Pin nf-test in the CI instead of installing the latest release

[hoelzer]

Problem

The Install nf-test step runs:

wget -qO- https://code.askimed.com/install/nf-test | bash

Without a version argument that script resolves the latest release through https://api.github.com/repos/askimed/nf-test/releases/latest — unauthenticated. On shared GitHub runners that call gets rate limited, and because the script runs under set -e the whole job dies before a single test runs:

Run wget -qO- https://code.askimed.com/install/nf-test | bash
curl: (22) The requested URL returned error: 403

This happened on the CI of #124. It is unrelated to the pipeline itself and will come back at random.

Change

Use nf-core/setup-nf-test with a pinned version, mirroring how the workflow already installs Nextflow with nf-core/setup-nextflow:

• a pinned version means no API call to resolve "latest"
• the action caches the download in the runner tool cache
• GITHUB_TOKEN is set on that step so any API access it does make is authenticated

0.9.5 is the version the CI has been resolving to anyway, so nothing changes about what is tested.

Note

This touches the same workflow file as #124, but a different section (that PR only changes the NXF_VER matrix), so the two merge cleanly in either order.

[matthuska]

Not a comment about the specific changes here (which look good), but about the action files in general: most of the actions are out of date. We can set up dependabot to automatically create PRs to bump the action versions. I can set that up for you if you like, since I'm already doing it for a few other repos.

[hoelzer]

Thanks — agreed, and I've opened #134 with a .github/dependabot.yml for the github-actions ecosystem: target-branch: dev so the PRs land where every other PR here does rather than on main, monthly, minor/patch bumps grouped into one PR and majors on their own so they can be tested individually.

If you'd rather set this up yourself with whatever conventions you're using in the other repos, say the word and I'll close #134 in favour of yours — no attachment to my version.