Be aware of the Makefile effect

Happy New Year!

TL;DR: zizmor would have caught the vulnerability that caused this…mostly. Read on for details.

Standard disclaimer: These are my personal opinions, not the opinions of my employer, PyPI, or any open source I projects I participate in (either for funsies or because I’m paid to). In particular, nothing I write below can be interpreted to imply (or imply the negation of) similar opinions by any of the above, except where explicitly stated.

This is an announcement for zizmor, a new tool for finding security issues in GitHub Actions setups. You can run it on one or more workflow definitions1, and it’ll emit cargo-style diagnostics, SARIF, or JSON as you please. Support for custom actions (e.g. action.yml within actions/checkout or similar) is planned, but not implemented yet. ↩

Another Rust crate announcement: this time I’m announcing yamlpath, a small library for format-preserving YAML feature extraction.