From 5a26cab6d83612be8b40135dbe2c8991dc7fa083 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Sun, 12 Jul 2026 22:19:33 +0200 Subject: [PATCH] Remove compromised actions-cool actions; pin check-user-permission (closes #891) actions-cool/issues-helper and actions-cool/maintain-one-comment were compromised (all version tags moved to an imposter commit that exfiltrates CI/CD credentials); GitHub TOS-blocked both repos on 2026-05-19. Remove them from the allowlist -- they are no longer fetchable, and org-wide enforcement should no longer approve them. actions-cool/check-user-permission belongs to the same org but was not compromised and is still live. It was allowlisted as a wildcard ('*': keep), which -- given the org account was compromised -- is more trust than warranted. Pin it instead to c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e (v2.4.0), the exact SHA apache/camel already uses, with keep: true so it stays approved but is not dependabot-tracked (we do not want to auto-pull new versions from this org). This preserves camel's safe, SHA-pinned usage while dropping the wildcard. approved_patterns.yml is updated to match (surgical diff; unrelated expiry churn left to the update / remove_expired jobs). Generated-by: Claude Opus 4.8 (1M context) via Claude Code --- actions.yml | 9 ++------- approved_patterns.yml | 4 +--- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/actions.yml b/actions.yml index 718fb172..efef3d97 100644 --- a/actions.yml +++ b/actions.yml @@ -34,13 +34,8 @@ 3a12b0ab99d9cd590a3e9b5a90ea017210ed9556: tag: v4.0.1 actions-cool/check-user-permission: - '*': - keep: true -actions-cool/issues-helper: - '*': - keep: true -actions-cool/maintain-one-comment: - '*': + c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e: + tag: v2.4.0 keep: true addnab/docker-run-action: 4f65fabd2431ebc8d299f8e5a018d79a769ae185: diff --git a/approved_patterns.yml b/approved_patterns.yml index 921cd926..1525214a 100644 --- a/approved_patterns.yml +++ b/approved_patterns.yml @@ -23,9 +23,7 @@ - 1Password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 - 1Password/load-secrets-action/configure@92467eb28f72e8255933372f1e0707c567ce2259 - 1Password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 -- actions-cool/check-user-permission@* -- actions-cool/issues-helper@* -- actions-cool/maintain-one-comment@* +- actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e - addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 - AdoptOpenJDK/install-jdk@* - advanced-security/dismiss-alerts@046d6b48d2e43cf563f96f67332c47c432eff83e