Skip to content

Commit be0f2ed

Browse files
mashehumashehu
authored
Merge pull request #942 from nf-core/patch
Remove vulnerable PR-comment artifact pattern
2 parents 83f2699 + 2c3a474 commit be0f2ed

7 files changed

Lines changed: 234 additions & 72 deletions

File tree

‎.github/workflows/branch.yml‎

Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,45 +2,61 @@ name: nf-core branch protection
22
# This workflow is triggered on PRs to `main`/`master` branch on the repository
33
# It fails when someone tries to make a PR against the nf-core `main`/`master` branch instead of `dev`
44
on:
5-
pull_request_target:
5+
pull_request:
66
branches:
77
- main
88
- master
99

10+
permissions: {}
11+
1012
jobs:
1113
test:
1214
runs-on: ubuntu-latest
1315
steps:
1416
# PRs to the nf-core repo main/master branch are only ok if coming from the nf-core repo `dev` or any `patch` branches
1517
- name: Check PRs
1618
if: github.repository == 'nf-core/raredisease'
19+
env:
20+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
1721
run: |
18-
{ [[ ${{github.event.pull_request.head.repo.full_name }} == nf-core/raredisease ]] && [[ $GITHUB_HEAD_REF == "dev" ]]; } || [[ $GITHUB_HEAD_REF == "patch" ]]
22+
{ [[ "$HEAD_REPO" == nf-core/raredisease ]] && [[ $GITHUB_HEAD_REF == "dev" ]]; } || [[ $GITHUB_HEAD_REF == "patch" ]]
1923
20-
# If the above check failed, post a comment on the PR explaining the failure
21-
# NOTE - this doesn't currently work if the PR is coming from a fork, due to limitations in GitHub actions secrets
22-
- name: Post PR comment
24+
# If the above check failed, build a comment to be posted by the shared poster workflow
25+
- name: Build PR comment
2326
if: failure()
24-
uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
25-
with:
26-
message: |
27-
## This PR is against the `${{github.event.pull_request.base.ref}}` branch :x:
27+
env:
28+
PR_NUMBER: ${{ github.event.pull_request.number }}
29+
BASE_REF: ${{ github.event.pull_request.base.ref }}
30+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
31+
PR_USER: ${{ github.event.pull_request.user.login }}
32+
run: |
33+
mkdir -p pr-comment
34+
echo "$PR_NUMBER" > pr-comment/pr_number.txt
35+
echo "branch" > pr-comment/header.txt
36+
cat > pr-comment/comment.md <<EOF
37+
## This PR is against the \`${BASE_REF}\` branch :x:
2838
29-
* Do not close this PR
30-
* Click _Edit_ and change the `base` to `dev`
31-
* This CI test will remain failed until you push a new commit
39+
* Do not close this PR
40+
* Click _Edit_ and change the \`base\` to \`dev\`
41+
* This CI test will remain failed until you push a new commit
3242
33-
---
43+
---
3444
35-
Hi @${{ github.event.pull_request.user.login }},
45+
Hi @${PR_USER},
3646
37-
It looks like this pull-request is has been made against the [${{github.event.pull_request.head.repo.full_name }}](https://github.com/${{github.event.pull_request.head.repo.full_name }}) ${{github.event.pull_request.base.ref}} branch.
38-
The ${{github.event.pull_request.base.ref}} branch on nf-core repositories should always contain code from the latest release.
39-
Because of this, PRs to ${{github.event.pull_request.base.ref}} are only allowed if they come from the [${{github.event.pull_request.head.repo.full_name }}](https://github.com/${{github.event.pull_request.head.repo.full_name }}) `dev` branch.
47+
It looks like this pull-request is has been made against the [${HEAD_REPO}](https://github.com/${HEAD_REPO}) ${BASE_REF} branch.
48+
The ${BASE_REF} branch on nf-core repositories should always contain code from the latest release.
49+
Because of this, PRs to ${BASE_REF} are only allowed if they come from the [${HEAD_REPO}](https://github.com/${HEAD_REPO}) \`dev\` branch.
4050
41-
You do not need to close this PR, you can change the target branch to `dev` by clicking the _"Edit"_ button at the top of this page.
42-
Note that even after this, the test will continue to show as failing until you push a new commit.
51+
You do not need to close this PR, you can change the target branch to \`dev\` by clicking the _"Edit"_ button at the top of this page.
52+
Note that even after this, the test will continue to show as failing until you push a new commit.
4353
44-
Thanks again for your contribution!
45-
repo-token: ${{ secrets.GITHUB_TOKEN }}
46-
allow-repeats: false
54+
Thanks again for your contribution!
55+
EOF
56+
57+
- name: Upload PR comment artifact
58+
if: failure()
59+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
60+
with:
61+
name: pr-comment
62+
path: pr-comment/

