Skip to content

Remove vulnerable PR-comment artifact pattern - #258

Merged
mashehu merged 1 commit into
devfrom
patch
Jul 27, 2026
Merged

Remove vulnerable PR-comment artifact pattern#258
mashehu merged 1 commit into
devfrom
patch

Conversation

@mashehu

@mashehu mashehu commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Security patch

This PR applies a security fix included in nf-core/tools 4.0.3 for a potential exploit in the GitHub Actions workflows that post comments on pull requests.

For details, see the related security advisory: https://nf-co.re/advisories/pr-comment-workflow-vulnerability

The fix must be merged into the default branch to take effect. Please merge this PR as soon as possible.

These changes only affect CI workflows, so merging them into the default branch does not require a new pipeline release.

These files conflicted with the patch and were reset wholesale to the nf-core/tools 4.0.3 template version, on the basis that they carry no pipeline-specific content. If this branch had local edits in them, those edits are gone — please review: .github/workflows/branch.yml .github/workflows/template-version-comment.yml
@nf-core-bot

Copy link
Copy Markdown
Member

Warning

Newer version of the nf-core template is available.

Your pipeline is using an old version of the nf-core template: 3.2.0.
Please update your pipeline to the latest version.

For more documentation on how to update your pipeline, please see the nf-core documentation and Synchronisation documentation.

@mashehu
mashehu merged commit ee174c2 into dev Jul 27, 2026
4 of 13 checks passed
@mashehu
mashehu deleted the patch branch July 27, 2026 14:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants