sage is using a compromised tj-actions/changed-files GitHub action

[eslerm]

Filing a public issue instead of reporting this as a private vulnerability, since this malware is a publicly known and an urgent issue.

sage uses a compromised version of tj-actions/changed-files. The compromised action appears to leak secrets the runner has in memory.

The action is included in:

• https://github.com/sagemath/sage/blob/7d830638dc9f4a38ada23dc4f2c301c06b068350/.github/workflows/build.yml

Output of an affected runs:

• https://github.com/sagemath/sage/actions/runs/13866682283/job/38807100680#step:5:74

Please review.

Learn about the compromise on StepSecurity of Semgrep.

[fchapoton]

@kwankyu @tobiasdiez : I think we need to react quickly to this.

[tobiasdiez]

See #39722 (comment)