Skip to content

Commit e8b6f2a

Browse files
committed
hotfix: remove compromised changed-files action
The `tj-actions/changed-files` GitHub action appears to have been compromised. For details, see: - https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/ - https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised Apparently, using the action can leak CI secrets, so this commit removes our only use of the action and replaces it with an equivalent implementation in shell. Signed-off-by: Geoffrey M. Oxberry <geoffrey.oxberry@datadoghq.com>
1 parent c1be9f0 commit e8b6f2a

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

.github/workflows/check-changelog.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,12 @@ jobs:
2525
- name: Check if CHANGELOG.md was modified
2626
id: changelog-check
2727
if: steps.label-check.outputs.has_label == 'false'
28-
uses: tj-actions/changed-files@dcc7a0cba800f454d79fff4b993e8c3555bcc0a8 # v45.0.7
29-
with:
30-
files: |
31-
CHANGELOG.md
28+
run: |
29+
if git diff --quiet HEAD^ -- CHANGELOG.md; then
30+
echo "any_changed=false" >> $GITHUB_OUTPUT
31+
else
32+
echo "any_changed=true" >> $GITHUB_OUTPUT
33+
fi
3234
3335
- name: Assert CHANGELOG.md is modified
3436
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

0 commit comments

Comments
 (0)