## Summary of the Issue The `tj-actions/changed-files` GitHub Action has been compromised. Attackers modified the Action’s code and retroactively updated multiple version tags to reference a malicious commit. This compromised Action has been found to **expose CI/CD secrets in GitHub Actions build logs**. If these logs are public, anyone can access and steal these secrets. GitHub has since removed the affected Action, and a secure replacement is available. However, **any secrets exposed in your workflow logs should be treated as compromised and rotated immediately**. The compromise of `tj-actions/changed-files` was potentially due to a similar compromise of another GitHub Action, `reviewdog/action-setup@v1`. The following Actions may also be affected:  * `reviewdog/action-shellcheck` * `reviewdog/action-composite-template` * `reviewdog/action-staticcheck` * `reviewdog/action-ast-grep` * `reviewdog/action-typos` ## Our Progress to Date We have identified the following workflows with potential risk: eclipse-che/che-docs/.github/workflows/vale.yml eclipse-che/blog/.github/workflows/vale.yml eclipse-che/che-docs-vale-style/.github/workflows/vale.yml We examined the workflow runs that occurred within the timeframe when the compromised actions were infected. | 2025-03-10T14:27:11Z | https://github.com/eclipse-che/che-docs/actions/runs/13767098929 | |----------------------|------------------------------------------------------------------| | 2025-03-12T15:30:23Z | https://github.com/eclipse-che/che-docs/actions/runs/13815261212 | | 2025-03-12T17:27:55Z | https://github.com/eclipse-che/che-docs/actions/runs/13817725666 | | 2025-03-14T10:05:09Z | https://github.com/eclipse-che/che-docs/actions/runs/13854280816 | | 2025-03-14T10:05:11Z | https://github.com/eclipse-che/che-docs/actions/runs/13854281284 | These analyses revealed no potential leaks. Additionally, the only secret used in these workflows is the ephemeral GITHUB_TOKEN. ## Immediate Actions to Take 1. **Review our Workflow Runs Logs Analysis** It is possible that we missed something. At this time, potential indicators of compromise we are aware of are the appearance of **secret hashes** in workflow runs logs for steps using the compromised actions above. Kindly review the logs for steps involving: * `tj-actions/changed-files:` * Check for hashes under log lines containing “`changed-files`” text * Example: in [this article](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised) under “Review GitHub Actions Workflow Run Logs”  * `reviewdog/*:` * Check for hashes in step logs * Example: in [this article](https://www.stepsecurity.io/blog/reviewdog-github-actions-are-compromised) under “Summary of the incident”  2. **Rotate Potentially Compromised Secrets** * If you see something suspicious, identify all secrets used the workflow. * Identify which ones are managed by Eclipse Foundation and which ones are controlled by your team. * For all secrets controlled by your team * Generate new secrets and send us updates via standard procedure: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Sharing-secrets. Please mention in the email that the change is requested after a potential compromise of the secret * Revoke those exposed credentials you control to prevent unauthorized access. * For all secrets controlled by the Eclipse Foundation, please share with us the list of secrets names to be rotated and revoked. 3. **Update Your Workflows to Use a Secure Replacement** Replace all instances of `tj-actions/changed-files` and others with patched versions, using the specific commit hash instead of version tags to mitigate against future supply chain attacks: ``` tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1 ``` If you really need to use tags (not recommended), you can use: ``` tj-actions/changed-files@v46.0.1 ``` 4. **Delete Logs Containing Secrets** If secrets were exposed in workflow logs, delete the affected logs immediately to prevent further exposure. 5. **Review Your Project’s Configuration and Stay Alert** Review the configuration of your projects and watch out for actions that might have been already performed with those exposed secrets. Such actions could potentially include, but are not limited to (depending on the secrets exposed): * Modify project’s artifacts (like release tarballs) * Add commits or tags * Change links in Project’s documentation ## Next steps To avoid supply chain threats, update all GitHub actions tags to [use commit hash](https://wellarchitected.github.com/library/application-security/recommendations/actions-security/#pin-versions-of-actions) instead. [Dependabot can manage action updates](https://wellarchitected.github.com/library/application-security/recommendations/actions-security/#use-dependabot-to-upgrade-vulnerable-actions), including commit hash. The Eclipse Foundation Security Team offers [tooling](https://github.com/eclipse-csi/octopin) to pin all your workflows at once and [ensure they stay that way](https://github.com/eclipse-csi/.eclipsefdn/blob/main/otterdog/blueprints/pin_workflows.yml). ## Additional Resources * **StepSecurity:** Initial report on Harden Runner detection and the compromise of the tj-actions changed-files action [Step Security](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised) * **GitHub:** Advisory GHSA-mrrh-fwg8-r2c3 https://github.com/advisories/GHSA-mrrh-fwg8-r2c3 * **Hacker News:** News report on CISA's warning of active exploitation https://thehackernews.com/2025/03/cisa-warns-of-active-exploitation-in.html * **CISA:** Alert on supply chain compromise involving a third-party GitHub action (CVE-2025-30066) https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 * **Wiz:** Further analysis of the new GitHub action supply chain attack and the reviewdog-action-setup https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup * **GitHub:** Advisory for Reviewdog GHSA-qmg3-hpqr-gqvc https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc /confidential