Static analysis for GitHub Actions

Usage: zizmor [OPTIONS] <INPUT>...

Input Options:
  <INPUT>...
          The inputs to audit.

          These can be individual workflow filenames, action definitions (typically `action.yml`), entire directories, or a `user/repo` slug for a GitHub repository. In the latter case, a `@ref` can be appended to audit the repository at a particular git reference state.

          Use `-` to read a single input from stdin.

      --collect <KIND>...
          Control which kinds of inputs are collected for auditing.

          By default, all workflows and composite actions are collected, while honoring `.gitignore` files.

          Possible values:
          - all:        Collect all possible inputs, ignoring `.gitignore` files
          - default:    Collect all inputs, respecting `.gitignore` files
          - workflows:  Collect GitHub Actions workflows
          - actions:    Collect GitHub Actions action definitions (i.e. `action.yml`)
          - dependabot: Collect Dependabot configuration files (i.e. `dependabot.yml`)
          - pre-commit: Collect pre-commit configuration and hooks files, i.e. `.pre-commit-config.yaml` and `.pre-commit-hooks.yaml`

          [default: default]

      --strict-collection
          Fail instead of warning on syntax and schema errors in collected inputs

Audit Options:
      --fix[=<MODE>]
          Fix findings automatically, when available (EXPERIMENTAL)

          Possible values:
          - safe:        Apply only safe fixes (the default)
          - unsafe-only: Apply only unsafe fixes
          - all:         Apply all fixes, both safe and unsafe

  -p, --pedantic
          Emit 'pedantic' findings.

          This is an alias for --persona=pedantic.

      --persona <PERSONA>
          The persona to use while auditing

          Possible values:
          - auditor:  The "auditor" persona (false positives OK)
          - pedantic: The "pedantic" persona (code smells OK)
          - regular:  The "regular" persona (minimal false positives)

          [default: regular]

      --min-severity <LEVEL>
          Filter all results below this severity

          [possible values: informational, low, medium, high]

      --min-confidence <LEVEL>
          Filter all results below this confidence

          [possible values: low, medium, high]

      --no-ignores
          Don't honor ignore comments or ignore rules in configuration

Output Options:
  -v, --verbose...
          Increase logging verbosity

  -q, --quiet...
          Decrease logging verbosity

      --format <KIND>
          The output format to emit. By default, cargo-style diagnostics will be emitted

          Possible values:
          - plain:   cargo-style output
          - json:    JSON-formatted output (currently v1)
          - json-v1: "v1" JSON format
          - sarif:   SARIF-formatted output
          - github:  GitHub Actions workflow command-formatted output

          [default: plain]

      --no-progress
          Don't show progress bars, even if the terminal supports them

      --color <WHEN>
          Control the use of color in output

          Possible values:
          - auto:   Use color output if the output supports it
          - always: Force color output, even if the output isn't a terminal
          - never:  Disable color output, even if the output is a compatible terminal

      --render-links <WHEN>
          Whether to render OSC 8 links in the output.

          This affects links under audit IDs, as well as any links produced by audit rules.

          Only affects `--format=plain` (the default).

          Possible values:
          - auto:   Render OSC 8 links in output if support is detected
          - always: Always render OSC 8 links in output
          - never:  Never render OSC 8 links in output

          [env: ZIZMOR_RENDER_LINKS=]
          [default: auto]

      --show-audit-urls <WHEN>
          Whether to render audit URLs in the output, separately from any URLs embedded in OSC 8 links.

          Only affects `--format=plain` (the default).

          Possible values:
          - auto:   Render audit URLs in output automatically based on output format and runtime context
          - always: Always render audit URLs in output
          - never:  Never render audit URLs in output

          [env: ZIZMOR_SHOW_AUDIT_URLS=]
          [default: auto]

      --no-exit-codes
          Disable all error codes besides success and tool failure

Network Options:
  -o, --offline
          Perform only offline operations.

          This disables all online audit rules, and prevents zizmor from auditing remote repositories.

          [env: ZIZMOR_OFFLINE=]

      --gh-token <GH_TOKEN>
          The GitHub API token to use [env: GH_TOKEN or GITHUB_TOKEN or ZIZMOR_GITHUB_TOKEN]

      --gh-hostname <GH_HOSTNAME>
          The GitHub Server Hostname. Defaults to github.com

          [env: GH_HOST=]
          [default: github.com]

      --no-online-audits
          Perform only offline audits.

          This is a weaker version of `--offline`: instead of completely forbidding all online operations, it only disables audits that require connectivity.

          [env: ZIZMOR_NO_ONLINE_AUDITS=]

      --cache-dir <DIR>
          The directory to use for HTTP caching. By default, a host-appropriate user-caching directory will be used

Options:
      --lsp
          Run in language server mode (EXPERIMENTAL).

          This flag cannot be used with any other flags.

  -c, --config <FILE>
          The configuration file to load. This loads a single configuration file across all input groups, which may not be what you intend

          [env: ZIZMOR_CONFIG=]

      --no-config
          Disable all configuration loading

      --completions <SHELL>
          Generate tab completion scripts for the specified shell

          Possible values:
          - bash:       Bourne Again `SHell` (bash)
          - elvish:     Elvish shell
          - fish:       Friendly Interactive `SHell` (fish)
          - nushell:    Nushell
          - powershell: `PowerShell`
          - zsh:        Z `SHell` (zsh)

      --thanks
          Emit thank-you messages for zizmor's sponsors

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version