New GitHub Action supply chain attack: reviewdog/action-setup

**Executive summary:** Wiz Research identified a chain of supply-chain compromises affecting reviewdog/action-setup@v1 and tj-actions/changed-files that injected base64-encoded malicious payloads into CI install scripts, causing workflow logs to expose repository secrets (publicly visible for public repos) and enabling attempts to compromise downstream repositories including a targeted attempt against Coinbase; the issue has been assigned CVE-2025-30154 and guidance for detection, rotation of secrets, and hardening (hash-pinning actions, allow-listing) is provided.