Remove compromised actions-cool actions; pin check-user-permission (closes #891)#1035
Open
potiuk wants to merge 1 commit into
Open
Remove compromised actions-cool actions; pin check-user-permission (closes #891)#1035potiuk wants to merge 1 commit into
potiuk wants to merge 1 commit into
Conversation
Member
Author
|
This repo has been removed anyway. |
…loses #891) actions-cool/issues-helper and actions-cool/maintain-one-comment were compromised (all version tags moved to an imposter commit that exfiltrates CI/CD credentials); GitHub TOS-blocked both repos on 2026-05-19. Remove them from the allowlist -- they are no longer fetchable, and org-wide enforcement should no longer approve them. actions-cool/check-user-permission belongs to the same org but was not compromised and is still live. It was allowlisted as a wildcard ('*': keep), which -- given the org account was compromised -- is more trust than warranted. Pin it instead to c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e (v2.4.0), the exact SHA apache/camel already uses, with keep: true so it stays approved but is not dependabot-tracked (we do not want to auto-pull new versions from this org). This preserves camel's safe, SHA-pinned usage while dropping the wildcard. approved_patterns.yml is updated to match (surgical diff; unrelated expiry churn left to the update / remove_expired jobs). Generated-by: Claude Opus 4.8 (1M context) via Claude Code
potiuk
force-pushed
the
security/remove-actions-cool-891
branch
from
163b113 to
5a26cab
Compare
potiuk
changed the title
Member
Author
Downstream impact check (apache/* consumers)I searched Who uses them, and how
Compromise windowPer the StepSecurity advisory:
Did any ASF workflow run in that window?Runs created 2026-05-18..2026-05-19 for each workflow:
No ASF workflow executed the compromised actions while the malicious commit was live, so on this evidence there was no credential exposure. Supporting detail:
Net
Caveat: this covers usages GitHub code-search surfaced on default branches, via the Actions run history. A usage the index missed (other branches / un-indexed repos) would not be captured here. |
This was referenced Jul 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #891.
actions-cool/issues-helperandactions-cool/maintain-one-commentwere compromised -- an attacker moved every version tag to an imposter commit that exfiltrates CI/CD credentials (StepSecurity advisory linked in #891). GitHub TOS-blocked both repos on 2026-05-19, so they are no longer fetchable. Removed from the allowlist.actions-cool/check-user-permissionis the same org but was not compromised and is still live. It was allowlisted as a wildcard ('*': keep) -- more trust than warranted now that the org account was compromised. Rather than removing it (which would breakapache/camel, the one ASF consumer, which pins it safely by SHA), this pins it toc21884f3dda18dafc2f8b402fe807ccc9ec1aa5e(v2.4.0) -- the exact SHA camel uses -- withkeep: trueso it stays approved but is not dependabot-tracked (no auto-pulling new versions from this org).Verified across
apache/*: only camel used check-user-permission (SHA-pinned, safe). The three repos that referenced the compromised actions by@v3(linkis, linkis-website, incubator-kie-kogito-docs) are already protected by GitHub's takedown -- their steps now simply fail to fetch the action rather than running malicious code.approved_patterns.ymlis updated to match (surgical diff; unrelated expiry churn left to theupdate/remove_expiredjobs).Downstream cleanup (tracking)
Heads-up issues filed for the ASF repos that still reference the removed actions by the (now-blocked)
@v3tag, so they can drop/replace the dead steps:issues-helper@v3inauto-comment.ymlissues-helper@v3inauto-comment.yml(dormant workflow)maintain-one-comment@v3in the PR-preview workflowsNone of these were exposed (no runs during the compromise window -- see the analysis comment above).
🤖 Generated with Claude Code