Skip to content

Remove vulnerable PR-comment artifact pattern - #89

Merged
mashehu merged 1 commit into
masterfrom
patch
Jul 24, 2026
Merged

Remove vulnerable PR-comment artifact pattern#89
mashehu merged 1 commit into
masterfrom
patch

Conversation

@mashehu

@mashehu mashehu commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Security patch

This PR applies a security fix included in nf-core/tools 4.0.3 for a potential exploit in the GitHub Actions workflows that post comments on pull requests.

For details, see the related security advisory: https://nf-co.re/advisories/pr-comment-workflow-vulnerability

The fix must be merged into the default branch to take effect. Please merge this PR as soon as possible.

These changes only affect CI workflows, so merging them into the default branch does not require a new pipeline release.

@nf-core-bot

nf-core-bot commented Jul 24, 2026

Copy link
Copy Markdown
Member

Warning

Newer version of the nf-core template is available.

Your pipeline is using an old version of the nf-core template: 4.0.2.
Please update your pipeline to the latest version.

For more documentation on how to update your pipeline, please see the Synchronisation documentation.

@github-actions

github-actions Bot commented Jul 24, 2026

Copy link
Copy Markdown

nf-core pipelines lint overall result: Passed ✅ ⚠️

Posted for pipeline commit e7ac0bc

+| ✅ 233 tests passed       |+
#| ❔  14 tests were ignored |#
!| ❗   8 tests had warnings |!
Details

❗ Test warnings:

  • pipeline_todos - TODO string in awsfulltest.yml: You can customise AWS full pipeline tests as required
  • pipeline_todos - TODO string in nextflow.config: Specify any additional parameters here
  • pipeline_todos - TODO string in CONTRIBUTING.md: Add any pipeline specific contribution guidelines here, such as coding styles, procedures, checklists etc.
  • pipeline_todos - TODO string in base.config: Check the defaults for all processes
  • pipeline_todos - TODO string in methods_description_template.yml: #Update the HTML below to your preferred methods description, e.g. add publication citation for this pipeline
  • pipeline_if_empty_null - ifEmpty(null) found in /home/runner/work/rnadnavar/rnadnavar/lint_results.md: _* pipeline_if_empty_null - No ifEmpty(null) strings found
    _
  • schema_lint - Input mimetype is missing or empty
  • included_configs - Pipeline config does not include custom configs. Please add the includeConfig line.

❔ Tests ignored:

  • files_exist - File is ignored: conf/modules.config
  • files_exist - File is ignored: conf/test.config
  • files_exist - File is ignored: conf/test_full.config
  • files_exist - File is ignored: .github/workflows/linting_comment.yml
  • files_unchanged - File ignored due to lint config: LICENSE or LICENSE.md or LICENCE or LICENCE.md
  • files_unchanged - File ignored due to lint config: .github/workflows/branch.yml
  • files_unchanged - File does not exist: .github/workflows/linting_comment.yml
  • files_unchanged - File ignored due to lint config: .github/workflows/linting.yml
  • files_unchanged - File ignored due to lint config: assets/nf-core-rnadnavar_logo_light.png
  • files_unchanged - File ignored due to lint config: docs/images/nf-core-rnadnavar_logo_light.png
  • files_unchanged - File ignored due to lint config: docs/images/nf-core-rnadnavar_logo_dark.png
  • files_unchanged - File ignored due to lint config: .gitignore or .prettierignore
  • template_strings - template_strings
  • modules_config - modules_config

✅ Tests passed:

Run details

  • nf-core/tools version 4.0.2
  • Run at 2026-07-24 14:34:43

@mashehu
mashehu merged commit 4aed72d into master Jul 24, 2026
39 checks passed
@mashehu
mashehu deleted the patch branch July 24, 2026 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@FriederikeHanssen FriederikeHanssen FriederikeHanssen approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mashehu @nf-core-bot @FriederikeHanssen