This only affects nf-core pipelines, and not pipelines using the template that are outside of nf-core - unless you've set up your own token/bot (as the nf-core bot only works within the GitHub organisation). This is a precaution only, we don't have any evidence that anything bad is happened, we're just trying to be proactive. Thanks all!

Only nf-core affected ? I had the impression that any org using nf-core templates and having defined a bot token for the comment CI would be affected > Pipelines outside nf-core will not be affected by this vulnerability, except for those that have set their own

NF_CORE_BOT_AUTH_TOKEN

environment variable on GitHub. In that case, you should apply the changes in the 4.0.3 release.

Ok yeah, true. I was sort of assuming that no-one else did that, but maybe that's not the case 👍🏻