Remove vulnerable PR-comment artifact pattern

[mashehu]

Security patch

This PR applies a security fix included in nf-core/tools 4.0.3 for a potential exploit in the GitHub Actions workflows that post comments on pull requests.

For details, see the related security advisory: https://nf-co.re/advisories/pr-comment-workflow-vulnerability

The fix must be merged into the default branch to take effect. Please merge this PR as soon as possible.

These changes only affect CI workflows, so merging them into the default branch does not require a new pipeline release.

[nf-core-bot]

Warning

Newer version of the nf-core template is available.

Your pipeline is using an old version of the nf-core template: 4.0.2.
Please update your pipeline to the latest version.

For more documentation on how to update your pipeline, please see the Synchronisation documentation.

[github-actions]

nf-core pipelines lint overall result: Passed ✅ ⚠️

Posted for pipeline commit f00aebf

+| ✅ 248 tests passed       |+
#| ❔  12 tests were ignored |#
!| ❗   4 tests had warnings |!

Details

❗ Test warnings:

• nextflow_config - Config manifest.version should end in dev: 1.0.0
• readme - README contains the placeholder zenodo.XXXXXXX. This should be replaced with the zenodo doi (after the first release).
• pipeline_todos - TODO string in README.md: Add citation for pipeline after first release. Uncomment lines below and update Zenodo doi and badge at the top of this file.
• pipeline_todos - TODO string in nextflow.config: Specify any additional parameters here

❔ Tests ignored:

• files_exist - File is ignored: conf/igenomes.config
• files_exist - File is ignored: conf/igenomes_ignored.config
• files_exist - File is ignored: .github/workflows/linting_comment.yml
• nextflow_config - Config variable ignored: params.input
• files_unchanged - File ignored due to lint config: .github/PULL_REQUEST_TEMPLATE.md
• files_unchanged - File ignored due to lint config: .github/workflows/branch.yml
• files_unchanged - File does not exist: .github/workflows/linting_comment.yml
• files_unchanged - File ignored due to lint config: .github/workflows/linting.yml
• files_unchanged - File ignored due to lint config: assets/nf-core-seqsubmit_logo_light.png
• files_unchanged - File ignored due to lint config: docs/images/nf-core-seqsubmit_logo_light.png
• files_unchanged - File ignored due to lint config: docs/images/nf-core-seqsubmit_logo_dark.png
• container_configs - container_configs

✅ Tests passed:

