<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>Thank you for the clear and concise explanation.<br>
</p>
<pre class="moz-signature" cols="72">--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
<div class="moz-cite-prefix">On 3/20/2025 8:42 AM, Ondřej Surý
wrote:<br>
</div>
<blockquote type="cite" cite="mid:CE70BEAB-3B7C-4C3D-A65B-B8ED7776B130@isc.org">
<pre><blockquote type="cite" style="color: #007cff;"><pre class="moz-quote-pre" wrap="">On 20. 3. 2025, at 23:12, John Thurston <a class="moz-txt-link-rfc2396E" href="mailto:john.thurston@alaska.gov" moz-do-not-send="true"><john.thurston@alaska.gov></a> wrote:
And since I know that ISC has projects at GitHub, and I suspect that ISC projects would be a big, fat, juicy target for code injection, I feel like I gotta ask . . Is ISC willing to weigh in and say if their projects may have been affected, or if credentials for their projects may have been exposed?
</pre></blockquote><pre class="moz-quote-pre" wrap="">We don't use GitHub as primary platform and we push only public branches to GitHub as read-only mirrors.
I do run some extra checks on GitHub (like CodeQL and SonarCloud because of the integrations), but this was the first time I've ever heard about tj-actions in my life.
Ondrej
--
Ondřej Surý (He/Him)
<a class="moz-txt-link-abbreviated moz-txt-link-freetext" href="mailto:ondrej@isc.org" moz-do-not-send="true">ondrej@isc.org</a>
</pre></pre>
</blockquote>
</body>
</html>