|
| 1 | +# Created with komac v2.14.0 |
| 2 | +# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json |
| 3 | + |
| 4 | +PackageIdentifier: zizmor.zizmor |
| 5 | +PackageVersion: 1.21.0 |
| 6 | +PackageLocale: en-US |
| 7 | +Publisher: William Woodruff |
| 8 | +PublisherUrl: https://zizmor.sh/ |
| 9 | +PublisherSupportUrl: https://github.com/zizmorcore/zizmor/issues |
| 10 | +Author: William Woodruff |
| 11 | +PackageName: zizmor |
| 12 | +PackageUrl: https://zizmor.sh/ |
| 13 | +License: MIT |
| 14 | +LicenseUrl: https://github.com/zizmorcore/zizmor/blob/HEAD/LICENSE |
| 15 | +Copyright: Copyright (c) 2024 William Woodruff <william @ yossarian.net> |
| 16 | +CopyrightUrl: https://github.com/zizmorcore/zizmor/blob/HEAD/LICENSE |
| 17 | +ShortDescription: Static analysis for GitHub Actions. |
| 18 | +Description: |- |
| 19 | + zizmor is a static analysis tool for GitHub Actions. |
| 20 | +
|
| 21 | + It can find many common security issues in typical GitHub Actions CI/CD setups, including: |
| 22 | + - Template injection vulnerabilities, leading to attacker-controlled code execution |
| 23 | + - Accidental credential persistence and leakage |
| 24 | + - Excessive permission scopes and credential grants to runners |
| 25 | + - Impostor commits and confusable git references |
| 26 | + - ...and much more! |
| 27 | +Tags: |
| 28 | +- github-actions |
| 29 | +- security |
| 30 | +- security-tools |
| 31 | +- static-analysis |
| 32 | +ReleaseNotes: |- |
| 33 | + New Features 🌈🔗 |
| 34 | + - New audit: misfeature detects usage of GitHub Actions features that are considered "misfeatures." (#1517) |
| 35 | + Enhancements 🌱🔗 |
| 36 | + - zizmor now uses exit code 3 to signal an audit that has failed because no input files were collected. See the exit code documentation for details (#1515) |
| 37 | + - The unpinned-uses audit now supports auto-fixes for many findings (#1525) |
| 38 | + Changes ⚠️🔗 |
| 39 | + - The obfuscation audit no longer flags shell: cmd. That check has been moved to the new misfeature audit. Users may need to update their ignore comments and/or configuration (#1517) |
| 40 | + Bug Fixes 🐛🔗 |
| 41 | + - The unpinned-uses audit now flags reusable workflows that are unpinned, in addition to actions (#1509) |
| 42 | + Many thanks to @johnbillion for implementing this fix! |
| 43 | +ReleaseNotesUrl: https://github.com/zizmorcore/zizmor/releases/tag/v1.21.0 |
| 44 | +Documentations: |
| 45 | +- DocumentLabel: Docs |
| 46 | + DocumentUrl: https://docs.zizmor.sh/ |
| 47 | +ManifestType: defaultLocale |
| 48 | +ManifestVersion: 1.12.0 |
0 commit comments