Skip to content

Remove vulnerable PR-comment artifact pattern - #88

Merged
mashehu merged 1 commit into
devfrom
patch
Jul 28, 2026
Merged

mashehu merged 1 commit into
devfrom
patch

Conversation

@mashehu

@mashehu mashehu commented Jul 28, 2026

Copy link
Copy Markdown

Security patch

This PR applies a security fix included in nf-core/tools 4.0.3 for a potential exploit in the GitHub Actions workflows that post comments on pull requests.

For details, see the related security advisory: https://nf-co.re/advisories/pr-comment-workflow-vulnerability

The fix must be merged into the default branch to take effect. Please merge this PR as soon as possible.

These changes only affect CI workflows, so merging them into the default branch does not require a new pipeline release.

Automated security rollout could not apply this cleanly. Resolve the
remaining conflict markers and *.rej files, then open a PR from 'patch'
into 'dev'.

Patch source: this pipeline's TEMPLATE branch never received the
nf-core/tools 4.0.3 sync, so the change was taken from
nf-core/abotyper's TEMPLATE with the repository identity in branch.yml
rewritten for this pipeline. While resolving, check that no file ended
up naming nf-core/abotyper.

Note: these files had their conflicts resolved for you, by resetting
them wholesale to the nf-core/tools 4.0.3 template version — so they
carry no markers even though they conflicted. Review them:
.github/workflows/branch.yml
.github/workflows/template-version-comment.yml
@nf-core-bot

Copy link
Copy Markdown
Member

Warning

Newer version of the nf-core template is available.

Your pipeline is using an old version of the nf-core template: 3.2.0.
Please update your pipeline to the latest version.

For more documentation on how to update your pipeline, please see the nf-core documentation and Synchronisation documentation.

@mashehu
mashehu merged commit ff1b23f into dev Jul 28, 2026
4 of 7 checks passed
@mashehu
mashehu deleted the patch branch July 28, 2026 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants