[koromak]

Anyone know of a tool like zizmor for GitLab CI/CD? Pretty confident my setup is unsafe after reading through this.

Honestly safety in CI/CD seems near impossible anyways.

[pabs3]

There is some linting available:

https://docs.gitlab.com/ee/ci/yaml/lint.html

Personally I'd move as much logic out of the YAML as possible into either pure shell scripts or scripts in other languages. Then use shellcheck other appropriate linters for those scripts.

Maybe one day someone will write a proper linter for the shell-wrapped-in-yaml insanity that are these CI systems, but it seems unlikely.