Skip to content

Commit b2493f5

Browse files
mashehumashehu
authored
switch to more secure split PR comment approach (#4342)
1 parent 4a51a69 commit b2493f5

16 files changed

Lines changed: 282 additions & 107 deletions

File tree

‎.github/workflows/branch.yml‎

Lines changed: 40 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,11 @@ name: nf-core branch protection
22
# This workflow is triggered on PRs to main branch on the repository
33
# It fails when someone tries to make a PR against the nf-core `main` branch instead of `dev`
44
on:
5-
pull_request_target:
6-
branches: [main]
5+
pull_request:
6+
branches:
7+
- main
8+
9+
permissions: {}
710

811
jobs:
912
test:
@@ -12,32 +15,47 @@ jobs:
1215
# PRs to the nf-core repo main branch are only ok if coming from the nf-core repo `dev` or any `patch` branches
1316
- name: Check PRs
1417
if: github.repository == 'nf-core/tools'
18+
env:
19+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
1520
run: |
16-
{ [[ ${{github.event.pull_request.head.repo.full_name}} == nf-core/tools ]] && [[ $GITHUB_HEAD_REF == "dev" ]]; } || [[ $GITHUB_HEAD_REF == "patch" ]]
21+
{ [[ "$HEAD_REPO" == "nf-core/tools" ]] && [[ "$GITHUB_HEAD_REF" == "dev" ]]; } || [[ "$GITHUB_HEAD_REF" == "patch" ]]
1722
18-
# If the above check failed, post a comment on the PR explaining the failure
19-
- name: Post PR comment
23+
# If the above check failed, build a comment to be posted by the shared poster workflow
24+
- name: Build PR comment
2025
if: failure()
21-
uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3
22-
with:
23-
message: |
24-
## This PR is against the `main` branch :x:
26+
env:
27+
PR_NUMBER: ${{ github.event.pull_request.number }}
28+
BASE_REF: ${{ github.event.pull_request.base.ref }}
29+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
30+
PR_USER: ${{ github.event.pull_request.user.login }}
31+
run: |
32+
mkdir -p pr-comment
33+
echo "$PR_NUMBER" > pr-comment/pr_number.txt
34+
echo "branch" > pr-comment/header.txt
35+
cat > pr-comment/comment.md <<EOF
36+
## This PR is against the \`${BASE_REF}\` branch :x:
2537
26-
* Do not close this PR
27-
* Click _Edit_ and change the `base` to `dev`
28-
* This CI test will remain failed until you push a new commit
38+
* Do not close this PR
39+
* Click _Edit_ and change the \`base\` to \`dev\`
40+
* This CI test will remain failed until you push a new commit
2941
30-
---
42+
---
3143
32-
Hi @${{ github.event.pull_request.user.login }},
44+
Hi @${PR_USER},
3345
34-
It looks like this pull-request is has been made against the [${{github.event.pull_request.head.repo.full_name }}](https://github.com/${{github.event.pull_request.head.repo.full_name }}) `main` branch.
35-
The `main` branch on nf-core repositories should always contain code from the latest release.
36-
Because of this, PRs to `main` are only allowed if they come from the [${{github.event.pull_request.head.repo.full_name }}](https://github.com/${{github.event.pull_request.head.repo.full_name }}) `dev` branch.
46+
It looks like this pull-request is has been made against the [${HEAD_REPO}](https://github.com/${HEAD_REPO}) ${BASE_REF} branch.
47+
The ${BASE_REF} branch on nf-core repositories should always contain code from the latest release.
48+
Because of this, PRs to ${BASE_REF} are only allowed if they come from the [${HEAD_REPO}](https://github.com/${HEAD_REPO}) \`dev\` branch.
3749
38-
You do not need to close this PR, you can change the target branch to `dev` by clicking the _"Edit"_ button at the top of this page.
39-
Note that even after this, the test will continue to show as failing until you push a new commit.
50+
You do not need to close this PR, you can change the target branch to \`dev\` by clicking the _"Edit"_ button at the top of this page.
51+
Note that even after this, the test will continue to show as failing until you push a new commit.
4052
41-
Thanks again for your contribution!
42-
repo-token: ${{ secrets.GITHUB_TOKEN }}
43-
allow-repeats: false
53+
Thanks again for your contribution!
54+
EOF
55+
56+
- name: Upload PR comment artifact
57+
if: failure()
58+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
59+
with:
60+
name: pr-comment
61+
path: pr-comment/

