GHSA-qmg3-hpqr-gqvc Multiple Reviewdog actions were compromised during a specific time period

• GitHub Actions reviewdog/action-setup: 1 (no fix yet)

Summary `reviewdog/action-setup@v1` was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` would also be compromised, regardless of version or pinning method: • reviewdog/action-shellcheck • reviewdog/action-composite-template • reviewdog/action-staticcheck • reviewdog/action-ast-grep • reviewdog/action-typos Details Malicious commit: https://github.com/reviewdog/action-setup/commit/f0d342d fix/retag via version upgrade: https://github.com/reviewdog/action-setup/commit/3f401fe See the detailed report from Wiz Research: Wiz Blog Post and reviewdog maintainer annoucement: reviewdog #2079