
who helped by reporting and shaking out bugs from our first stable release!

Improved

• The github-env audit now detects dangerous writes to GITHUB_PATH,
  is more precise, and can produce multiple findings per run block (#391)

Fixed

• workflow_call.secrets keys with missing values are now parsed correctly (#388)
• The cache-poisoning audit no longer incorrectly treats docker/build-push-action as
  a publishing workflow is push: false is explicitly set (#389)
• The template-injection audit no longer considers github.action_path
  to be a potentially dangerous expansion (#402)
• The github-env audit no longer skips run: steps with non-trivial
  shell: stanzas (#403)