GITHUB ACTION TJ-ACTIONS/CHANGED-FILES SUPPLY CHAIN ATTACK: EVERYTHING YOU NEED TO KNOW

Summary from the TLDR InfoSec newsletter

The tj-actions/changed-files GitHub Action repository was compromised by an attacker posing as the Renovate bot. The attacker added a malicious payload that caused the CI runner to dump its memory into the Actions work log and redirected all tags to include this payload. Sensitive data in GitHub secrets for this action can be visible in public repos, but the impact on private repositories is more limited.