Daniel Lundin
08/31/2026, 8:26 AM┌───────────────────────────────────────────────────────────────────────┬────────┐
│ request │ result │
├───────────────────────────────────────────────────────────────────────┼────────┤
│ codeload.../tar.gz/8ee1f36… (the pinned SHA) │ 400 │
├───────────────────────────────────────────────────────────────────────┼────────┤
│ same SHA, authenticated │ 400 │
├───────────────────────────────────────────────────────────────────────┼────────┤
│ same SHA via codeload.../zip/ │ 400 │
├───────────────────────────────────────────────────────────────────────┼────────┤
│ same SHA via codeload.../legacy.tar.gz/ │ 200 │
├───────────────────────────────────────────────────────────────────────┼────────┤
│ same SHA via <http://api.github.com/repos/…/tarball/|api.github.com/repos/…/tarball/> │ 200 │
├───────────────────────────────────────────────────────────────────────┼────────┤
│ codeload.../tar.gz/v4.0.1 and /v4 — tags pointing at that same commit │ 200 │
├───────────────────────────────────────────────────────────────────────┼────────┤
│ other, less-used SHAs of the same repo │ 200 │
└───────────────────────────────────────────────────────────────────────┴────────┘
So the commit is fine and reachable by every other route; codeload specifically refuses the modern archive formats for that one SHA, for anonymous and authenticated callers alike. It's a GitHub-side bug, not permissions, not rate limiting, and not something a re-run can fix. All six shards failed again with the identical error.
Worth noting it isn't only your PR: an unrelated strict_syntax branch failed the same way at 07:57 today, and everything before ~05:27 passed. Every nf-core/modules PR is blocked while this lasts, so it's worth raising in Slack rather than sitting on it.
If nf-core wants to unblock itself rather than wait, the fix is one line in .github/actions/nf-test-action/action.yml:
uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4
The awkward part is that v4.0.1 is the latest release and 8ee1f36 is its commit, so re-pinning to the current tag lands back on the broken SHA. The options are pinning to the tag name v4 (works, but breaks the SHA-pinning convention Renovate maintains) or to a newer untagged main commit such as 3770981792f1… from 2026-08-12 (verified 200, but unreleased). Neither is clearly right — that's a call for whoever owns that action file.
"""
(My emphasis.) Does anyone know what's going on?Maxime Garcia
08/31/2026, 8:29 AMMaxime Garcia
08/31/2026, 8:29 AMDaniel Lundin
08/31/2026, 8:29 AMDaniel Lundin
08/31/2026, 8:29 AMMaxime Garcia
08/31/2026, 8:38 AMMaxime Garcia
08/31/2026, 8:38 AM