Skip to content

[MNT] Replace tj-actions/changed-files #2625

Open
@MatthewMiddlehurst

Description

@MatthewMiddlehurst

Describe the issue

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

The repo owners did a bit of an oopsie and now the action no longer exists. This is mainly used in our pre-commit action on PRs to only look at changed files.

EDIT: The repo is available again, but it would still be good to find a replacement.

Suggest a potential alternative/fix

Find/write and alternative. This does not have to be an action, you can just find the changed files manually.

Additional context

There are some security implications for this with using tags in GitHub actions, but I'm not sure replacing every action import with a SHA is a trouble free solution. I don't see anything leaked on our end.

Metadata

Metadata

Assignees

No one assigned

    Labels

    maintenanceContinuous integration, unit testing & package distribution

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions