Consolidate and harden PR-comment GitHub Actions workflows - #1872
Draft
ewels wants to merge 1 commit into
Draft
Conversation
|
ewels
changed the title
Add a single shared pr-comment.yml as the only workflow that runs with a write token. It is triggered via workflow_run after a producer workflow completes, downloads a standard pr-comment artifact, and posts the comment. The producer workflows (linting, template version, branch protection) now run on pull_request with read-only tokens and only upload a pr-comment artifact (pr_number.txt, header.txt, optional comment.md). This removes the pull_request_target triggers, drops a shell-injection vector when building the install command and comment body, and replaces the duplicated poster workflows (linting_comment.yml, template-version-comment-action.yml). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GFdLvcJv6tHEB8fJWVwdAv
ewels
force-pushed
the
claude/blissful-goodall-a315fe
branch
from
June 22, 2026 10:19
f46b42f to
85c0f76
Compare
Member
Author
|
nf-core/testpipeline equivalent: nf-core/testpipeline#148 |
mashehu
pushed a commit
to mashehu/testpipeline
that referenced
this pull request
Jun 23, 2026
Adds a single shared `pr-comment.yml` workflow as the only one that runs with a write token. It is triggered via `workflow_run` after a producer workflow completes, downloads a standard `pr-comment` artifact, and posts the comment. The producer workflows — `linting`, `template-version-comment`, and `branch` — now run on `pull_request` with read-only tokens and just upload a `pr-comment` artifact (`pr_number.txt`, `header.txt`, optional `comment.md`). They no longer post comments directly. Removes the now-redundant `linting_comment.yml`. Ported from nf-core/rnaseq#1872. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> # Conflicts: # .github/workflows/branch.yml # .github/workflows/linting_comment.yml # .github/workflows/template-version-comment.yml
mashehu
pushed a commit
to mashehu/testpipeline
that referenced
this pull request
Jun 23, 2026
Adds a single shared `pr-comment.yml` workflow as the only one that runs with a write token. It is triggered via `workflow_run` after a producer workflow completes, downloads a standard `pr-comment` artifact, and posts the comment. The producer workflows — `linting`, `template-version-comment`, and `branch` — now run on `pull_request` with read-only tokens and just upload a `pr-comment` artifact (`pr_number.txt`, `header.txt`, optional `comment.md`). They no longer post comments directly. Removes the now-redundant `linting_comment.yml`. Ported from nf-core/rnaseq#1872. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tidies up and hardens the GitHub Actions workflows that post comments on PRs.
What changes
pr-comment.ymlworkflow as the only one that runs with a write token. It is triggered viaworkflow_runafter a producer workflow completes, downloads a standardpr-commentartifact, and posts the comment.linting,template-version-comment, andbranch— now run onpull_requestwith read-only tokens and just upload apr-commentartifact (pr_number.txt,header.txt, optionalcomment.md). They no longer post comments directly.linting_comment.ymlandtemplate-version-comment-action.yml.Why
headers keep each comment type independent, so they update in place as before.No change to the comments contributors actually see (lint results, template-version warning, branch-protection notice all still post, including on fork PRs).
Draft for review.
🤖 Generated with Claude Code