Conversation
tj-actions/changed-files was previously referenced by the mutable major-version tag `v47`. Mutable action tags are exactly what let CVE-2025-30066 (GHSA-mrrh-fwg8-r2c3) happen: an attacker with write access to tj-actions/changed-files retargeted its version tags (back to v1) to a malicious commit that dumped CI runner memory, including secrets, into public workflow logs. `docs-integration-tests.yml` runs this action in the same job as several dozen secrets (API keys, DB credentials, GH_RELEASE_PAT) with contents:write / pull-requests:write permissions, so a repeat of that attack against this specific action would be high impact here. As of writing, the `v47` tag still points at the v47.0.0 commit even though v47.0.6 has since been released, which is itself a small illustration of how a floating tag can silently lag or be moved without a corresponding version bump that Dependabot would flag. Pin to the v47.0.6 commit SHA (with a version comment for readability) so the action can only run the exact reviewed code, regardless of what the tag is later repointed to. Dependabot's github-actions ecosystem entry in .github/dependabot.yml already tracks and bumps SHA-pinned actions, so future updates keep working the same way. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
docs-integration-tests.ymlreferencestj-actions/changed-files@v47by its mutable major-version tag rather than an immutable commit SHA.Floating tags on third-party actions are exactly the mechanism behind GHSA-mrrh-fwg8-r2c3 / CVE-2025-30066: in March 2025,
tj-actions/changed-filesitself was compromised and its version tags (going back tov1) were retargeted to a malicious commit that dumped CI runner memory, including secrets, into workflow logs — which are public for public repositories.This specific workflow is a good example of why that matters here: the
Get Changed Filesstep runs in the same job as several dozen third-party secrets (AWS_*,OPENAI_API_KEY,GH_RELEASE_PAT, etc.) andcontents: write/pull-requests: writepermissions, so a repeat of the same style of attack against this action would have real reach in this repo.As a small, concrete illustration of tag mutability: right now
v47still resolves to thev47.0.0commit even thoughv47.0.6has since been tagged upstream — the major tag simply hasn't been moved forward, and nothing stops it (orv1..v46) from being moved backward to something malicious without any new version ever being published for Dependabot to flag.Fix
Pin the action to the
v47.0.6commit SHA, with a trailing version comment for readability:This is the pattern GitHub's own security hardening guide recommends for third-party actions. The repo's existing
github-actionsDependabot ecosystem entry already understands SHA-pinneduses:references and will keep opening version-bump PRs the same way it does today.Scope kept intentionally minimal to this one action, since it's the one with a documented supply-chain compromise history; happy to follow up on the repo's other third-party action refs (
softprops/action-gh-release,peter-evans/create-pull-request,readthedocs/actions/preview,codecov/codecov-action) in a separate PR if that's wanted.Checklist
v47.0.6tag via the GitHub API (gh api repos/tj-actions/changed-files/tags).🤖 Generated with Claude Code