Remove vulnerable PR-comment artifact pattern #1748
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: nf-core template version comment | |
| # This workflow is triggered on PRs to check if the pipeline template version matches the latest nf-core version. | |
| # It posts a comment to the PR, even if it comes from a fork. | |
| on: | |
| pull_request: | |
| permissions: {} | |
| jobs: | |
| check_template_version: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out pipeline code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Read template version from .nf-core.yml | |
| uses: nichmor/minimal-read-yaml@1f7205277e25e156e1f63815781db80a6d490b8f # v0.0.2 | |
| id: read_yml | |
| with: | |
| config: ${{ github.workspace }}/.nf-core.yml | |
| - name: Install nf-core | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install nf-core | |
| - name: Build PR comment if template is outdated | |
| # The fork-controlled version is passed via the environment and only ever | |
| # used as quoted shell data (never interpolated into a command), so it | |
| # cannot be used for script injection. | |
| env: | |
| PR_VERSION: ${{ steps.read_yml.outputs['nf_core_version'] }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| mkdir -p pr-comment | |
| echo "$PR_NUMBER" > pr-comment/pr_number.txt | |
| echo "template-version" > pr-comment/header.txt | |
| latest_version=$(nf-core --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1) | |
| if [ -n "$PR_VERSION" ] && [ -n "$latest_version" ] && [ "$PR_VERSION" != "$latest_version" ]; then | |
| cat > pr-comment/comment.md <<EOF | |
| > [!WARNING] | |
| > Newer version of the nf-core template is available. | |
| > | |
| > Your pipeline is using an old version of the nf-core template: ${PR_VERSION}. | |
| > Please update your pipeline to the latest version. | |
| > | |
| > For more documentation on how to update your pipeline, please see the [Synchronisation documentation](https://nf-co.re/docs/developing/template-syncs/overview). | |
| EOF | |
| fi | |
| - name: Upload PR comment artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: pr-comment | |
| path: pr-comment/ |