WHOSE CODE AM I RUNNING IN GITHUB ACTIONS?

Summary from the TLDR newsletter

Somebody added malicious code to the tj-actions/changed-files GitHub Action a week ago, making the compromised action leak secrets to build logs. The attack was possible because it's common practice to refer to tags in a GitHub Actions workflow - changing a tag can make an action run different code the next time it runs. Specifying a git commit ID instead creates a reference that will run the same code every time. This post presents a script that enables you to check whether there are any mutable references within your GitHub Actions workflows.