zizmorcore

Issues somebody may already be working on are listed last. List everything by date

• Feature: emit SARIF without uploading

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 2/5 1-3 hours Newbie friendliness 72/100

  zizmorcore/zizmor-action#195 · 2 comments · Opened Nov 13, 2026

  Maintainers usually reply within 1 day

• Feature: Report unused zizmor ignores

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement needs-design

  Difficulty 4/5 3-5 days Newbie friendliness 52/100

  zizmorcore/zizmor#2525 · 2 comments · 1 reaction · Opened Nov 4, 2026

  Maintainers usually reply within 1 day

• New audit: Manual insecure `persist-credentials: true`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement new-audit

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  zizmorcore/zizmor#2519 · 2 comments · Opened Nov 3, 2026

  Maintainers usually reply within 1 day

• [BUG]: unpinned-images loses precision when the image is chosen with `case(...)`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  bug false-negative

  Difficulty 3/5 1-2 days Newbie friendliness 74/100

  zizmorcore/zizmor#2508 · 1 comment · Opened Oct 31, 2026

  Maintainers usually reply within 1 day

• Feature: Support ".zizmorignore" style paths in `rule.<id>.ignore`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  config enhancement

  Difficulty 4/5 3-5 days Newbie friendliness 45/100

  zizmorcore/zizmor#2507 · 8 comments · Opened Oct 31, 2026

  Maintainers usually reply within 1 day

• Feature: opt-in stricter syntax for `undocumented-permissions`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement long-term

  Difficulty 4/5 3-5 days Newbie friendliness 54/100

  zizmorcore/zizmor#2499 · 7 comments · Opened Oct 30, 2026

  Maintainers usually reply within 1 day

• `undocumented-permissions` doesn't detect comments just above a permission

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 3/5 1-2 days Newbie friendliness 55/100

  zizmorcore/zizmor#2498 · 2 comments · Opened Oct 30, 2026

  Maintainers usually reply within 1 day

• unpinned-tools: poor UX for versions pinned through a variable

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  user-experience

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2484 · 3 reactions · Opened Oct 25, 2026

  Maintainers usually reply within 1 day

• [BUG]: ref-version-mismatch false positive when version comment is followed by another comment (e.g. yamllint/ryl directive)

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  needs-decision

  Difficulty 3/5 1-2 days Newbie friendliness 62/100

  zizmorcore/zizmor#2433 · 2 comments · Opened Oct 5, 2026

  Maintainers usually reply within 1 day

• Drop the Linux-only constraint

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 1/5 Under an hour Newbie friendliness 75/100

  zizmorcore/zizmor-action#171 · 1 comment · 1 reaction · Opened Oct 4, 2026

  Maintainers usually reply within 1 day

• Simplify cache-poisoning autofixes

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  autofix enhancement

  Difficulty 3/5 1-2 days Newbie friendliness 58/100

  zizmorcore/zizmor#2427 · 1 comment · 1 reaction · Opened Oct 2, 2026

  Maintainers usually reply within 1 day

• Feature: Flag to store/retrive GitHub API token from system keyring

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement triage

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  zizmorcore/zizmor#2403 · 5 comments · Opened Sep 21, 2026

  Maintainers usually reply within 1 day

• [BUG]: ref-version-mismatch check doesn't take cooldown in consideration

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  bug needs-decision

  Difficulty 3/5 1-2 days Newbie friendliness 64/100

  zizmorcore/zizmor#2378 · 1 comment · Opened Sep 9, 2026

  Maintainers usually reply within 1 day

• Audits should be able to spot findings based on indirect matrix expansions

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 5/5 Over a week Newbie friendliness 48/100

  zizmorcore/zizmor#2366 · 3 comments · Opened Sep 5, 2026

  Maintainers usually reply within 1 day

• Running in offline mode within GitHub Actions CI

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  question

  Difficulty 3/5 1-2 days Newbie friendliness 65/100

  zizmorcore/zizmor#2359 · 8 comments · Opened Sep 1, 2026

  Maintainers usually reply within 1 day

• Feature: support msys2 as bash

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement needs-design

  Difficulty 3/5 1-2 days Newbie friendliness 68/100

  zizmorcore/zizmor#2343 · 3 comments · Opened Aug 28, 2026

  Maintainers usually reply within 1 day

• New audit: big shell blocks

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  new-audit

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2323 · 3 reactions · Opened Aug 19, 2026

