⬆️ Bump tj-actions/changed-files from 45 to 46 #39722
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 45 to 46. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@v45...v46) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
|
Documentation preview for this PR (built with commit 73abffd; changes) is ready! 🎉 |
|
@sagemath/core IMPORTANT: we have been affected by the compromised action, see https://github.com/sagemath/sage/actions/runs/13866682283/job/38807100680#step:5:74 According to https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#considering-cross-repository-access, the
|
|
what exactly needs to be done ? |
|
how to find all places in the logs with such compromised data ? |
|
Is it this one: |
we don't need to. We need this to stop by this upgrade, but we can assume all sagemath org tokens are compromised and on all the forks which run our Actions, if I am not mistaken |
|
to be on a safe side, I just posted https://groups.google.com/g/sage-release/c/QP60KVd4Af4/m/vuudv0MIAwAJ |
The compromised commit has been already removed upstream in the action, so at the moment no further secrets are posted in the github workflow. In particular, we don't need to upgrade this action urgently. But as @dimpase said, we should assume that someone might have temporarily gained access to our github infrastructure and might have made changes to settings/pushed commits, and/or have changed secrets. |
|
The only secret my team found on sage was https://github.com/sagemath/sage/actions/runs/13866682283/job/38807100680#step:5:74 By now, that token should have expired. An attacker may have done something previously with that token. The GitHub action is no longer compromised. The action became malicious at March 14 2025 at 16:57:45 UTC with a commit, and was malicious for ~12 hours. The URL above is from a runner which was ran during that time. edit: summary and recommendations by upstream tj-actions/changed-files tj-actions/changed-files#2463 (comment) |
Bumps tj-actions/changed-files from 45 to 46.
Release notes
Sourced from tj-actions/changed-files's releases.
... (truncated)
Changelog
Sourced from tj-actions/changed-files's changelog.
... (truncated)
Commits
2f7c5bfUpdated README.md (#2473)4189ec6update: sync-release-version.yml to use signed commits (#2472)4cd184aupdate: sync-release-version.yml (#2471)5cbf220Updated README.md (#2469)0f1ffe6fix: update update-readme.yml to sign-commits (#2468)ddef03efix: update permission in update-readme.yml workflow (#2467)9c2df0dfix: update github workflow update-readme.yml (#2466)6525332docs: update docs to highlight security issues (#2465)e37e952Deleted renovate.jsona284dc1Upgraded to v45.0.8 (#2462)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)