potiuk opened a new issue, #846: URL: https://github.com/apache/linkis-website/issues/846
Heads-up from ASF Infra. `.github/workflows/auto-comment.yml` uses `actions-cool/issues-helper@v3`. **What happened.** On 2026-05-18 every tag of `actions-cool/issues-helper` was repointed to an imposter commit that harvests and exfiltrates CI/CD secrets ([StepSecurity advisory](https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials)); GitHub TOS-blocked the repo on 2026-05-19, so `@v3` no longer resolves. **No exposure here.** This workflow's last run was 2025-06-10 -- it did **not** run during the compromise window, so no secrets were exposed. **Action needed.** The reference is dead; please remove it or swap to `actions/github-script` (always-allowed `actions/*` namespace, no allow-list change needed). Happy to send a PR. Also removed from the ASF allow list in apache/infrastructure-actions#1035. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
