From 237ab7fa68f96f2b857b04730a6cb25589c182ec Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Wed, 5 Aug 2026 11:04:03 +0200 Subject: [PATCH] ci: move changed-files off the CVE-2025-30066 affected v41 request-review.yml still referenced tj-actions/changed-files@v41, the action and version range hit by the March 2025 supply chain compromise (GHSA-mrrh-fwg8-r2c3): the attacker re-pointed existing version tags at code that dumped the runner's memory, including the job's GITHUB_TOKEN, into the public build logs. Bump to v46.0.5, pinned by commit SHA so the ref cannot be re-pointed again; the two other call sites already on v46 get the same pin in the next commit. The action's file-matching API is unchanged between v41 and v46 for the patterns used here. --- .github/workflows/request-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/request-review.yml b/.github/workflows/request-review.yml index 9998d6f83..5487639d7 100644 --- a/.github/workflows/request-review.yml +++ b/.github/workflows/request-review.yml @@ -19,7 +19,7 @@ jobs: ref: refs/pull/${{ github.event.pull_request.number }}/merge - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v41 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5 with: files: icons/*.svg - run: |