Skip to content

Commit af1fe93

Browse files
authored
Swap external action to verify changed files for inline code (#6779)
In the light of recent security issues, we are choosing to use our own code to replace an external action. See https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised for context b/403703743
1 parent 236df1f commit af1fe93

File tree

1 file changed

+11
-7
lines changed

1 file changed

+11
-7
lines changed

.github/workflows/release-note-changes.yml

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- 'main'
77

88
jobs:
9-
build:
9+
release-notes-changed:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- uses: actions/[email protected]
@@ -18,12 +18,16 @@ jobs:
1818

1919
- name: Get changed changelog files
2020
id: changed-files
21-
uses: tj-actions/[email protected]
22-
with:
23-
files_ignore: |
24-
plugins/**
25-
files: |
26-
**/CHANGELOG.md
21+
run: |
22+
git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha}} | grep CHANGELOG.md > /tmp/changelog_file_list.txt
23+
if [[ "$?" == "0" ]]
24+
then
25+
echo "any_changed=true" >> $GITHUB_OUTPUT
26+
else
27+
echo "any_changed=false" >> $GITHUB_OUTPUT
28+
fi
29+
echo "all_changed_files=$(cat /tmp/changelog_file_list.txt)" >> $GITHUB_OUTPUT
30+
rm /tmp/changelog_file_list.txt
2731
2832
- name: Set up JDK 17
2933
uses: actions/[email protected]

0 commit comments

Comments
 (0)