From 3efe6589e8d91cef455cdab49493df2e47c0e24a Mon Sep 17 00:00:00 2001
From: Andrei Gherzan <andrei@gherzan.com>
Date: Sun, 18 Oct 2026 19:31:27 +0100
Subject: [PATCH] ci: replace tj-actions/changed-files with a local action

Drop the dependency on tj-actions/changed-files and replace it with a local
composite action. Especially given it was compromised in the past - see
CVE-2025-30066.

The action diffs HEAD^1..HEAD of the PR merge commit that actions/checkout
checks out by default. It fails if HEAD is not a merge commit, so a change to
the checkout ref can't silently diff the wrong range.

With this in place, both of the workflows can share a consistent list of paths.

Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
---
 .github/actions/changed-files/action.yml | 52 ++++++++++++++++++++++++
 .github/workflows/yocto-builds.yml       | 17 +-------
 .github/workflows/yocto-layer.yml        | 18 +-------
 3 files changed, 56 insertions(+), 31 deletions(-)
 create mode 100644 .github/actions/changed-files/action.yml

diff --git a/.github/actions/changed-files/action.yml b/.github/actions/changed-files/action.yml
new file mode 100644
index 0000000..f36ccdd
--- /dev/null
+++ b/.github/actions/changed-files/action.yml
@@ -0,0 +1,52 @@
+# SPDX-FileCopyrightText: Andrei Gherzan <andrei@gherzan.com>
+#
+# SPDX-License-Identifier: MIT
+
+name: "Check for changes relevant to Yocto builds"
+
+outputs:
+  any_changed:
+    description: "'true' if the PR touches a file relevant to Yocto builds"
+    value: ${{ steps.check.outputs.any_changed }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check for changes relevant to Yocto builds
+      id: check
+      shell: bash
+      # actions/checkout checks out the PR merge commit, so HEAD^1 is the
+      # base branch tip and HEAD^1..HEAD is exactly the PR's change set.
+      run: |
+        git rev-parse -q --verify HEAD^2 >/dev/null ||
+          { echo "HEAD is not a PR merge commit"; exit 1; }
+
+        # Globs as in [[ == ]], where '*' also matches '/'.
+        patterns=(
+          '.github/actions/*'
+          '.github/workflows/docker-images/yocto-builder/*'
+          '.github/workflows/docker-images/*.sh'
+          '.github/workflows/yocto-builds.yml'
+          '.github/workflows/yocto-layer.yml'
+          'classes/*'
+          'conf/*'
+          'dynamic-layers/*'
+          'files/*'
+          'lib/*'
+          'recipes-*'
+          'wic/*'
+        )
+
+        files="$(git diff --no-renames --name-only HEAD^1 HEAD)"
+        any_changed=false
+        while read -r f; do
+          for p in "${patterns[@]}"; do
+            # shellcheck disable=SC2053
+            if [[ $f == $p ]]; then
+              echo "Relevant change: $f"
+              any_changed=true
+              break 2
+            fi
+          done
+        done <<< "$files"
+        echo "any_changed=$any_changed" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/yocto-builds.yml b/.github/workflows/yocto-builds.yml
index 997af5c..43e60e3 100644
--- a/.github/workflows/yocto-builds.yml
+++ b/.github/workflows/yocto-builds.yml
@@ -35,22 +35,9 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      - name: Define Yocto build files
+      - name: Check for Yocto relevant changes
         id: changed-files-specific
-        uses: tj-actions/changed-files@v24
-        with:
-          files: |
-            .github/actions/**
-            .github/workflows/docker-images/yocto-builder/**
-            .github/workflows/docker-images/*.sh
-            .github/workflows/yocto-builds.yml
-            classes/**
-            conf/**
-            dynamic-layers/**
-            files/**
-            lib/**
-            recipes-**
-            wic/**
+        uses: ./.github/actions/changed-files
       - name: Build a temporary yocto-builder image
         uses: ./.github/actions/docker-build
         with:
diff --git a/.github/workflows/yocto-layer.yml b/.github/workflows/yocto-layer.yml
index 69ee81c..109548f 100644
--- a/.github/workflows/yocto-layer.yml
+++ b/.github/workflows/yocto-layer.yml
@@ -18,23 +18,9 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      - name: Define Yocto build files
+      - name: Check for Yocto relevant changes
         id: changed-files-specific
-        uses: tj-actions/changed-files@v24
-        with:
-          files: |
-            .github/actions/**
-            .github/workflows/docker-images/yocto-builder/**
-            .github/workflows/docker-images/*.sh
-            .github/workflows/yocto-builds.yml
-            .github/workflows/yocto-layer.yml
-            classes/**
-            conf/**
-            dynamic-layers/**
-            files/**
-            lib/**
-            recipes-**
-            wic/**
+        uses: ./.github/actions/changed-files
       - name: Build a temporary yocto-builder image
         uses: ./.github/actions/docker-build
         with: