fix(ci): drop nf-core lint job without .nf-core.yml; document private CA on Platform

- Remove the nf-core pipelines lint step from linting.yml: dev dropped .nf-core.yml
  in ca70336, which broke the workflow (empty nf-core install and missing config).
- Rename workflow to Pipeline linting; keep action pins aligned with Renovate targets.
- Add README guidance for private CA in task containers using current process names.
- Fix editorconfig continuation indent in NF_AGGREGATE workflow warning.

Co-authored-by: Florian Wuennemann <flowuenne@gmail.com>

Author: cursoragent

.github/workflows/linting.yml

@@ -1,7 +1,5 @@
-name: nf-core linting
-# This workflow is triggered on pushes and PRs to the repository.
-# It runs the `nf-core pipelines lint` and markdown lint tests to ensure
-# that the code meets the nf-core guidelines.
+name: Pipeline linting
+# Runs pre-commit (Prettier, editorconfig, etc.) on pushes to dev and on pull requests.
 on:
   push:
     branches:
@@ -26,58 +24,3 @@ jobs:
 
       - name: Run pre-commit
         run: pre-commit run --all-files
-
-  nf-core:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out pipeline code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Install Nextflow
-        uses: nf-core/setup-nextflow@v2
-
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-          architecture: "x64"
-
-      - name: read .nf-core.yml
-        uses: pietrobolcato/action-read-yaml@1.1.0
-        id: read_yml
-        with:
-          config: ${{ github.workspace }}/.nf-core.yml
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install nf-core==${{ steps.read_yml.outputs['nf_core_version'] }}
-
-      - name: Run nf-core pipelines lint
-        if: ${{ github.base_ref != 'master' }}
-        env:
-          GITHUB_COMMENTS_URL: ${{ github.event.pull_request.comments_url }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_PR_COMMIT: ${{ github.event.pull_request.head.sha }}
-        run: nf-core -l lint_log.txt pipelines lint --dir ${GITHUB_WORKSPACE} --markdown lint_results.md
-
-      - name: Run nf-core pipelines lint --release
-        if: ${{ github.base_ref == 'master' }}
-        env:
-          GITHUB_COMMENTS_URL: ${{ github.event.pull_request.comments_url }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_PR_COMMIT: ${{ github.event.pull_request.head.sha }}
-        run: nf-core -l lint_log.txt pipelines lint --release --dir ${GITHUB_WORKSPACE} --markdown lint_results.md
-
-      - name: Save PR number
-        if: ${{ always() }}
-        run: echo ${{ github.event.pull_request.number }} > PR_number.txt
-
-      - name: Upload linting log file artifact
-        if: ${{ always() }}
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
-        with:
-          name: linting-logs
-          path: |
-            lint_log.txt
-            lint_results.md
-            PR_number.txt

README.md

@@ -19,7 +19,7 @@ The pipeline fetches run data from the Seqera Platform API and generates benchma
 
 - [Nextflow](https://www.nextflow.io/docs/latest/getstarted.html#installation) >=25.10.0
 - Account in [Seqera Platform](https://seqera.io/platform/)
-- [Access token](https://docs.seqera.io/platform/23.3.0/api/overview#authentication) which is your personal authorization token for the Seqera Platform CLI. This can be created in the user menu under **Your tokens**. Export the token as a shell variable directly into your terminal if running the pipelie locally. You will not need to set this if running the pipeline within the Seqera Platform as it will automatically be inherited from the executing environment.
+- [Access token](https://docs.seqera.io/platform/23.3.0/api/overview#authentication) which is your personal authorization token for the Seqera Platform CLI. This can be created in the user menu under **Your tokens**. Export the token as a shell variable directly into your terminal if running the pipeline locally. You will not need to set this if running the pipeline within the Seqera Platform as it will automatically be inherited from the executing environment.
 
   ```bash
   export TOWER_ACCESS_TOKEN=<your access token>
@@ -46,7 +46,25 @@ nextflow run seqeralabs/nf-aggregate \
     -profile docker
 ```
 
-If you are using a Seqera Platform Enterprise instance that is secured with a private CA SSL certificate not recognized by default Java certificate authorities, you can specify a custom `cacerts` store path through the `--java_truststore_path` parameter and optionally, a password with the `--java_truststore_password`. This certificate will be used to achieve connectivity with your Seqera Platform instance through API and CLI.
+If you are using a Seqera Platform Enterprise instance that is secured with a private CA SSL certificate not recognized by default Java certificate authorities, you can specify a custom `cacerts` store path through the `--java_truststore_path` parameter and optionally, a password with the `--java_truststore_password`. This configures the Nextflow JVM used for Seqera Platform API access (see `lib/SeqeraApi.groovy`).
+
+### Seqera Platform Enterprise with a private CA (containers)
+
+For API access from Nextflow, `--java_truststore_path` / `--java_truststore_password` are usually sufficient. Task containers may still lack your private CA when they open TLS connections. As a workaround, add the following under **Advanced options → Nextflow config** in Seqera Platform (replace `tower-server-url` with your Seqera host name only, without `https://`):
+
+```groovy
+process {
+   withName: /NORMALIZE_BENCHMARK_JSONL|AGGREGATE_BENCHMARK_REPORT_DATA|RENDER_BENCHMARK_REPORT|EXTRACT_TARBALL/ {
+     beforeScript = '''
+keytool -printcert -rfc -sslserver tower-server-url:443 > PRIVATE_CERT.pem
+keytool -importcert -alias seqera-ca -file PRIVATE_CERT.pem -keystore truststore.jks -storepass changeit -noprompt
+export JAVA_TOOL_OPTIONS="-Djavax.net.ssl.trustStore=$(pwd)/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit"
+'''
+   }
+}
+```
+
+This downloads the server certificate, builds a small JKS truststore in the task work directory, and points the JVM inside the task at it.
 
 ### Benchmark reports
 

workflows/nf_aggregate/main.nf

@@ -33,7 +33,7 @@ workflow NF_AGGREGATE {
         ch_split.api.count().subscribe { n ->
             if (n > 0) {
                 log.warn "Found ${n} API run(s) but --generate_benchmark_report is not enabled. " +
-                         "API runs will not produce any output. Enable --generate_benchmark_report to process them."
+                    "API runs will not produce any output. Enable --generate_benchmark_report to process them."
             }
         }
     }