mustachecase/zanadir repository overview

⁠zanadir

Does your CI actually protect your repository? zanadir reads your CI configuration and reports which security and quality controls are missing, and which can never fail a build: a scanner with continue-on-error, or a secret scan that only runs on a schedule.

It supports GitHub Actions, GitLab CI, Bitbucket, Azure Pipelines, Jenkins and CircleCI.

⁠Quick start

Scan a public GitHub repository without cloning it:

docker run --rm mustachecase/zanadir scan --repo owner/name

Or scan a local checkout:

docker run --rm -v "$PWD:/repo" mustachecase/zanadir scan --dir /repo

Add --enforce to fail the build on gaps, -o json or -o sarif for other tools, and -e GITHUB_TOKEN for private repositories. In GitHub Actions, use zanadir-action⁠.

⁠Tags

latest, plus one tag per release (for example 0.10.0), which is the one to pin in CI. Each tag works on both Intel/AMD and ARM machines. The image contains only the zanadir binary.

Docs, source and issues: https://github.com/MustacheCase/zanadir⁠ · MIT licence