Optimizing GitHub Actions Static Analysis with Finite State Transducers

The developer of the static analysis tool zizmor optimized its GitHub Actions template injection vulnerability detection using Finite State Transducers (FSTs). By mapping GitHub Actions context patterns to their logical "capability", FSTs reduced the representation size by an order of magnitude (from ~240KB to ~14.5KB) and proved faster and more memory-efficient than previous table- and prefix-tree-based approaches. Furthermore, the FST is pre-computed at compile time, eliminating startup costs. This improvement significantly reduces false positives and enhances detection efficiency.