zizmor's auditor persona surfaces findings the default persona hides

I ran zizmor --pedantic across two repos as part of a supply chain hardening sprint. Both came back clean. When I checked the summary line, both had suppressed findings: “No findings to report. Good job! (1 suppressed)” and “No findings to report. Good job! (2 ignored, 3 suppressed)”. Six real issues, none of them surfaced by --pedantic.

What I Learned

--pedantic is a persona alias for --persona=pedantic. That persona is tuned for code smells: things like superfluous-actions, unpinned-uses, unsound-condition. The higher-confidence security findings that the default regular persona suppresses fall outside its scope.

When I ran the standard mise run actions:audit (which is just zizmor .github/workflows with no flags), both repos came back “No findings to report” with suppressed findings. The CI pipeline was green. Nobody would have noticed.

The zizmor docs show a --persona flag with three values:

The key is that --persona=auditor surfaces a different set of findings than --pedantic. They target different classes of issues. Running only --pedantic misses the medium-severity, high-confidence findings that the regular persona suppresses¹.

The command

# Full audit: every finding zizmor can produce
zizmor .github/workflows --persona=auditor --no-ignores

--no-ignores bypasses zizmor.yml and inline # zizmor: ignore[rule] comments. Run both flags together to see every finding. Through mise:

mise x zizmor -- zizmor .github/workflows --persona=auditor --no-ignores

What it found

Six suppressed findings across two repos: three artipacked (credential persistence in checkout), two superfluous-actions (unnecessary third-party actions), and one secrets-outside-env (secret used without an environment). None of them needed a suppression. I fixed all six; the details are in fixing zizmor findings without suppressions.

I spent too long trying to figure out why --pedantic was not showing these findings. I assumed --pedantic was the “show everything” mode. The zizmor docs mention personas in the --persona flag help, but the summary line “(1 suppressed)” only hints at what is hidden. I would document the --persona=auditor --no-ignores command in every repo’s AGENTS.md from the start, so the “full audit” incantation is always one copy-paste away.

References

• zizmor. Static analysis for GitHub Actions.
• zizmor personas. Documentation for the --persona flag and what each persona surfaces.
• zizmor audit: superfluous-actions. Documentation for the rule that flagged peter-evans/create-pull-request.
• zizmor audit: artipacked. Documentation for the rule that flagged persist-credentials: true.
• zizmor audit: secrets-outside-env. Documentation for the rule that flagged DAGGER_CLOUD_TOKEN.
• fixing zizmor findings without suppressions. The fix patterns for all six findings.