Search results

[BUG]: zizmor currently flags maturin's generated workflow for sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} being vulnerable to a cache poisoning attack

bugSomething isn't workingSomething isn't working

false-positive

Status: Open.

#1940 In zizmorcore/zizmor;

· abelaba opened on Apr 22, 2026

Feature: Allow specific actions to be excluded from superfluous-actions

enhancementNew feature or requestNew feature or request

triageIssue is being triagedIssue is being triaged

Status: Open.

#1939 In zizmorcore/zizmor;

· MattIPv4 opened on Apr 22, 2026

Feature: Allow specific actions to be excluded from ref-version-mismatch

enhancementNew feature or requestNew feature or request

triageIssue is being triagedIssue is being triaged

Status: Open.

#1938 In zizmorcore/zizmor;

· MattIPv4 opened on Apr 22, 2026

[BUG]: bot-conditions false positive when github.actor is used only to suppress follow-up bot reruns

bugSomething isn't workingSomething isn't working

Status: Open.

#1914 In zizmorcore/zizmor;

· crazy-max opened on Apr 15, 2026

Performance: optimize the fast path for remote audits of only workflows

performance

refactorRefactoring tasksRefactoring tasks

Status: Open.

#1908 In zizmorcore/zizmor;

· woodruffw opened on Apr 14, 2026

Feature: detects local duplication of 3rd party/shared actions

enhancementNew feature or requestNew feature or request

questionFurther information is requestedFurther information is requested

Status: Open.

#1906 In zizmorcore/zizmor;

· guillp opened on Apr 14, 2026

Feature: support configuring personas per-rule

configConfiguration functionalityConfiguration functionality

enhancementNew feature or requestNew feature or request

triageIssue is being triagedIssue is being triaged

Status: Open.

#1885 In zizmorcore/zizmor;

· DetachHead opened on Apr 12, 2026

Replace our pest usage with a hand-written parser

performance

refactorRefactoring tasksRefactoring tasks

Status: Open.

#1883 In zizmorcore/zizmor;

· woodruffw opened on Apr 11, 2026

·  

1.25.0

Fix SARIF context gaps

refactorRefactoring tasksRefactoring tasks

Status: Open.

Feature

#1882 In zizmorcore/zizmor;

· woodruffw opened on Apr 11, 2026

·  

1.25.0

Feature: replace safe context whitelist by an unsafe context blacklist

needs-mre

Status: Open.

#1878 In zizmorcore/zizmor;

· dashingDragon opened on Apr 10, 2026

[BUG]: False positive superfluous-actions for dtolnay/rust-toolchain on self-hosted runner

bugSomething isn't workingSomething isn't working

Status: Open.

#1865 In zizmorcore/zizmor;

· AntoineSebert opened on Apr 7, 2026

·  

1.25.0

[BUG]: use-trusted-publishing: false negative for token-based publish workflows using id-token: write for provenance

bugSomething isn't workingSomething isn't working

false-negative

Status: Open.

#1848 In zizmorcore/zizmor;

· shaanmajid opened on Apr 2, 2026