  Maintainers usually reply within 1 day

• New audit: `shell-syntax`

  May be free again @woodruffw claimed this 85 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  zizmorcore/zizmor#2322 · 6 comments · 4 reactions · 1 assignee · Opened Aug 19, 2026

  Maintainers usually reply within 1 day

• Feature: Enable `show_audit_urls` for GitHub output format as well

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  question

  Difficulty 2/5 1-3 hours Newbie friendliness 68/100

  zizmorcore/zizmor#2296 · 1 comment · Opened Aug 11, 2026

  Maintainers usually reply within 1 day

• New audit: overly broad tag patterns

  May be free again @woodruffw claimed this 94 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement new-audit

  zizmorcore/zizmor#2294 · 1 reaction · 1 assignee · Opened Aug 10, 2026

  Maintainers usually reply within 1 day

• Bug: autofixes for `unpinned-uses` and `known-vulnerable-actions` don't converge in one run

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  autofix bug

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2286 · 1 comment · 2 reactions · Opened Aug 10, 2026

  Maintainers usually reply within 1 day

• Support `prek.toml`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  long-term

  Difficulty 5/5 Over a week Newbie friendliness 25/100

  zizmorcore/zizmor#2260 · 7 reactions · Opened Aug 2, 2026

  Maintainers usually reply within 1 day

• Feature: unpinned image in services

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  question

  Difficulty 3/5 1-2 days Newbie friendliness 56/100

  zizmorcore/zizmor#2257 · 1 comment · Opened Aug 2, 2026

  Maintainers usually reply within 1 day

• [META] pre-commit audit parity

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  meta

  Difficulty 5/5 Over a week Newbie friendliness 30/100

  zizmorcore/zizmor#2256 · 9 comments · 5 reactions · Opened Aug 2, 2026

  Maintainers usually reply within 1 day

• Support rule aliases

  May be free again @woodruffw claimed this 111 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  config enhancement

  zizmorcore/zizmor#2232 · 1 reaction · 1 assignee · Opened Jul 24, 2026

  Maintainers usually reply within 1 day

• Feature: add an input to pass the YAML config directly

  May be free again A pull request for this issue was closed without being merged. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  zizmorcore/zizmor-action#143 · 3 comments · Opened Jul 23, 2026

  Maintainers usually reply within 1 day

• Feature: Handle 503/500s from GitHub

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 4/5 3-5 days Newbie friendliness 42/100

  zizmorcore/zizmor#2210 · 1 comment · Opened Jul 20, 2026

  Maintainers usually reply within 1 day

• Feature: Improve output when scanning multiple remote actions

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement needs-decision

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  zizmorcore/zizmor#2203 · 4 comments · Opened Jul 17, 2026

  Maintainers usually reply within 1 day

• Feature: support --strict-collection

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 2/5 1-3 hours Newbie friendliness 65/100

  zizmorcore/zizmor-action#141 · 1 comment · Opened Jul 17, 2026

  Maintainers usually reply within 1 day

• Feature: Distribute to other package ecosystems?

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement needs-decision packaging

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2194 · 4 comments · Opened Jul 15, 2026

  Maintainers usually reply within 1 day

• Generate JSON schema for our JSON (v1) output

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 3/5 1-2 days Newbie friendliness 68/100

  zizmorcore/zizmor#2190 · Opened Jul 14, 2026

  Maintainers usually reply within 1 day

• Feature: Flag `benc-uk/workflow-dispatch` as superfluous action (use `gh workflow run` instead)

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement good first issue

  Difficulty 3/5 1-2 days Newbie friendliness 58/100

  zizmorcore/zizmor#2181 · 4 comments · 1 reaction · Opened Jul 12, 2026

  Maintainers usually reply within 1 day

• Feature: Extend unpinned-tools to detect setup actions that require version + checksum pinning

