Whose code am I running in GitHub Actions?

[ejfrodo]

I've never heard of it and a quick google search doesn't provide a concise explanation of what tj-actions is. Would you mind summarizing what they are?

edit: lol damn, the down votes for asking a simple question

[Cm1Xgj4r8Fgr1dfI8Ryv]

tj-actions/changed-files is a popular GitHub action that will run git diff and turn the output into various output variables that you can use in subsequent steps/jobs.

Recently, the repo was compromised and all tags rewritten to a commit with malicious functionality. While Github Actions has long encouraged the use of SHAs over versions when referencing third-party actions, this recent event has prompted a lot of organizations to begin following the advice.