DevOps & CI/CD
Bug Report
A compromised GitHub Action rewrote its tags: why we now pin every action to a SHA
In March 2025 the popular tj-actions/changed-files action was compromised and its version tags were repointed to code that printed CI secrets into workflow logs. Three of our repositories used it by tag. This is how we checked exposure, rotated secrets and moved to SHA pinning.