5 ms·
Exactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit. See https://github.com/tj-actions
by werrett 2y ago
Exactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit.
See https://github.com/tj-actions/changed-files/tags https://github.com/tj-actions/changed-files/tags
All the tags point to commit `^0e58ed8`
https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67#diff-3d2b59189eeedc2d428ddd632e97658fe310f587f7cb63b01f9b98ffc11c0197R2999 https://github.com/tj-actions/changed-files/commit/0e58ed867...
- diggan 2y agoCorrect me if I'm wrong, but you would be able to prevent this specific issues with the "Rules" in order to block updates of tags; https://github.blog/news-insights/product-news/github-repository-rules-are-now-generally-available/ https://github.blog/news-insights/product-news/github-reposi...
- sestep 2y agoYeah but no GitHub Action is going to do this because updating tags is the de facto mechanism for releasing patches for those repositories.