‎.github/workflows/codspeed.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
name: Run start-up benchmarks
2929
runs-on: codspeed-macro
3030
steps:
31-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
31+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3232
name: Check out source-code repository
3333

3434
- name: Set up Python

‎.github/workflows/pr-comment.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Post PR comment
2+
# Shared, privileged comment poster.
3+
#
4+
# This is the single workflow that runs with a write token. It is triggered
5+
# after any of the listed "producer" workflows complete on a pull request.
6+
# Each producer runs untrusted PR code (if any) with a read-only token and
7+
# uploads a `pr-comment` artifact describing the comment to post; this workflow
8+
# only ever reads that plain-text artifact, so no PR code is executed here.
9+
#
10+
# Artifact contract (uploaded by producers under the name `pr-comment`):
11+
# pr_number.txt - the pull request number
12+
# header.txt - sticky-comment identifier (keeps comment types separate)
13+
# comment.md - the Markdown body (omit the file to post nothing)
14+
15+
on:
16+
workflow_run:
17+
workflows:
18+
- "nf-core branch protection"
19+
20+
permissions:
21+
actions: read
22+
contents: read
23+
pull-requests: write
24+
25+
jobs:
26+
post-comment:
27+
runs-on: ubuntu-latest
28+
# Only act on runs that were triggered by a pull request.
29+
if: github.event.workflow_run.event == 'pull_request'
30+
steps:
31+
- name: Download PR comment artifact
32+
uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
33+
with:
34+
run_id: ${{ github.event.workflow_run.id }}
35+
name: pr-comment
36+
if_no_artifact_found: ignore
37+
38+
- name: Read comment metadata
39+
id: meta
40+
run: |
41+
# No comment body means there is nothing to post.
42+
[ -f pr-comment/comment.md ] || exit 0
43+
44+
pr_number=$(cat pr-comment/pr_number.txt)
45+
header=$(cat pr-comment/header.txt)
46+
47+
# Guard against anything unexpected ending up in the PR number.
48+
case "$pr_number" in
49+
''|*[!0-9]*)
50+
echo "Invalid PR number: '$pr_number'"
51+
exit 1
52+
;;
53+
esac
54+
55+
echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
56+
echo "header=$header" >> "$GITHUB_OUTPUT"
57+
echo "post=true" >> "$GITHUB_OUTPUT"
58+
59+
- name: Post PR comment
60+
if: steps.meta.outputs.post == 'true'
61+
uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
62+
with:
63+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64+
number: ${{ steps.meta.outputs.pr_number }}
65+
header: ${{ steps.meta.outputs.header }}
66+
path: pr-comment/comment.md

‎.github/workflows/test_offline_configs.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,28 +67,28 @@ jobs:
6767
fetch-depth: "0"
6868
- name: Check the correct default config base of the nf-core configs
6969
id: check_default_config
70-
uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
70+
uses: GuillaumeFalourd/assert-command-line-output@63ad23408d758ee7f09b4557cc0901d6ae4f3f76 # v2.4
7171
with:
7272
command_line: nextflow config -value params.custom_config_base .
7373
contains: https://raw.githubusercontent.com/nf-core/configs/master
7474
expected_result: PASSED
7575
- name: Check the correct inclusion of an existing institutional profile
7676
id: check_profile_inclusion
77-
uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
77+
uses: GuillaumeFalourd/assert-command-line-output@63ad23408d758ee7f09b4557cc0901d6ae4f3f76 # v2.4
7878
with:
7979
command_line: nextflow config -profile google -o flat .
8080
contains: "The nf-core framework" # Part of CITATION.cff, should always be printed if profile is included
8181
expected_result: PASSED
8282
- name: Check the failed inclusion of a non-existing institutional profile
8383
id: check_nonexistent_profile
84-
uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
84+
uses: GuillaumeFalourd/assert-command-line-output@63ad23408d758ee7f09b4557cc0901d6ae4f3f76 # v2.4
8585
with:
8686
command_line: nextflow config -profile GLaDOS -o flat .
8787
contains: "Unknown configuration profile: 'GLaDOS'"
8888
expected_result: PASSED
8989
- name: Check that offline prevents inclusion of nf-core configs
9090
id: check_offline_mode
91-
uses: GuillaumeFalourd/assert-command-line-output@2cd32f7751887b5ef1886521de68ea2ec3e2aee7 # v2
91+
uses: GuillaumeFalourd/assert-command-line-output@63ad23408d758ee7f09b4557cc0901d6ae4f3f76 # v2.4
9292
env:
9393
NXF_OFFLINE: true
9494
with:

