What platforms would you like zizmor to support?

[woodruffw]

Starting with 1.29.0, I've decided to relax zizmor's unofficial "GitHub Actions" only support policy by adding support for auditing pre-commit hooks and configurations.

In a sense this opens the floodgates, and means that I'm (more) willing to consider supporting other CI/CD platforms as zizmor inputs.

This discussion topic is intended to centralize discussion of those, so I can gauge interest.

Some prior discussions:

• GitLab support: https://github.com/orgs/zizmorcore/discussions/356
• Forgejo/Gitea support: https://github.com/orgs/zizmorcore/discussions/1936

If there's another platform you'd like to see supported (or would just like to register interest in one of the above), this is the right place to do so 🙂

More generally, this is also where I'd like to hash out what it will take for zizmor to support new platforms. The rough current plan is that each new platform will require:

1. A directly responsible individual (which might be me) who is familiar with that platform's ins-and-outs and can drive implementation
2. A JSON schema for that platform already available on SchemaStore -- zizmor doesn't use this schema directly, but we do embed it for each input type to provide better error messages in the invalid input case
3. At least one existing (or new) audit that's directly applicable to zizmor (i.e., something with security salient, not just code quality)

[shaanmajid]

I think the Docker ecosystem is especially relevant and could benefit from some existing zizmor audits:

• unpinned-images can be extended to pin FROM / COPY --from directives in Dockerfiles
• adhoc-packages cleanly applies, since RUN is just a shell
• For new audits, flagging curl | sh patterns or ADD <url> directives without a corresponding --checksum could be viable candidates (both perhaps as a pedantic finding)

Docker's ubiquity and outsized security footprint makes it especially pertinent here IMO. There's admittedly some overlap with existing like hadolint, but that's primarily a quality linter, not a security one, so I think the ecosystem would still have significant benefits from zizmor coverage.

It admittedly falls on criteria 2 -- Dockerfiles aren't really a data format, so there's no corresponding SchemaStore JSON schema. But perhaps tree-sitter-dockerfile or similar grammars could fill some of that void?

[woodruffw]

Yeah, Docker would be a cool one to support. The big challenge there will be the source spanning, but if there's already a tree-sitter grammar then it probably wouldn't be too bad.

(Or even better, if there was a span-aware parser that produced a full AST, rather than a CST.)

[woodruffw]

(IMO not having a JSON schema there isn't a huge deal. To be precise it should have a JSON schema if it fits into a JSON document model, but Dockerfile doesn't 🙂)