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement triage

  Difficulty 4/5 3-5 days Newbie friendliness 45/100

  zizmorcore/zizmor#2176 · 1 comment · Opened Jul 8, 2026

  Maintainers usually reply within 1 day

• [BUG]: dependabot-cooldown flags missing cooldown with `open-pull-requests-limit: 0`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  bug triage

  Difficulty 2/5 1-3 hours Newbie friendliness 72/100

  zizmorcore/zizmor#2148 · 1 comment · Opened Jun 25, 2026

  Maintainers usually reply within 1 day

• Feature: run zizmor with config from zizmorcore/zizmor-action

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement triage

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2142 · Opened Jun 22, 2026

  Maintainers usually reply within 1 day

• Feature: Allow configuration for flagging tag object SHAs

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  zizmorcore/zizmor#2130 · 5 comments · Opened Jun 16, 2026

  Maintainers usually reply within 1 day

• Feature: Extend `adhoc-packages` audit to other common package managers

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement triage

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2128 · 3 comments · Opened Jun 16, 2026

  Maintainers usually reply within 1 day

• [Documentation] How to specify additional files to scan

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 2/5 1-3 hours Newbie friendliness 50/100

  zizmorcore/zizmor-pre-commit#47 · 3 comments · Opened Jun 15, 2026

• Feature: enforce patch-level version tag policy for `unpinned-uses`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement triage

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  zizmorcore/zizmor#2105 · 3 comments · Opened Jun 7, 2026

  Maintainers usually reply within 1 day

• Feature: autofix wrong value in ternary pattern

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  autofix enhancement

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2096 · 1 comment · Opened Jun 3, 2026

  Maintainers usually reply within 1 day

• Remove `--format=github`

  May be free again @woodruffw claimed this 163 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  breaking

  zizmorcore/zizmor#2094 · 2 comments · 1 assignee · Opened Jun 2, 2026

  Maintainers usually reply within 1 day

• Feature: cache-poisoning for heuristic for release event

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement false-positive

  Difficulty 3/5 1-2 days Newbie friendliness 58/100

  zizmorcore/zizmor#2071 · 4 comments · Opened May 26, 2026

  Maintainers usually reply within 1 day

• Integrate GitHub's checks API?

  May be free again @woodruffw claimed this 173 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  zizmorcore/zizmor-action#117 · 3 comments · 1 assignee · Opened May 23, 2026

  Maintainers usually reply within 1 day

• Feature: add --gh-token=auto to invoke gh auth token automativally

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement needs-decision

  Difficulty 3/5 1-2 days Newbie friendliness 55/100

  zizmorcore/zizmor#2052 · 2 comments · 1 reaction · Opened May 23, 2026

  Maintainers usually reply within 1 day

• Feature: Warn on package install without a cooldown

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 4/5 3-5 days Newbie friendliness 45/100

  zizmorcore/zizmor#2044 · 2 comments · Opened May 21, 2026

  Maintainers usually reply within 1 day

• Feature: Auto-fix for `unpinned-images`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  zizmorcore/zizmor#2033 · 1 comment · Opened May 18, 2026

  Maintainers usually reply within 1 day

• archived-uses: suggest alternative actions

  May be free again @woodruffw claimed this 180 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement

  zizmorcore/zizmor#2028 · 1 assignee · Opened May 17, 2026

  Maintainers usually reply within 1 day

• Feature request: new audit for insecure-ssh-keyscan - trust-on-first-use host key acceptance

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement new-audit

  Difficulty 3/5 1-2 days Newbie friendliness 55/100

  zizmorcore/zizmor#2012 · 1 comment · Opened May 15, 2026

  Maintainers usually reply within 1 day

• Feature: warn about GHA jobs with `id-token: write` attempting to build / invoke unrelated scripts

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  discussion enhancement

  Difficulty 5/5 Over a week Newbie friendliness 45/100

  zizmorcore/zizmor#1968 · 6 comments · 1 reaction · Opened May 4, 2026

  Maintainers usually reply within 1 day

• Feature: support --fix to reduce excessive permissions

  May be free again A pull request for this issue was closed without being merged. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  enhancement triage

  Difficulty 4/5 3-5 days Newbie friendliness 45/100

  zizmorcore/zizmor#1958 · 9 comments · Opened Apr 30, 2026

  Maintainers usually reply within 1 day