Skip to content

Remove vulnerable PR-comment artifact pattern - #128

Merged
daisymut merged 1 commit into
devfrom
patch
Jul 28, 2026
Merged

Remove vulnerable PR-comment artifact pattern#128
daisymut merged 1 commit into
devfrom
patch

Conversation

@mashehu

@mashehu mashehu commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Security patch

This PR applies a security fix included in nf-core/tools 4.0.3 for a potential exploit in the GitHub Actions workflows that post comments on pull requests.

For details, see the related security advisory: https://nf-co.re/advisories/pr-comment-workflow-vulnerability

The fix must be merged into the default branch to take effect. Please merge this PR as soon as possible.

These changes only affect CI workflows, so merging them into the default branch does not require a new pipeline release.

@nf-core-bot
Remove vulnerable PR-comment artifact pattern
e40a61f 
These files conflicted with the patch and were reset wholesale to the nf-core/tools 4.0.3 template version, on the basis that they carry no pipeline-specific content. If this branch had local edits in them, those edits are gone — please review: .github/workflows/branch.yml .github/workflows/template-version-comment.yml
@nf-core-bot

nf-core-bot commented Jul 27, 2026

Copy link
Copy Markdown
Member

Warning

Newer version of the nf-core template is available.

Your pipeline is using an old version of the nf-core template: 3.4.1.
Please update your pipeline to the latest version.

For more documentation on how to update your pipeline, please see the nf-core documentation and Synchronisation documentation.

@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown

nf-core pipelines lint overall result: Passed ✅ ⚠️

Posted for pipeline commit e40a61f

+| ✅ 213 tests passed       |+
#| ❔   4 tests were ignored |#
!| ❗   8 tests had warnings |!
Details

❗ Test warnings:

  • readme - README contains the placeholder zenodo.XXXXXXX. This should be replaced with the zenodo doi (after the first release).
  • pipeline_todos - TODO string in main.nf.test: Once you have added the required tests, please run the following command to build this file:
  • pipeline_todos - TODO string in nextflow.config: Specify any additional parameters here
  • pipeline_todos - TODO string in main.nf: Optionally add in-text citation tools to this list.
  • pipeline_todos - TODO string in main.nf: Optionally add bibliographic entries to this list.
  • pipeline_todos - TODO string in main.nf: Only uncomment below if logic in toolCitationText/toolBibliographyText has been filled!
  • pipeline_todos - TODO string in test_full.config: Specify the paths to your full test data ( on nf-core/test-datasets or directly in repositories, e.g. SRA)
  • pipeline_todos - TODO string in methods_description_template.yml: #Update the HTML below to your preferred methods description, e.g. add publication citation for this pipeline

❔ Tests ignored:

  • files_exist - File is ignored: .github/workflows/linting_comment.yml
  • files_unchanged - File ignored due to lint config: .github/workflows/branch.yml
  • files_unchanged - File does not exist: .github/workflows/linting_comment.yml
  • files_unchanged - File ignored due to lint config: .github/workflows/linting.yml

✅ Tests passed:

Run details

  • nf-core/tools version 3.4.1
  • Run at 2026-07-27 17:38:58

daisymut
daisymut approved these changes Jul 28, 2026
View reviewed changes

@daisymut daisymut left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Y

@daisymut
daisymut merged commit d240748 into dev Jul 28, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@daisymut daisymut daisymut approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mashehu @nf-core-bot @daisymut