‎.github/workflows/linting.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,3 +78,21 @@ jobs:
7878
lint_log.txt
7979
lint_results.md
8080
PR_number.txt
81+
82+
# Build a comment for the shared pr-comment.yml poster to publish on the PR
83+
- name: Prepare PR comment
84+
if: ${{ always() }}
85+
env:
86+
PR_NUMBER: ${{ github.event.pull_request.number }}
87+
run: |
88+
mkdir -p pr-comment
89+
echo "$PR_NUMBER" > pr-comment/pr_number.txt
90+
echo "lint" > pr-comment/header.txt
91+
[ -f lint_results.md ] && cp lint_results.md pr-comment/comment.md || true
92+
93+
- name: Upload PR comment artifact
94+
if: ${{ always() }}
95+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
96+
with:
97+
name: pr-comment
98+
path: pr-comment/

‎.github/workflows/linting_comment.yml‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎.github/workflows/nf-test.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,22 @@ jobs:
122122
fi
123123
fi
124124
125+
# continue-on-error keeps latest-everything from failing the job, so it never shows up in
126+
# `needs.nf-test.result` downstream and CI stays green. Surface it via a PR comment instead;
127+
# other NXF_VER failures already fail the job/CI directly, so no comment is needed for those.
128+
- name: Prepare PR comment fragment
129+
if: ${{ always() && steps.run_nf_test.outcome == 'failure' && matrix.NXF_VER == 'latest-everything' }}
130+
run: |
131+
mkdir -p pr-comment-fragment
132+
echo "* ❌ \`${{ matrix.profile }}\` | \`${{ matrix.NXF_VER }}\` | Shard ${{ matrix.shard }}/${{ env.TOTAL_SHARDS }}" > pr-comment-fragment/fragment.md
133+
134+
- name: Upload PR comment fragment
135+
if: ${{ always() && steps.run_nf_test.outcome == 'failure' && matrix.NXF_VER == 'latest-everything' }}
136+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
137+
with:
138+
name: pr-comment-fragment-${{ strategy.job-index }}
139+
path: pr-comment-fragment/
140+
125141
confirm-pass:
126142
needs: [nf-test]
127143
if: always()
@@ -148,3 +164,44 @@ jobs:
148164
echo "DEBUG: toJSON(needs) = ${{ toJSON(needs) }}"
149165
echo "DEBUG: toJSON(needs.*.result) = ${{ toJSON(needs.*.result) }}"
150166
echo "::endgroup::"
167+
168+
- name: Download PR comment fragments
169+
if: ${{ always() }}
170+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
171+
continue-on-error: true
172+
with:
173+
pattern: pr-comment-fragment-*
174+
path: pr-comment-fragments
175+
merge-multiple: true
176+
177+
# Build a comment for the shared pr-comment.yml poster to publish on the PR.
178+
# Based on the fragments above (not needs.*.result) so non-blocking failures are still reported.
179+
- name: Prepare PR comment
180+
if: ${{ always() }}
181+
env:
182+
PR_NUMBER: ${{ github.event.pull_request.number }}
183+
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
184+
run: |
185+
mkdir -p pr-comment
186+
echo "$PR_NUMBER" > pr-comment/pr_number.txt
187+
echo "nf-test" > pr-comment/header.txt
188+
if [ -d pr-comment-fragments ] && [ -n "$(ls -A pr-comment-fragments)" ]; then
189+
{
190+
echo "## ❌ nf-test failed with latest Nextflow version"
191+
echo ""
192+
echo "> [!NOTE]"
193+
echo "> Tests with Nextflow's latest version failed but it will not cause a CI workflow failure."
194+
echo "> Please check if the failure is expected with newer (edge-)releases of Nextflow or if it needs fixing."
195+
echo ""
196+
cat pr-comment-fragments/*.md
197+
echo ""
198+
echo "See the [full run](${RUN_URL}) for details."
199+
} > pr-comment/comment.md
200+
fi
201+
202+
- name: Upload PR comment artifact
203+
if: ${{ always() }}
204+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
205+
with:
206+
name: pr-comment
207+
path: pr-comment/

‎.github/workflows/pr-comment.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: Post PR comment
2+
# Shared, privileged comment poster.
3+
#
4+
# This is the single workflow that runs with a write token. It is triggered
5+
# after any of the listed "producer" workflows complete on a pull request.
6+
# Each producer runs untrusted PR code (if any) with a read-only token and
7+
# uploads a `pr-comment` artifact describing the comment to post; this workflow
8+
# only ever reads that plain-text artifact, so no PR code is executed here.
9+
#
10+
# Artifact contract (uploaded by producers under the name `pr-comment`):
11+
# pr_number.txt - the pull request number
12+
# header.txt - sticky-comment identifier (keeps comment types separate)
13+
# comment.md - the Markdown body (omit the file to post nothing)
14+
15+
on:
16+
workflow_run:
17+
workflows:
18+
- "nf-core linting"
19+
- "nf-core template version comment"
20+
- "nf-core branch protection"
21+
- "Run nf-test"
22+
23+
permissions:
24+
actions: read
25+
contents: read
26+
pull-requests: write
27+
28+
jobs:
29+
post-comment:
30+
runs-on: ubuntu-latest
31+
if: github.event.workflow_run.event == 'pull_request'
32+
steps:
33+
- name: Download PR comment artifact
34+
uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
35+
with:
36+
run_id: ${{ github.event.workflow_run.id }}
37+
name: pr-comment
38+
path: pr-comment
39+
if_no_artifact_found: ignore
40+
41+
- name: Read comment metadata
42+
id: meta
43+
run: |
44+
echo "::group::Downloaded pr-comment contents"
45+
ls -la pr-comment 2>/dev/null || echo "No pr-comment/ directory was downloaded."
46+
echo "::endgroup::"
47+
48+
if [ ! -d pr-comment ]; then
49+
echo "No pr-comment artifact found; nothing to post."
50+
exit 0
51+
fi
52+
53+
if [ ! -f pr-comment/comment.md ]; then
54+
echo "Artifact present but no comment.md; nothing to post."
55+
exit 0
56+
fi
57+
58+
pr_number=$(cat pr-comment/pr_number.txt)
59+
header=$(cat pr-comment/header.txt)
60+
echo "Found comment.md (header='$header', pr_number='$pr_number')."
61+
62+
# Guard against anything unexpected ending up in the PR number.
63+
case "$pr_number" in
64+
''|*[!0-9]*)
65+
echo "Invalid PR number: '$pr_number'"
66+
exit 1
67+
;;
68+
esac
69+
70+
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
71+
echo "header=$header" >> "$GITHUB_OUTPUT"
72+
echo "post=true" >> "$GITHUB_OUTPUT"
73+
echo "Will post comment to PR #${pr_number}."
74+
75+
- name: Post PR comment
76+
if: steps.meta.outputs.post == 'true'
77+
uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
78+
with:
79+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80+
number: ${{ steps.meta.outputs.pr_number }}
81+
header: ${{ steps.meta.outputs.header }}
82+
path: pr-comment/comment.md

