Bump tj-actions/verify-changed-files from 16 to 17 in /.github/workflows - #15
Conversation
dependabot
Bot
added
dependencies
|
@dependabot rebase |
de6c29a to
756d3b7
Compare
|
🔎 zai-reviewer — reviewed |
![adv-reviewer[bot]](https://avatars.githubusercontent.com/in/4400616?s=60&v=4){kind=small}
|
|
||
| - name: Verify changed files | ||
| uses: tj-actions/verify-changed-files@v16 | ||
| uses: tj-actions/verify-changed-files@v17 |
There was a problem hiding this comment.
The step is pinned to a moving major tag (tj-actions/verify-changed-files@v17) rather than an immutable commit SHA. The tj-actions org was compromised in March 2025 via force-pushed tags (the tj-actions/changed-files incident) that ran secret-exfiltrating code inside CI jobs. This step executes in the same job that sets persist-credentials: true (line 20) and exposes github.token to later steps (line 66); if this action's tag were force-moved again, the malicious code would run with access to those credentials. The bump from v16 to v17 is the right opportunity to convert this reference to a SHA pin, consistent with GitHub's guidance for third-party actions.
|
@dependabot rebase |
756d3b7 to
dc83671
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Go Benchmark'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 2.
| Benchmark suite | Current: dc83671 | Previous: de4f19c | Ratio |
|---|---|---|---|
BenchmarkCacheRead100kLF |
204.8 ns/op 6 B/op 0 allocs/op |
98.04 ns/op 3 B/op 0 allocs/op |
2.09 |
BenchmarkCacheRead100kLF - ns/op |
204.8 ns/op |
98.04 ns/op |
2.09 |
This comment was automatically generated by workflow using github-action-benchmark.
Bumps [tj-actions/verify-changed-files](https://github.com/tj-actions/verify-changed-files) from 16 to 17. - [Release notes](https://github.com/tj-actions/verify-changed-files/releases) - [Changelog](https://github.com/tj-actions/verify-changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/verify-changed-files@v16...v17) --- updated-dependencies: - dependency-name: tj-actions/verify-changed-files dependency-version: '17' dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dc83671 to
a2cc375
Compare
1 participant
Bumps tj-actions/verify-changed-files from 16 to 17.
Release notes
Sourced from tj-actions/verify-changed-files's releases.
... (truncated)
Changelog
Sourced from tj-actions/verify-changed-files's changelog.
... (truncated)
Commits
2acec78Updated README.md (#373)9076915feat: add support for matching non ascii characters (#371)b5c4e3eUpdated README.md (#369)f2ed8f0Update README.mdcffdb8cMerge pull request #368 from tj-actions/chore/update-readmed3e7995Updated README.md8182bddfeat: add support for running action within a subdirectory (#366)0e5b383Merge pull request #367 from tj-actions/renovate/tj-actions-glob-19.xd523882chore(deps): update tj-actions/glob action to v19d9a97a5Merge pull request #364 from tj-actions/upgrade-to-v17.0.2