zizmor 1.24.0

Static analysis for GitHub Actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# Adapted from
# https://github.com/woodruffw/gha-hazmat/blob/main/.github/workflows/hardcoded-credentials.yml

on:
  push:
    branches:
      - master
  workflow_dispatch:

name: hardcoded-credentials

permissions: {}

jobs:
  test:
    name: test
    runs-on: ubuntu-latest
    container:
      image: fake.example.com/example
      credentials:
        username: user
        password: hackme
    steps:
      - run: echo 'vulnerable!'