• files_exist - File found: .gitattributes
• files_exist - File found: .gitignore
• files_exist - File found: .nf-core.yml
• files_exist - File found: .prettierignore
• files_exist - File found: .prettierrc.yml
• files_exist - File found: CHANGELOG.md
• files_exist - File found: CITATIONS.md
• files_exist - File found: CODE_OF_CONDUCT.md
• files_exist - File found: LICENSE or LICENSE.md or LICENCE or LICENCE.md
• files_exist - File found: nextflow_schema.json
• files_exist - File found: nextflow.config
• files_exist - File found: README.md
• files_exist - File found: .github/.dockstore.yml
• files_exist - File found: .github/ISSUE_TEMPLATE/bug_report.yml
• files_exist - File found: .github/ISSUE_TEMPLATE/config.yml
• files_exist - File found: .github/ISSUE_TEMPLATE/feature_request.yml
• files_exist - File found: .github/PULL_REQUEST_TEMPLATE.md
• files_exist - File found: .github/workflows/branch.yml
• files_exist - File found: .github/workflows/nf-test.yml
• files_exist - File found: .github/actions/get-shards/action.yml
• files_exist - File found: .github/actions/nf-test/action.yml
• files_exist - File found: .github/workflows/linting.yml
• files_exist - File found: assets/email_template.html
• files_exist - File found: assets/email_template.txt
• files_exist - File found: assets/sendmail_template.txt
• files_exist - File found: assets/nf-core-seqsubmit_logo_light.png
• files_exist - File found: conf/modules.config
• files_exist - File found: conf/test.config
• files_exist - File found: conf/test_full.config
• files_exist - File found: docs/CONTRIBUTING.md
• files_exist - File found: docs/images/nf-core-seqsubmit_logo_light.png
• files_exist - File found: docs/images/nf-core-seqsubmit_logo_dark.png
• files_exist - File found: docs/output.md
• files_exist - File found: docs/README.md
• files_exist - File found: docs/README.md
• files_exist - File found: docs/usage.md
• files_exist - File found: nf-test.config
• files_exist - File found: tests/default.nf.test
• files_exist - File found: main.nf
• files_exist - File found: assets/multiqc_config.yml
• files_exist - File found: conf/base.config
• files_exist - File found: .github/workflows/awstest.yml
• files_exist - File found: .github/workflows/awsfulltest.yml
• files_exist - File found: modules.json
• files_exist - File found: ro-crate-metadata.json
• files_exist - File not found check: .github/ISSUE_TEMPLATE/bug_report.md
• files_exist - File not found check: .github/ISSUE_TEMPLATE/feature_request.md
• files_exist - File not found check: .github/workflows/push_dockerhub.yml
• files_exist - File not found check: .markdownlint.yml
• files_exist - File not found check: .nf-core.yaml
• files_exist - File not found check: .yamllint.yml
• files_exist - File not found check: bin/markdown_to_html.r
• files_exist - File not found check: conf/aws.config
• files_exist - File not found check: docs/images/nf-core-seqsubmit_logo.png
• files_exist - File not found check: lib/Checks.groovy
• files_exist - File not found check: lib/Completion.groovy
• files_exist - File not found check: lib/NfcoreTemplate.groovy
• files_exist - File not found check: lib/Utils.groovy
• files_exist - File not found check: lib/Workflow.groovy
• files_exist - File not found check: lib/WorkflowMain.groovy
• files_exist - File not found check: lib/WorkflowSeqsubmit.groovy
• files_exist - File not found check: parameters.settings.json
• files_exist - File not found check: pipeline_template.yml
• files_exist - File not found check: Singularity
• files_exist - File not found check: lib/nfcore_external_java_deps.jar
• files_exist - File not found check: .travis.yml
• nextflow_config - Found nf-schema plugin
• nextflow_config - Config variable found: manifest.name
• nextflow_config - Config variable found: manifest.nextflowVersion
• nextflow_config - Config variable found: manifest.description
• nextflow_config - Config variable found: manifest.version
• nextflow_config - Config variable found: manifest.homePage
• nextflow_config - Config variable found: timeline.enabled
• nextflow_config - Config variable found: trace.enabled
• nextflow_config - Config variable found: report.enabled
• nextflow_config - Config variable found: dag.enabled
• nextflow_config - Config variable found: process.cpus
• nextflow_config - Config variable found: process.memory
• nextflow_config - Config variable found: process.time
• nextflow_config - Config variable found: params.outdir
• nextflow_config - Config variable found: manifest.mainScript
• nextflow_config - Config variable found: timeline.file
• nextflow_config - Config variable found: trace.file
• nextflow_config - Config variable found: report.file
• nextflow_config - Config variable found: dag.file
• nextflow_config - Config variable (correctly) not found: params.nf_required_version
• nextflow_config - Config variable (correctly) not found: params.container
• nextflow_config - Config variable (correctly) not found: params.singleEnd
• nextflow_config - Config variable (correctly) not found: params.igenomesIgnore
• nextflow_config - Config variable (correctly) not found: params.name
• nextflow_config - Config variable (correctly) not found: params.enable_conda
• nextflow_config - Config variable (correctly) not found: params.max_cpus
• nextflow_config - Config variable (correctly) not found: params.max_memory
• nextflow_config - Config variable (correctly) not found: params.max_time
• nextflow_config - Config variable (correctly) not found: params.validationFailUnrecognisedParams
• nextflow_config - Config variable (correctly) not found: params.validationLenientMode
• nextflow_config - Config variable (correctly) not found: params.validationSchemaIgnoreParams