‎.github/workflows/template-version-comment.yml‎

Lines changed: 36 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,17 @@ name: nf-core template version comment
22
# This workflow is triggered on PRs to check if the pipeline template version matches the latest nf-core version.
33
# It posts a comment to the PR, even if it comes from a fork.
44

5-
on: pull_request_target
5+
on:
6+
pull_request:
7+
8+
permissions: {}
69

710
jobs:
8-
template_version:
11+
check_template_version:
912
runs-on: ubuntu-latest
1013
steps:
1114
- name: Check out pipeline code
12-
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1316
with:
1417
ref: ${{ github.event.pull_request.head.sha }}
1518

@@ -22,25 +25,36 @@ jobs:
2225
- name: Install nf-core
2326
run: |
2427
python -m pip install --upgrade pip
25-
pip install nf-core==${{ steps.read_yml.outputs['nf_core_version'] }}
28+
pip install nf-core
29+
30+
- name: Build PR comment if template is outdated
31+
# The fork-controlled version is passed via the environment and only ever
32+
# used as quoted shell data (never interpolated into a command), so it
33+
# cannot be used for script injection.
34+
env:
35+
PR_VERSION: ${{ steps.read_yml.outputs['nf_core_version'] }}
36+
PR_NUMBER: ${{ github.event.pull_request.number }}
37+
run: |
38+
mkdir -p pr-comment
39+
echo "$PR_NUMBER" > pr-comment/pr_number.txt
40+
echo "template-version" > pr-comment/header.txt
41+
42+
latest_version=$(nf-core --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
2643
27-
- name: Check nf-core outdated
28-
id: nf_core_outdated
29-
run: echo "OUTPUT=$(pip list --outdated | grep nf-core)" >> ${GITHUB_ENV}
44+
if [ -n "$PR_VERSION" ] && [ -n "$latest_version" ] && [ "$PR_VERSION" != "$latest_version" ]; then
45+
cat > pr-comment/comment.md <<EOF
46+
> [!WARNING]
47+
> Newer version of the nf-core template is available.
48+
>
49+
> Your pipeline is using an old version of the nf-core template: ${PR_VERSION}.
50+
> Please update your pipeline to the latest version.
51+
>
52+
> For more documentation on how to update your pipeline, please see the [Synchronisation documentation](https://nf-co.re/docs/developing/template-syncs/overview).
53+
EOF
54+
fi
3055
31-
- name: Post nf-core template version comment
32-
uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
33-
if: |
34-
contains(env.OUTPUT, 'nf-core')
56+
- name: Upload PR comment artifact
57+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
3558
with:
36-
repo-token: ${{ secrets.NF_CORE_BOT_AUTH_TOKEN }}
37-
allow-repeats: false
38-
message: |
39-
> [!WARNING]
40-
> Newer version of the nf-core template is available.
41-
>
42-
> Your pipeline is using an old version of the nf-core template: ${{ steps.read_yml.outputs['nf_core_version'] }}.
43-
> Please update your pipeline to the latest version.
44-
>
45-
> For more documentation on how to update your pipeline, please see the [nf-core documentation](https://github.com/nf-core/tools?tab=readme-ov-file#sync-a-pipeline-with-the-template) and [Synchronisation documentation](https://nf-co.re/docs/contributing/sync).
46-
#
59+
name: pr-comment
60+
path: pr-comment/

‎.nf-core.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
lint:
22
files_exist:
33
- conf/modules.config
4+
- .github/workflows/linting_comment.yml
45
files_unchanged:
56
- .github/CONTRIBUTING.md
67
- .github/PULL_REQUEST_TEMPLATE.md
78
- docs/images/nf-core-raredisease_logo_dark.png
89
- docs/images/nf-core-raredisease_logo_light.png
910
- assets/nf-core-raredisease_logo_light.png
11+
- .github/workflows/branch.yml
12+
- .github/workflows/linting.yml
1013
modules_config: false
1114
nf_core_version: 3.5.1
1215
repository_type: pipeline

0 commit comments

Comments
 (0)