zizmorcore · woodruffw · Aug 28, 2025 · Aug 26, 2025 · Aug 26, 2025 · Aug 27, 2025
diff --git a/README.md b/README.md
@@ -220,6 +220,12 @@ when [`advanced-security`](#advanced-security) is enabled.
 will not upload results to Advanced Security, and will instead
 print them to the console.
 
+### `color`
+
+*Default*: `true`
+
+`color` controls whether `zizmor-action` outputs colorized log output.
+
 ## Permissions
 
 `zizmor-action` requires different permissions depending on how you use it.

diff --git a/action.sh b/action.sh
@@ -51,6 +51,7 @@ fi
 [[ "${GHA_ZIZMOR_ONLINE_AUDITS}" == "true" ]] || arguments+=("--no-online-audits")
 [[ -n "${GHA_ZIZMOR_MIN_SEVERITY}" ]] && arguments+=("--min-severity=${GHA_ZIZMOR_MIN_SEVERITY}")
 [[ -n "${GHA_ZIZMOR_MIN_CONFIDENCE}" ]] && arguments+=("--min-confidence=${GHA_ZIZMOR_MIN_CONFIDENCE}")
+[[ "${GHA_ZIZMOR_COLOR}" == "true" ]] && arguments+=("--color=always") || arguments+=("--color=never")
 
 image="ghcr.io/zizmorcore/zizmor:${GHA_ZIZMOR_VERSION#v}"
 
@@ -60,8 +61,6 @@ image="ghcr.io/zizmorcore/zizmor:${GHA_ZIZMOR_VERSION#v}"
 #   like '.' resolve correctly.
 # - We pass the GitHub token as an environment variable so that zizmor
 #   can run online audits/perform online collection if requested.
-# - We pass FORCE_COLOR=1 so that the output is always colored, even
-#   though we intentionally don't `docker run -it`.
 # - ${GHA_ZIZMOR_INPUTS} is intentionally not quoted, so that
 #   it can expand according to the shell's word-splitting rules.
 #   However, we put it after `--` so that it can't be interpreted
@@ -73,7 +72,6 @@ docker run \
     --volume "${GITHUB_WORKSPACE}:/workspace:ro" \
     --workdir "/workspace" \
     --env "GH_TOKEN=${GHA_ZIZMOR_TOKEN}" \
-    --env "FORCE_COLOR=1" \
     "${image}" \
     "${arguments[@]}" \
     -- \

diff --git a/action.yml b/action.yml
@@ -56,6 +56,11 @@ inputs:
       results to the repository's security tab.
     required: false
     default: "true"
+  color:
+    description: |
+      Whether zizmor should output colorized CLI output.
+    required: false
+    default: "true"
 
 runs:
   using: composite
@@ -73,6 +78,7 @@ runs:
         GHA_ZIZMOR_VERSION: ${{ inputs.version }}
         GHA_ZIZMOR_TOKEN: ${{ inputs.token }}
         GHA_ZIZMOR_ADVANCED_SECURITY: ${{ inputs.advanced-security }}
+        GHA_ZIZMOR_COLOR: ${{ inputs.color }}
       shell: bash
 
     - name: Upload SARIF file to GitHub Advanced Security