‎.prettierignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ nf_core/pipeline-template/nextflow_schema.json
66
nf_core/pipeline-template/modules.json
77
nf_core/pipeline-template/tower.yml
88
nf_core/pipeline-template/.github/ISSUE_TEMPLATE/bug_report.yml
9+
nf_core/pipeline-template/.github/workflows/branch.yml
910
nf_core/pipeline-template/.github/workflows/nf-test.yml
11+
nf_core/pipeline-template/.github/workflows/pr-comment.yml
1012
tests/data/pipeline_create_template_skip.yml
1113
# don't run on things handled by ruff
1214
*.py

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
- remove date placeholder from changelog title ([#4333](https://github.com/nf-core/tools/pull/4333))
3838
- correct always-true `nf-core pipelines lint` condition in the linting workflow and fix doc typos (broken `#lint-tests` anchor, duplicate word, stray code-span space) ([#4324](https://github.com/nf-core/tools/pull/4324))
3939
- Fix publishDir configuration in modules.config for multiqc ([#4347](https://github.com/nf-core/tools/pull/4347))
40+
- Switch to a more secure approach for PR comments by splitting the GitHub Actions workflow ([#4342](https://github.com/nf-core/tools/pull/4342))
4041

4142
### Download
4243

‎nf_core/pipeline-template/.github/actions/nf-test/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ runs:
3737

3838
- name: Setup apptainer
3939
if: contains(inputs.profile, 'singularity')
40-
uses: eWaterCycle/setup-apptainer@3f706d898c9db585b1d741b4692e66755f3a1b40 # v2
40+
uses: eWaterCycle/setup-apptainer@4bb22c52d4f63406c49e94c804632975787312b3 # v2.0.0
4141

4242
- name: Set up Singularity
4343
if: contains(inputs.profile, 'singularity')

‎nf_core/pipeline-template/.github/workflows/branch.yml‎

Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,45 +2,61 @@ name: nf-core branch protection
22
# This workflow is triggered on PRs to `main`/`master` branch on the repository
33
# It fails when someone tries to make a PR against the nf-core `main`/`master` branch instead of `dev`
44
on:
5-
pull_request_target:
5+
pull_request:
66
branches:
77
- main
88
- master
99

