Update tj-actions/changed-files usage from the Github Action checks since it has been compromised #17597
Conversation
There was a problem hiding this comment.
Hi @reta I approve the PR and opened a similar issue on build repo.
However at the time build repo is locking to a commit instead of @main so I guess we are fine for now.
Seems like the original reporting suggest majority of the versions are affected?
As for core, would this example fully replace the action?
https://github.com/opensearch-project/opensearch-build/blob/main/.github/workflows/manifests.yml#L6-L10
Let me know,
Thanks.
|
And do we need backports for this? |
|
Seem like it is just changing tags to point to this commit tj-actions/changed-files@0e58ed8. And since we already lock to a commit a while ago I think we are fine for now. Thanks. |
|
Seems resolved: tj-actions/changed-files#2464 (comment) |
…ince it has been compromised Signed-off-by: Andriy Redko <drreta@gmail.com>
reta
changed the title
Thanks @peterzhuamazon , updated to the latest one |
Description
Remove tj-actions/changed-files usage from the Github Action checks since it has been compromised. See please https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
Related Issues
N/A
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.