[BUG] Potentially affected by the security issue in changed-files

[wyardley]

Is there an existing issue for this?

• I have searched the existing issues

Does this issue exist in the latest version?

• I'm using the latest release

Describe the bug?

Since this pins to a loose of changed-files and not a specific sha, it may well also be affected by the issue described in
tj-actions/changed-files#2464 and tj-actions/changed-files#2463.

To Reproduce

1. Use this project
2. There is no step 2

What OS are you seeing the problem on?

all, ubuntu-latest or ubuntu-22.04

Expected behavior?

Relevant log output

Has all relevant logs been included?

• I've included all relevant logs

Anything else?

I tested pinning this to a recent sha and don't see any base64 encoded secrets in output. However I think it would probably be smart to pin indirect uses like this, since from what I can see, I don't think users can pin indirect dependencies?

Code of Conduct

• I agree to follow this project's Code of Conduct