arduino-esp32 is using a compromised tj-actions/changed-files GitHub action (CVE-2025-30066)

[eslerm]

arduino-esp32 uses a compromised version of tj-actions/changed-files. The compromised action appears to leak secrets the runner has in memory.

The action is included in:

• https://github.com/espressif/arduino-esp32/blob/2a3de9c41533c0559e7c16ea34f4315e5fc2205d/.github/workflows/push.yml

Output of an affected run:

• https://github.com/espressif/arduino-esp32/actions/runs/13864794849/job/38801411946#step:3:91

Please review.

Learn about the compromise on StepSecurity of Semgrep.

This issue has been assigned CVE-2025-30066

[eslerm]

Note that https://github.com/espressif/pytest-embedded also uses this action.

[me-no-dev]

@eslerm thanks! we are aware and actions are currently disabled

[Jason2866]

Fixed by #11130