GitHub Action tj-actions/changed-files is compromised

[hugovk]

See https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/

https://github.com/search?q=org%3Apython+tj-actions&type=code

https://github.com/Ana06/get-changed-files could be used as a replacement, or you could rewrite the logic in a Python script.

[hugovk]

A quick fix is to pin to an older hash:

• ci: use pinned tj-actions/changed-files v39 matter-labs/era-compiler-llvm#792
• Use unexploited 'tj-actions/change-files' action hasura/ndc-hub#508

Edit: The https://github.com/tj-actions/changed-files repo has now been deleted.

[marcorichetta]

A quick fix is to pin to an older hash:

* ~[ci: use pinned tj-actions/changed-files v39 matter-labs/era-compiler-llvm#792](https://github.com/matter-labs/era-compiler-llvm/pull/792)~

* ~[Use unexploited 'tj-actions/change-files' action hasura/ndc-hub#508](https://github.com/hasura/ndc-hub/pull/508)~

Edit: The tj-actions/changed-files repo has now been deleted.

Hi @hugovk, is this still relevant?

• The repo is not deleted.
• New versions were released

Per https://github.com/tj-actions/changed-files/releases/tag/v46, we should revoke the tokens and maybe use new tagged versions.

cc @cmaureir #3374

[hugovk]

It must have been temporarily made private, and made public again after they removed the malicious commits.

The advice at https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/#header-3 is:

1. Investigate if you have any repositories that did use tj-actions, you likely need to rotate any secrets that were made public in the CI build logs, using the steps above in this blog post
   1. Any tj-actions that leveraged tags would need to be investigated e.g., tj-actions/changed-files@v45 should be reviewed
   2. Any tj-actions versions that used the compromised commit tj-actions/changed-files@0e58ed8 should be reviewed
2. Upgrade all workflow actions to use the latest release immutable commit: tj-actions/changed-files@2f7c5bf or use the latest @v46 tag.