Repository Workflow Actions will be Blocked on 7 April [SecEng]

The following actions in your repository's workflows will be blocked by an org-wide policy from 7 April 2025, 10 AM: This will cause the workflow to fail. This is to mitigate supply chain attacks as seen in the recent [`tj-actions/changed-files` incident](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised). To remedy this, either: * Vendorize the action by forking it into opengovsg - we've already forked `opengovsg/dotenv` and `opengovsg/add-pr-comment` for your convenience; * Use a Git commit hash instead of version tag; * Use an official GitHub or [verified](https://docs.github.com/en/apps/github-marketplace/github-marketplace-overview/about-marketplace-badges) Action This is because the policy only allows: * Internal Actions (e.g. `opengovsg/...@v1`) * Official GitHub Actions (e.g. `actions/checkout@v4`, `github/...@v4`) * GitHub Marketplace Actions by verified creators (e.g. `aws-actions/configure-aws-credentials@v4`) * Hash-pinned Actions (e.g. `untrusted/...@614e28a...`) This is an automated message by Security Engineers via a Organisation GitHub app. If you have more questions, please contact Security Engineers.