Can we talk about <github.com/nf-core/tools/pull/4...
# infrastructurej
Jonathan Manning
10/29/2026, 11:47 AMCan we talk about github.com/nf-core/tools/pull/4543? I get the rationale, but I think we should stick with the best practice of pinning actions to SHAs
m
mashehu
10/29/2026, 11:58 AMgetting github actions right is just too hard and having to roll out patch releases over the whole org isn't optimal either (see past three patch roll outs)
r
Rike Hanssen
10/29/2026, 12:06 PMwhat are the actions that are excluded from this? Who has merge rights?
m
mashehu
10/29/2026, 12:11 PMactions under seqeralabs/ and nf-core/
p
Phil Ewels
11/01/2026, 2:12 PMWe discussed this quite a bit already in #C0BRS3S6V7A @Jonathan Manning
Phil Ewels
11/01/2026, 2:14 PMI think that it's a special case for several reasons:
• Most compromises (stolen tokens etc) that affect one nf-core pipeline will usually affect the whole org = the action is within the same trust boundary (not true for basically any other action)
• We have the ability to patch our own actions immediately (not true for basically any other action)
• We have many repos, making updates difficult (not true for typical single-repo projects)
Phil Ewels
11/01/2026, 2:15 PMBecause of this, I think that using version pins for our own actions, and only our own, is more secure than using hashes