• nextflow_config - Config variable (correctly) not found: params.validationShowHiddenParams
• nextflow_config - Config variable (correctly) not found: validation.failUnrecognisedParams
• nextflow_config - Config variable (correctly) not found: validation.failUnrecognisedHeaders
• nextflow_config - Config timeline.enabled had correct value: true
• nextflow_config - Config report.enabled had correct value: true
• nextflow_config - Config trace.enabled had correct value: true
• nextflow_config - Config dag.enabled had correct value: true
• nextflow_config - Config manifest.name began with nf-core/
• nextflow_config - Config variable manifest.homePage began with https://github.com/nf-core/
• nextflow_config - Config dag.file ended with .html
• nextflow_config - Config variable manifest.nextflowVersion started with >= or !>=
• nextflow_config - Config params.custom_config_version is set to master
• nextflow_config - Config params.custom_config_base is set to https://raw.githubusercontent.com/nf-core/configs/master
• nextflow_config - Lines for loading custom profiles found
• nextflow_config - nextflow.config contains configuration profile test
• nextflow_config - Config default value correct: params.rrna_limit= 80.0
• nextflow_config - Config default value correct: params.trna_limit= 18.0
• nextflow_config - Config default value correct: params.cat_db_download_id= nr
• nextflow_config - Config default value correct: params.checkm2_db_download_id= 14897628
• nextflow_config - Config default value correct: params.custom_config_version= master
• nextflow_config - Config default value correct: params.custom_config_base= https://raw.githubusercontent.com/nf-core/configs/master
• nextflow_config - Config default value correct: params.publish_dir_mode= copy
• nextflow_config - Config default value correct: params.max_multiqc_email_size= 25.MB
• nextflow_config - Config default value correct: params.validate_params= true
• nextflow_config - Config default value correct: params.pipelines_testdata_base_path= https://raw.githubusercontent.com/nf-core/test-datasets/
• nextflow_config - Config default value correct: params.upload_tpa= false
• nextflow_config - Config default value correct: params.test_upload= true
• nextflow_config - Config default value correct: params.is_private= false
• nextflow_config - Config default value correct: params.webincli_mode= submit
• nf_test_content - 'tests/reads_paired_end.nf.test' contains outdir parameter
• nf_test_content - 'tests/reads_paired_end.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/reads_paired_end.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_no_study_complete_metadata.nf.test' contains outdir parameter
• nf_test_content - 'tests/assembly_no_study_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_no_study_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_one_contig.nf.test' contains outdir parameter
• nf_test_content - 'tests/mag_one_contig.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_one_contig.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_coverage_single_reads.nf.test' contains outdir parameter
• nf_test_content - 'tests/mag_no_coverage_single_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_coverage_single_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_complete_metadata.nf.test' contains outdir parameter
• nf_test_content - 'tests/assembly_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_coverage_paired_reads.nf.test' contains outdir parameter
• nf_test_content - 'tests/mag_no_coverage_paired_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_coverage_paired_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_rna_presence.nf.test' contains outdir parameter
• nf_test_content - 'tests/mag_no_rna_presence.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_rna_presence.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/default.nf.test' contains outdir parameter
• nf_test_content - 'tests/default.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/default.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_study_complete_metadata.nf.test' contains outdir parameter
• nf_test_content - 'tests/mag_no_study_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_study_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_no_coverage_single_reads.nf.test' contains outdir parameter
• nf_test_content - 'tests/assembly_no_coverage_single_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_no_coverage_single_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_no_coverage_paired_reads.nf.test' contains outdir parameter
• nf_test_content - 'tests/assembly_no_coverage_paired_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_no_coverage_paired_reads.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_complete_metadata.nf.test' contains outdir parameter
• nf_test_content - 'tests/mag_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_complete_metadata.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_taxonomy.nf.test' contains outdir parameter
• nf_test_content - 'tests/mag_no_taxonomy.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/mag_no_taxonomy.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_one_contig.nf.test' contains outdir parameter
• nf_test_content - 'tests/assembly_one_contig.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/assembly_one_contig.nf.test' snapshots a 'versions.yml' file
• nf_test_content - 'tests/nextflow.config' contains modules_testdata_base_path
• nf_test_content - 'tests/nextflow.config' contains pipelines_testdata_base_path
• nf_test_content - 'nf-test.config' sets a testsDir
• nf_test_content - 'nf-test.config' sets a workDir
