Checkmarx · cx-antero-silva · Mar 21, 2025
@@ -0,0 +1,13 @@
+{
+  "id": "12aead41-b910-43aa-9af9-e280f95e587c",
+  "queryName": "tj-actions changed-files secret discovery",
+  "severity": "HIGH",
+  "category": "Insecure Configurations",
+  "descriptionText": "GitHub Action tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.",
+  "descriptionUrl": "https://github.com/advisories/GHSA-mrrh-fwg8-r2c3",
+  "platform": "CICD",
+  "descriptionID": "02044a76",
+  "cloudProvider": "common",
+  "cwe": "506",
+  "oldSeverity": "HIGH"
+}
@@ -0,0 +1,26 @@
+package Cx
+
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+
+	uses := input.document[i].jobs[j].steps[k].uses
+	isAllowed(uses)
+
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("uses={{%s}}", [uses]),
+		"issueType": "InscureAction",
+		"keyExpectedValue": "tj-actions changed-files through 46.",
+		"keyActualValue": "tj-actions changed-files through 45.",
+		"searchLine": common_lib.build_search_line(["jobs", j, "steps", k, "uses"],[])
+	}
+}
+
+
+isAllowed(use){
+	allowed := ["tj-actions/changed-files@v45"]
+    startswith(use,allowed[i])
+}
+
@@ -0,0 +1,52 @@
+name: check-go-coverage
+
+on:
+  pull_request_target:
+    branches: [master]
+
+jobs:
+  coverage:
+    name: Check Go coverage
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Go 1.22.x
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.x
+      - name: Run test metrics script
+        id: testcov
+        run: |
+          make test-coverage-report | tee test-results
+          echo "coverage=$(cat test-results | grep "Total coverage: " test-results | cut -d ":" -f 2 | bc)" >> $GITHUB_ENV
+      - name: Checks if Go coverage is at least 80%
+        if: env.coverage < 80
+        run: |
+          echo "Go coverage is lower than 80%: ${{ env.coverage }}%"
+          exit 1
+changed_files:
+    runs-on: ubuntu-latest  # windows-latest || macos-latest
+    name: Test changed-files
+    steps:
+      - uses: actions/checkout@v4
+
+      # -----------------------------------------------------------------------------------------------------------
+      # Example 1
+      # -----------------------------------------------------------------------------------------------------------
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v46
+        # To compare changes between the current commit and the last pushed remote commit set `since_last_remote_commit: true`. e.g
+        # with:
+        #   since_last_remote_commit: true 
+
+      - name: List all changed files
+        env:
+          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+        run: |
+          for file in ${ALL_CHANGED_FILES}; do
+            echo "$file was changed"
+          done
@@ -0,0 +1,108 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  # ------------------------------------------------------------------------------------------------------------------------------------------------
+  # Event `pull_request`: Compare the last commit of the main branch or last remote commit of the PR branch -> to the current commit of a PR branch.
+  # ------------------------------------------------------------------------------------------------------------------------------------------------
+  changed_files:
+    runs-on: ubuntu-latest  # windows-latest || macos-latest
+    name: Test changed-files
+    steps:
+      - uses: actions/checkout@v4
+
+      # -----------------------------------------------------------------------------------------------------------
+      # Example 1
+      # -----------------------------------------------------------------------------------------------------------
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v45
+        # To compare changes between the current commit and the last pushed remote commit set `since_last_remote_commit: true`. e.g
+        # with:
+        #   since_last_remote_commit: true 
+
+      - name: List all changed files
+        env:
+          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+        run: |
+          for file in ${ALL_CHANGED_FILES}; do
+            echo "$file was changed"
+          done
+
+      # -----------------------------------------------------------------------------------------------------------
+      # Example 2
+      # -----------------------------------------------------------------------------------------------------------
+      - name: Get all changed markdown files
+        id: changed-markdown-files
+        uses: tj-actions/changed-files@v45
+        with:
+          # Avoid using single or double quotes for multiline patterns
+          files: |
+            **.md
+            docs/**.md
+
+      - name: List all changed files markdown files
+        if: steps.changed-markdown-files.outputs.any_changed == 'true'
+        env:
+          ALL_CHANGED_FILES: ${{ steps.changed-markdown-files.outputs.all_changed_files }}
+        run: |
+          for file in ${ALL_CHANGED_FILES}; do
+            echo "$file was changed"
+          done
+
+      # -----------------------------------------------------------------------------------------------------------
+      # Example 3
+      # -----------------------------------------------------------------------------------------------------------
+      - name: Get all test, doc and src files that have changed
+        id: changed-files-yaml
+        uses: tj-actions/changed-files@v45
+        with:
+          files_yaml: |
+            doc:
+              - '**.md'
+              - docs/**
+            test:
+              - test/**
+              - '!test/**.md'
+            src:
+              - src/**
+          # Optionally set `files_yaml_from_source_file` to read the YAML from a file. e.g `files_yaml_from_source_file: .github/changed-files.yml`
+
+      - name: Run step if test file(s) change
+        # NOTE: Ensure all outputs are prefixed by the same key used above e.g. `test_(...)` | `doc_(...)` | `src_(...)` when trying to access the `any_changed` output.
+        if: steps.changed-files-yaml.outputs.test_any_changed == 'true'  
+        env:
+          TEST_ALL_CHANGED_FILES: ${{ steps.changed-files-yaml.outputs.test_all_changed_files }}
+        run: |
+          echo "One or more test file(s) has changed."
+          echo "List all the files that have changed: $TEST_ALL_CHANGED_FILES"
+
+      - name: Run step if doc file(s) change
+        if: steps.changed-files-yaml.outputs.doc_any_changed == 'true'
+        env:
+          DOC_ALL_CHANGED_FILES: ${{ steps.changed-files-yaml.outputs.doc_all_changed_files }}
+        run: |
+          echo "One or more doc file(s) has changed."
+          echo "List all the files that have changed: $DOC_ALL_CHANGED_FILES"
+
+      # -----------------------------------------------------------------------------------------------------------
+      # Example 4
+      # -----------------------------------------------------------------------------------------------------------
+      - name: Get changed files in the docs folder
+        id: changed-files-specific
+        uses: tj-actions/changed-files@v45
+        with:
+          files: docs/*.{js,html}  # Alternatively using: `docs/**`
+          files_ignore: docs/static.js
+
+      - name: Run step if any file(s) in the docs folder change
+        if: steps.changed-files-specific.outputs.any_changed == 'true'
+        env:
+          ALL_CHANGED_FILES: ${{ steps.changed-files-specific.outputs.all_changed_files }}
+        run: |
+          echo "One or more files in the docs folder has changed."
+          echo "List all the files that have changed: $ALL_CHANGED_FILES"