We hardened zizmor's GitHub Actions static analyzer
Trail of Bits hardened zizmor, a GitHub Actions static analyzer, following the March 2026 Shai-Hulud supply chain attack. They fixed parsing bugs and deserialization edge cases, validated against 41,253 workflows from 6,612 high-value repos. The effort yielded 20 filed issues and 15 merged PRs.