• nf_test_content - 'nf-test.config' sets a configFile
• files_unchanged - .gitattributes matches the template
• files_unchanged - .prettierrc.yml matches the template
• files_unchanged - CODE_OF_CONDUCT.md matches the template
• files_unchanged - LICENSE matches the template
• files_unchanged - .github/.dockstore.yml matches the template
• files_unchanged - .github/ISSUE_TEMPLATE/bug_report.yml matches the template
• files_unchanged - .github/ISSUE_TEMPLATE/config.yml matches the template
• files_unchanged - .github/ISSUE_TEMPLATE/feature_request.yml matches the template
• files_unchanged - assets/email_template.html matches the template
• files_unchanged - assets/email_template.txt matches the template
• files_unchanged - assets/sendmail_template.txt matches the template
• files_unchanged - docs/README.md matches the template
• files_unchanged - .gitignore matches the template
• files_unchanged - .prettierignore matches the template
• actions_nf_test - '.github/workflows/nf-test.yml' is triggered on expected events
• actions_nf_test - '.github/workflows/nf-test.yml' checks minimum NF version
• actions_awstest - '.github/workflows/awstest.yml' is triggered correctly
• actions_awsfulltest - .github/workflows/awsfulltest.yml is triggered correctly
• actions_awsfulltest - .github/workflows/awsfulltest.yml does not use -profile test
• readme - README Nextflow minimum version badge matched config. Badge: 25.10.4, Config: 25.10.4
• readme - README nf-core template version badge found.
• pipeline_if_empty_null - No ifEmpty(null) strings found
• plugin_includes - No wrong validation plugin imports have been found
• pipeline_name_conventions - Name adheres to nf-core convention
• template_strings - Did not find any Jinja template strings (0 files)
• schema_lint - Schema lint passed
• schema_lint - Schema title + description lint passed
• schema_lint - Input mimetype lint passed: 'text/csv'
• schema_params - Schema matched params returned from nextflow config
• system_exit - No System.exit calls found
• actions_schema_validation - Workflow validation passed: fix_linting.yml
• actions_schema_validation - Workflow validation passed: awstest.yml
• actions_schema_validation - Workflow validation passed: clean-up.yml
• actions_schema_validation - Workflow validation passed: awsfulltest.yml
• actions_schema_validation - Workflow validation passed: linting.yml
• actions_schema_validation - Workflow validation passed: branch.yml
• actions_schema_validation - Workflow validation passed: nf-test.yml
• actions_schema_validation - Workflow validation passed: pr-comment.yml
• actions_schema_validation - Workflow validation passed: template-version-comment.yml
• actions_schema_validation - Workflow validation passed: release-announcements.yml
• actions_schema_validation - Workflow validation passed: download_pipeline.yml
• merge_markers - No merge markers found in pipeline files
• modules_json - Only installed modules found in modules.json
• multiqc_config - assets/multiqc_config.yml found and not ignored.
• multiqc_config - assets/multiqc_config.yml contains report_section_order
• multiqc_config - assets/multiqc_config.yml contains export_plots
• multiqc_config - assets/multiqc_config.yml contains report_comment
• multiqc_config - assets/multiqc_config.yml follows the ordering scheme of the minimally required plugins.
• multiqc_config - assets/multiqc_config.yml contains a matching 'report_comment'.
• multiqc_config - assets/multiqc_config.yml contains 'export_plots: true'.
• modules_structure - modules directory structure is correct 'modules/nf-core/TOOL/SUBTOOL'
• local_component_structure - local subworkflows directory structure is correct 'subworkflows/local/TOOL/SUBTOOL'
• base_config - conf/base.config found and not ignored.
• modules_config - conf/modules.config found and not ignored.
• modules_config - FALINT found in conf/modules.config and Nextflow scripts.
• modules_config - CATPACK_ADDNAMES_BINS found in conf/modules.config and Nextflow scripts.
• modules_config - CATPACK_BINS found in conf/modules.config and Nextflow scripts.
• modules_config - CATPACK_PREPARE found in conf/modules.config and Nextflow scripts.
• modules_config - RENAME_FASTA_FOR_CATPACK found in conf/modules.config and Nextflow scripts.
• modules_config - BARRNAP found in conf/modules.config and Nextflow scripts.
• modules_config - TRNASCANSE found in conf/modules.config and Nextflow scripts.
• modules_config - COUNT_RNA found in conf/modules.config and Nextflow scripts.
• modules_config - CHECKM2_PREDICT found in conf/modules.config and Nextflow scripts.
• modules_config - CHECKM2_DATABASEDOWNLOAD found in conf/modules.config and Nextflow scripts.
• modules_config - COVERM_GENOME found in conf/modules.config and Nextflow scripts.
• modules_config - COVERM_CONTIG found in conf/modules.config and Nextflow scripts.
• modules_config - CREATE_ASSEMBLY_METADATA_CSV found in conf/modules.config and Nextflow scripts.
• modules_config - CONCAT_METADATA found in conf/modules.config and Nextflow scripts.
• modules_config - GENOME_UPLOAD found in conf/modules.config and Nextflow scripts.
• modules_config - ENA_WEBIN_CLI_WRAPPER found in conf/modules.config and Nextflow scripts.
• modules_config - REGISTERSTUDY found in conf/modules.config and Nextflow scripts.
• modules_config - MULTIQC found in conf/modules.config and Nextflow scripts.
• nfcore_yml - Repository type in .nf-core.yml is valid: pipeline
• nfcore_yml - nf-core version in .nf-core.yml is set to the latest version: 4.0.2
• rocrate_readme_sync - RO-Crate descriptions are in sync with README.md.

Run details

• nf-core/tools version 4.0.2
• Run at 2026-07-24 14:34:21