10+
permissions: {}
11+
1012
jobs:
1113
test:
1214
runs-on: ubuntu-latest
1315
steps:
1416
# PRs to the nf-core repo main/master branch are only ok if coming from the nf-core repo `dev` or any `patch` branches
1517
- name: Check PRs
1618
if: github.repository == '{{ name }}'
19+
env:
20+
HEAD_REPO: {% raw %}${{ github.event.pull_request.head.repo.full_name }}{% endraw %}
1721
run: |
18-
{ [[ {% raw %}${{github.event.pull_request.head.repo.full_name }}{% endraw %} == {{ name }} ]] && [[ $GITHUB_HEAD_REF == "dev" ]]; } || [[ $GITHUB_HEAD_REF == "patch" ]]
22+
{ [[ "$HEAD_REPO" == {{ name }} ]] && [[ $GITHUB_HEAD_REF == "dev" ]]; } || [[ $GITHUB_HEAD_REF == "patch" ]]
1923
20-
# If the above check failed, post a comment on the PR explaining the failure {%- raw %}
21-
# NOTE - this doesn't currently work if the PR is coming from a fork, due to limitations in GitHub actions secrets
22-
- name: Post PR comment
24+
# If the above check failed, build a comment to be posted by the shared poster workflow
25+
- name: Build PR comment
2326
if: failure()
24-
uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3
25-
with:
26-
message: |
27-
## This PR is against the `${{github.event.pull_request.base.ref}}` branch :x:
27+
env:{% raw %}
28+
PR_NUMBER: ${{ github.event.pull_request.number }}
29+
BASE_REF: ${{ github.event.pull_request.base.ref }}
30+
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
31+
PR_USER: ${{ github.event.pull_request.user.login }}{% endraw %}
32+
run: |
33+
mkdir -p pr-comment
34+
echo "$PR_NUMBER" > pr-comment/pr_number.txt
35+
echo "branch" > pr-comment/header.txt
36+
cat > pr-comment/comment.md <<EOF
37+
## This PR is against the \`${BASE_REF}\` branch :x:
2838
29-
* Do not close this PR
30-
* Click _Edit_ and change the `base` to `dev`
31-
* This CI test will remain failed until you push a new commit
39+
* Do not close this PR
40+
* Click _Edit_ and change the \`base\` to \`dev\`
41+
* This CI test will remain failed until you push a new commit
3242
33-
---
43+
---
3444
35-
Hi @${{ github.event.pull_request.user.login }},
45+
Hi @${PR_USER},
3646
37-
It looks like this pull-request is has been made against the [${{github.event.pull_request.head.repo.full_name }}](https://github.com/${{github.event.pull_request.head.repo.full_name }}) ${{github.event.pull_request.base.ref}} branch.
38-
The ${{github.event.pull_request.base.ref}} branch on nf-core repositories should always contain code from the latest release.
39-
Because of this, PRs to ${{github.event.pull_request.base.ref}} are only allowed if they come from the [${{github.event.pull_request.head.repo.full_name }}](https://github.com/${{github.event.pull_request.head.repo.full_name }}) `dev` branch.
47+
It looks like this pull-request is has been made against the [${HEAD_REPO}](https://github.com/${HEAD_REPO}) ${BASE_REF} branch.
48+
The ${BASE_REF} branch on nf-core repositories should always contain code from the latest release.
49+
Because of this, PRs to ${BASE_REF} are only allowed if they come from the [${HEAD_REPO}](https://github.com/${HEAD_REPO}) \`dev\` branch.
4050
41-
You do not need to close this PR, you can change the target branch to `dev` by clicking the _"Edit"_ button at the top of this page.
42-
Note that even after this, the test will continue to show as failing until you push a new commit.
51+
You do not need to close this PR, you can change the target branch to \`dev\` by clicking the _"Edit"_ button at the top of this page.
52+
Note that even after this, the test will continue to show as failing until you push a new commit.
4353
44-
Thanks again for your contribution!
45-
repo-token: ${{ secrets.GITHUB_TOKEN }}
46-
allow-repeats: false {%- endraw %}
54+
Thanks again for your contribution!
55+
EOF
56+
57+
- name: Upload PR comment artifact
58+
if: failure()
59+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
60+
with:
61+
name: pr-comment
62+
path: pr-comment/

‎nf_core/pipeline-template/.github/workflows/linting.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,4 +73,22 @@ jobs:
7373
path: |
7474
lint_log.txt
7575
lint_results.md
76-
PR_number.txt {%- endraw %}
76+
PR_number.txt
77+
78+
# Build a comment for the shared pr-comment.yml poster to publish on the PR
79+
- name: Prepare PR comment
80+
if: ${{ always() }}
81+
env:
82+
PR_NUMBER: ${{ github.event.pull_request.number }}
83+
run: |
84+
mkdir -p pr-comment
85+
echo "$PR_NUMBER" > pr-comment/pr_number.txt
86+
echo "lint" > pr-comment/header.txt
87+
[ -f lint_results.md ] && cp lint_results.md pr-comment/comment.md || true
88+
89+
- name: Upload PR comment artifact
90+
if: ${{ always() }}
91+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
92+
with:
93+
name: pr-comment
94+
path: pr-comment/{%- endraw %}

‎nf_core/pipeline-template/.github/workflows/linting_comment.yml‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

0 commit comments

Comments
 (0)