Pinning GitHub Actions to a SHA is not protection
In March 2025 an attacker compromised tj-actions/changed-files and rewrote its release tags to point at malicious code. The injected code dumped runner memory into workflow logs, which on a public rep
Sep 2, 20266 min read3