zizmor_github_actions_workflow_scanner_subprocess_json_output.py

1import subprocess
2import json
3
4def scan_workflow(workflow_path):
5    # Runs zizmor on a specific workflow file and returns findings in JSON format
6    result = subprocess.run(
7        ["zizmor", "--format", "json", workflow_path],
8        capture_output=True,
9        text=True
10    )
11    
12    if result.returncode == 0 or result.returncode == 1: # 1 often indicates findings found
13        return json.loads(result.stdout)
14    else:
15        print(f"Error running zizmor: {result.stderr}")
16        return None
17
18if __name__ == "__main__":
19    # Example usage: scan a local workflow file
20    findings = scan_workflow(".github/workflows/ci.yml")
21    if findings:
22        print(json.dumps(findings, indent=2))