Zizmor, GitHub action static analysis

Amazing set of security related static analysis rules for GitHub actions.

I did not know there were so many gotchas.