Heads-up from ASF Infra. .github/workflows/auto-comment.yml uses actions-cool/issues-helper@v3.
What happened. On 2026-05-18 every tag of actions-cool/issues-helper was repointed to an imposter commit that harvests and exfiltrates CI/CD secrets (StepSecurity advisory); GitHub TOS-blocked the repo on 2026-05-19, so @v3 no longer resolves.
No exposure here. This workflow's last run was 2025-06-10 -- it did not run during the compromise window, so no secrets were exposed.
Action needed. The reference is dead; please remove it or swap to actions/github-script (always-allowed actions/* namespace, no allow-list change needed). Happy to send a PR. Also removed from the ASF allow list in apache/infrastructure-actions#1035.
Heads-up from ASF Infra.
.github/workflows/auto-comment.ymlusesactions-cool/issues-helper@v3.What happened. On 2026-05-18 every tag of
actions-cool/issues-helperwas repointed to an imposter commit that harvests and exfiltrates CI/CD secrets (StepSecurity advisory); GitHub TOS-blocked the repo on 2026-05-19, so@v3no longer resolves.No exposure here. This workflow's last run was 2025-06-10 -- it did not run during the compromise window, so no secrets were exposed.
Action needed. The reference is dead; please remove it or swap to
actions/github-script(always-allowedactions/*namespace, no allow-list change needed). Happy to send a PR. Also removed from the ASF allow list in apache/infrastructure-actions#1035.