tj-actions/changed-files with Falco Actions

**Executive Summary:** The report details a supply-chain compromise of the GitHub Action tj-actions/changed-files (CVE-2025-30066) where an attacker used a stolen Personal Access Token to add a memdump.py payload that reads Runner.Worker memory to extract secrets; it shows how Falco Actions can be integrated into CI/CD workflows to detect memory-dumping activity, capture runtime artifacts, and produce analysis reports for investigation and remediation.