Skip to content

Remove vulnerable PR-comment artifact pattern - #28

Merged
mashehu merged 1 commit into
devfrom
patch
Jul 28, 2026
Merged

Remove vulnerable PR-comment artifact pattern#28
mashehu merged 1 commit into
devfrom
patch

Conversation

@mashehu

@mashehu mashehu commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Security patch

This PR applies a security fix included in nf-core/tools 4.0.3 for a potential exploit in the GitHub Actions workflows that post comments on pull requests.

For details, see the related security advisory: https://nf-co.re/advisories/pr-comment-workflow-vulnerability

The fix must be merged into the default branch to take effect. Please merge this PR as soon as possible.

These changes only affect CI workflows, so merging them into the default branch does not require a new pipeline release.

Note on how this patch was produced

This pipeline's TEMPLATE branch has not received the nf-core/tools 4.0.3 sync, so the change could not be generated from it. It was taken from nf-core/abotyper's TEMPLATE branch instead, with the repository identity in branch.yml rewritten for this pipeline — the only pipeline-specific content the template renders into any of these workflow files. Syncing the template separately is still worth doing, but does not block this fix.

This pipeline's TEMPLATE branch never received the nf-core/tools 4.0.3 sync, so the patch was taken from nf-core/abotyper's TEMPLATE branch with the repository identity in branch.yml rewritten for this pipeline. That identity is the only pipeline-specific content the template renders into any of the patched workflows, so this is the same change this pipeline's own sync would have produced — but the substituted source is worth a look.

These files conflicted with the patch and were reset wholesale to the nf-core/tools 4.0.3 template version, on the basis that they carry no pipeline-specific content. If this branch had local edits in them, those edits are gone — please review: .github/workflows/branch.yml
@github-actions

Copy link
Copy Markdown

Python linting (black) is failing

To keep the code consistent with lots of contributors, we run automated code consistency checks.
To fix this CI test, please run:

  • Install black: pip install black
  • Fix formatting errors in your pipeline: black .

Once you push these changes the test should pass, and you can hide this comment 👍

We highly recommend setting up Black in your code editor so that this formatting is done automatically on save. Ask about it on Slack for help!

Thanks again for your contribution!

@mashehu
mashehu merged commit d3d80e6 into dev Jul 28, 2026
1 of 7 checks passed
@mashehu
mashehu deleted the patch branch July 28, 2026 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants