dev -> main for 4.1.0

.devcontainer/build-devcontainer/Dockerfile

@@ -1,6 +1,6 @@
 # devcontainers/miniconda image based on debian (bookworm)
 # see tags and images: https://mcr.microsoft.com/en-us/artifact/mar/devcontainers/miniconda/tags
-FROM mcr.microsoft.com/devcontainers/miniconda@sha256:1a85cf3e3da9d999f994f74cf501b1d02c9aa73ebfa3552f806dbe4570d7d5b5 AS build
+FROM mcr.microsoft.com/devcontainers/miniconda@sha256:617c7e42311066ac0bac3b7f0a3647daa9eec70fb8e3aeb8a5b083337a8a8687 AS build
 
 # copy this repo at current revision
 COPY . /root/nfcore-tools/
@@ -27,7 +27,7 @@ RUN rm -f /etc/apt/sources.list.d/yarn.list && \
     rm -rf /var/lib/apt/lists/*
 
 # Final stage to copy only the required files after installation
-FROM mcr.microsoft.com/devcontainers/base:2.1.8-debian12@sha256:17e6cc517b483d1108b333d4c34352b0a21617f0117052e9b259d47113a9dc37 AS final
+FROM mcr.microsoft.com/devcontainers/base:2.1.11-debian12@sha256:bb7b81b6e5be17b5267f92f4ffda534fea37dab1df97b5e86c1f9b91da5c0b5d AS final
 
 # Copy only the conda environment and site-packages from build stage
 COPY --from=build /opt/conda /opt/conda

.devcontainer/setup.sh

@@ -10,7 +10,7 @@ export PS1='\[\e[3;36m\]\w ->\[\e[0m\\] '
 nextflow self-update
 
 # Install specifically the version of tools from the workspace
-uv sync --all-extras
+uv sync
 
 # Activate the virtual environment automatically on login
 echo "source $(pwd)/.venv/bin/activate" >> $HOME/.bashrc

.github/actions/create-lint-wf/action.yml

@@ -16,7 +16,7 @@ runs:
         export NXF_WORK=$(pwd)
 
     - name: Install Nextflow
-      uses: nf-core/setup-nextflow@b4ec1bc7c16a94435159de94a05253542fddf6ef # v3
+      uses: nf-core/setup-nextflow@893c28b667aedeba26e37f296d260ccc5bc4d914 # v3
       with:
         version: ${{ matrix.NXF_VER }}
 

.github/workflows/changelog.yml

@@ -3,35 +3,54 @@ on:
   issue_comment:
     types: [created] # Add "@nf-core-bot changelog" as a PR comment to trigger this workflow.
 
+permissions: {}
+
 jobs:
   update_changelog:
     runs-on: ubuntu-latest
-    if: contains(github.event.comment.body, '@nf-core-bot changelog')
+    if: >
+      github.event.issue.pull_request &&
+      contains(github.event.comment.body, '@nf-core-bot changelog')
 
     steps:
-      - name: branch-deploy
-        id: branch-deploy
-        if: github.event_name == 'issue_comment'
-        uses: github/branch-deploy@fded0351b6b79f854b335c11b3d93063461dd288 # v11.1.2
-        with:
-          trigger: "@nf-core-bot changelog"
-          reaction: "eyes"
-          stable_branch: "dev"
+      - name: Verify commenter is on the nf-core/infrastructure team
+        env:
+          GH_TOKEN: ${{ secrets.NF_CORE_BOT_AUTH_TOKEN }}
+          ACTOR: ${{ github.event.comment.user.login }}
+        run: |
+          state=$(gh api "orgs/nf-core/teams/infrastructure/memberships/${ACTOR}" --jq '.state' 2>/dev/null || true)
+          if [ "$state" != "active" ]; then
+            echo "::error::@${ACTOR} is not an active member of nf-core/infrastructure; refusing to run."
+            exit 1
+          fi
+          echo "@${ACTOR} is on nf-core/infrastructure — proceeding."
+
+      - name: React to the triggering comment
+        env:
+          GH_TOKEN: ${{ secrets.NF_CORE_BOT_AUTH_TOKEN }}
+        run: |
+          gh api --method POST \
+            "repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions" \
+            -f content=eyes
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      # Checks out the base ref (the trusted version of the repo) first.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.NF_CORE_BOT_AUTH_TOKEN }}
 
-      # Action runs on the issue comment, so we don't get the PR by default.
-      # Use the GitHub CLI to check out the PR:
+      - name: Save trusted scripts
+        run: |
+          cp "${GITHUB_WORKSPACE}/.github/workflows/changelog.py" "${RUNNER_TEMP}/changelog.py"
+          cp "${GITHUB_WORKSPACE}/.pre-commit-config.yaml" "${RUNNER_TEMP}/pre-commit-config.yaml"
+
       - name: Checkout Pull Request
         env:
           GH_TOKEN: ${{ secrets.NF_CORE_BOT_AUTH_TOKEN }}
         run: |
           PR_NUMBER="${{ github.event.issue.number }}"
           gh pr checkout $PR_NUMBER
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
@@ -45,30 +64,31 @@ jobs:
           PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
           PR_TITLE: ${{ github.event.issue.title || github.event.pull_request.title }}
         run: |
-          python ${GITHUB_WORKSPACE}/.github/workflows/changelog.py
+          python "${RUNNER_TEMP}/changelog.py"
 
       - name: Check if CHANGELOG.md actually changed
         id: file_changed
         run: |
           # Show the diff for debugging
-          git diff -- ${GITHUB_WORKSPACE}/CHANGELOG.md
+          git diff -- "${GITHUB_WORKSPACE}/CHANGELOG.md"
 
           # Check if file has unstaged changes
-          [ -n "$(git diff -- ${GITHUB_WORKSPACE}/CHANGELOG.md)" ] && file_changed="TRUE" || file_changed="FALSE"
+          [ -n "$(git diff -- "${GITHUB_WORKSPACE}/CHANGELOG.md")" ] && file_changed="TRUE" || file_changed="FALSE"
 
           echo "File changed: $file_changed"
-          echo "changed=$file_changed" >> $GITHUB_OUTPUT
+          echo "changed=$file_changed" >> "$GITHUB_OUTPUT"
 
       - name: Set up Python 3.14
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
       - name: Run pre-commit rules with prek
-        uses: j178/prek-action@6ad80277337ad479fe43bd70701c3f7f8aa74db3 # v2
+        if: steps.file_changed.outputs.changed == 'TRUE'
+        uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2
         continue-on-error: true
         with:
-          extra-args: --config .pre-commit-config.yaml --all-files
+          extra-args: --config ${{ runner.temp }}/pre-commit-config.yaml --files CHANGELOG.md
 
       - name: Commit and push changes
         if: steps.file_changed.outputs.changed == 'TRUE'
@@ -77,7 +97,7 @@ jobs:
         run: |
           git config user.email "core@nf-co.re"
           git config user.name "nf-core-bot"
-          git add ${GITHUB_WORKSPACE}/CHANGELOG.md
+          git add "${GITHUB_WORKSPACE}/CHANGELOG.md"
           git status
           git commit -m "[automated] Update CHANGELOG.md [skip ci]"
           git push

.github/workflows/clean-up.yml

@@ -10,7 +10,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11
         with:
           stale-issue-message: "This issue has been tagged as awaiting-changes or awaiting-feedback by an nf-core contributor. Remove stale label or add a comment otherwise this issue will be closed in 20 days."
           stale-pr-message: "This PR has been tagged as awaiting-changes or awaiting-feedback by an nf-core contributor. Remove stale label or add a comment if it is still useful."

.github/workflows/codspeed.yml

@@ -0,0 +1,66 @@
+name: CodSpeed benchmarks
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - codspeed.yml
+      - nf_core/**/*.py
+  pull_request:
+    paths:
+      - codspeed.yml
+      - nf_core/**/*.py
+  workflow_dispatch:
+
+# Cancel if a newer run with the same workflow name is queued
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write # for OpenID Connect authentication with CodSpeed
+
+jobs:
+  startup-benchmarks:
+    name: Run start-up benchmarks
+    runs-on: codspeed-macro
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        name: Check out source-code repository
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.14"
+
+      - name: Install Nextflow
+        uses: nf-core/setup-nextflow@893c28b667aedeba26e37f296d260ccc5bc4d914 # v3
+        with:
+          version: ${{ github.event.inputs.nextflow-version || matrix.nextflow-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --all-extras
+
+      # Clone nf-core/modules into the local cache here, while network is
+      # available. The modules-install benchmark then runs entirely offline
+      # (no per-round fetch), so it stays deterministic even if the CodSpeed
+      # step sandboxes network during measurement.
+      - name: Warm nf-core/modules cache
+        run: uv run python -c "from nf_core.modules.modules_repo import ModulesRepo; ModulesRepo()"
+
+      # These benchmarks spawn a fresh interpreter per round to measure
+      # import/start-up cost, which CodSpeed's instruction-counting
+      # "simulation" instrument can't see. Use "walltime" mode instead.
+      - name: Run start-up benchmarks
+        uses: CodSpeedHQ/action@88472375d0a4572cf70a9f1fe3a4e0ab8da1b924 # v5.0.1
+        with:
+          mode: walltime
+          run: uv run pytest benchmarks/test_startup_benchmarks.py --codspeed

.github/workflows/create-lint-wf.yml

@@ -42,22 +42,22 @@ jobs:
           export NXF_WORK=$(pwd)
 
       # Get the repo code
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         name: Check out source-code repository
 
       # Set up nf-core/tools
       - name: Set up Python 3.14
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 
       - name: Install python dependencies
-        run: uv sync --all-extras
+        run: uv sync
 
       - name: run create-lint-wf
         uses: ./.github/actions/create-lint-wf

.github/workflows/create-test-lint-wf-template.yml

@@ -32,7 +32,7 @@ jobs:
       all_features: ${{ steps.create_matrix.outputs.matrix }}
     steps:
       - name: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Create Matrix
         id: create_matrix
         run: |
@@ -56,23 +56,23 @@ jobs:
 
     steps:
       - name: Check out source-code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python 3.14
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 
       - name: Install python dependencies
-        run: uv sync --all-extras
+        run: uv sync
 
       - name: Install Nextflow
-        uses: nf-core/setup-nextflow@b4ec1bc7c16a94435159de94a05253542fddf6ef # v3
+        uses: nf-core/setup-nextflow@893c28b667aedeba26e37f296d260ccc5bc4d914 # v3
         with:
           version: latest-everything
 

.github/workflows/create-test-wf.yml

@@ -41,24 +41,24 @@ jobs:
           cd create-test-wf
           export NXF_WORK=$(pwd)
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         name: Check out source-code repository
 
       - name: Set up Python 3.14
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 
       - name: Install python dependencies
         run: uv sync
 
       - name: Install Nextflow
-        uses: nf-core/setup-nextflow@b4ec1bc7c16a94435159de94a05253542fddf6ef # v3
+        uses: nf-core/setup-nextflow@893c28b667aedeba26e37f296d260ccc5bc4d914 # v3
         with:
           version: ${{ matrix.NXF_VER }}
 

.github/workflows/deploy-pypi.yml

@@ -13,16 +13,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         name: Check out source-code repository
 
       - name: Set up Python 3.14
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 
@@ -34,6 +34,6 @@ jobs:
 
       - name: Publish dist to PyPI
         if: github.repository == 'nf-core/tools'
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
         with:
           password: ${{ secrets.pypi_password }}

.github/workflows/fix-linting.yml

@@ -12,14 +12,14 @@ jobs:
     steps:
       - name: branch-deploy
         id: branch-deploy
-        uses: github/branch-deploy@fded0351b6b79f854b335c11b3d93063461dd288 # v11.1.2
+        uses: github/branch-deploy@f0984057ffe1aa340aa017b6eafb894310aed88e # v12.0.0
         with:
           trigger: "@nf-core-bot fix linting"
           reaction: "eyes"
           stable_branch: "dev"
 
       # Use the @nf-core-bot token to check out so we can push later
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.nf_core_bot_auth_token }}
 
@@ -33,7 +33,7 @@ jobs:
       # Install and run prek
       - name: Run prek
         id: prek
-        uses: j178/prek-action@6ad80277337ad479fe43bd70701c3f7f8aa74db3 # v2
+        uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2
         with:
           extra-args: --config .pre-commit-config.yaml --all-files
         continue-on-error: true

.github/workflows/lint-code.yml

@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Run prek
-        uses: j178/prek-action@6ad80277337ad479fe43bd70701c3f7f8aa74db3 # v2
+        uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2
         with:
           extra-args: --config .pre-commit-config.yaml --all-files