We recently found a bug in the pipeline template (primarily since template version 3.0.0) that allowed the read-out of the nf-core-bot token. We therefore are currently rolling out patch PRs to all nf-core pipelines. See the security advisory for details and what pipeline maintainers have to do to mitigate it: https://nf-co.re/advisories/pr-comment-workflow-vulnerability deal with infra

It would not have prevented the problem, but have you considered using a GitHub app for authenticating the bot, rather than a long-lived token?

Could be worth looking into, though as you say whether the work would outweigh the benefits (let's discuss in #C069B2Z5P1R if you have more thoughts)