scanning-ci-workflows

Scan a repository's GitHub Actions workflow and composite-action files by running two pinned external CLIs over them -- actionlint for workflow validity (schema, expression types, runner labels, embedded shell) and zizmor for workflow security posture (template injection, over-broad permissions, dangerous triggers, credential persistence, unpinned uses) -- and report each tool's own findings unmodified. Use when auditing CI workflow files, checking a workflow before merging it, or answering whether a repository's Actions configuration is safe and well-formed. Report-only, never auto-fixing. Distinct from scanning-attack-surfaces, which grades one artifact's own exposure and privilege design by its own per-item reasoning (reading only a subset of one tool's findings as evidence) and separately audits standing hosting-platform configuration such as branch protection and token inventory, rather than reporting two analyzers' complete findings over a whole workflow set.