The tj-actions/changed-files GitHub Action has been compromised, raising serious concerns about the security of third-party dependencies in software development. Users express frustrations over the lack of immutability for GitHub Actions, suggesting that specifying commit hashes or using lockfiles could enhance security. There are ongoing discussions about trust issues with third-party tools and libraries, with some developers opting to avoid them altogether. Suggestions for improving security practices include using semantic versioning and implementing lockfiles to prevent rapid propagation of compromised Actions. The incident illustrates a broader issue with maintaining integrity in CI/CD pipelines and managing dependencies, especially given the rise in reports of malicious code being injected into popular packages and extensions.