From 5f7509da84eefcfe9841ddb0e7fe8a1bddfa3ca4 Mon Sep 17 00:00:00 2001
From: FriederikeHanssen <friederike.hanssen@seqera.io>
Date: Fri, 7 Aug 2026 19:47:26 +0200
Subject: [PATCH 1/6] move containeroptionsinto module

---
 modules/nf-core/gatk4spark/applybqsr/main.nf        | 8 ++++++++
 modules/nf-core/gatk4spark/baserecalibrator/main.nf | 8 ++++++++
 modules/nf-core/gatk4spark/markduplicates/main.nf   | 8 ++++++++
 3 files changed, 24 insertions(+)

diff --git a/modules/nf-core/gatk4spark/applybqsr/main.nf b/modules/nf-core/gatk4spark/applybqsr/main.nf
index 4aec53545cb6..3a81f4169473 100644
--- a/modules/nf-core/gatk4spark/applybqsr/main.nf
+++ b/modules/nf-core/gatk4spark/applybqsr/main.nf
@@ -7,6 +7,14 @@ process GATK4SPARK_APPLYBQSR {
         ? 'https://community-cr-prod.seqera.io/docker/registry/v2/blobs/sha256/49/498aea9c9bcaf736b9fb2a01366c1b7b38ccc0d38143178afc325d6a93241447/data'
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
+    // Spark's native UnixLoginModule fails to resolve a username for the container's UID
+    // (LoginException: invalid null input: name), because the container's own /etc/passwd
+    // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
+    // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
+    containerOptions { workflow.containerEngine in ['singularity', 'apptainer']
+        ? '--bind /etc/passwd:/etc/passwd:ro,/etc/group:/etc/group:ro'
+        : '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' }
+
     input:
     tuple val(meta), path(input), path(input_index), path(bqsr_table), path(intervals)
     path fasta
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/main.nf b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
index 2b8deb171f86..88998549bcfb 100644
--- a/modules/nf-core/gatk4spark/baserecalibrator/main.nf
+++ b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
@@ -7,6 +7,14 @@ process GATK4SPARK_BASERECALIBRATOR {
         ? 'https://community-cr-prod.seqera.io/docker/registry/v2/blobs/sha256/49/498aea9c9bcaf736b9fb2a01366c1b7b38ccc0d38143178afc325d6a93241447/data'
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
+    // Spark's native UnixLoginModule fails to resolve a username for the container's UID
+    // (LoginException: invalid null input: name), because the container's own /etc/passwd
+    // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
+    // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
+    containerOptions { workflow.containerEngine in ['singularity', 'apptainer']
+        ? '--bind /etc/passwd:/etc/passwd:ro,/etc/group:/etc/group:ro'
+        : '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' }
+
     input:
     tuple val(meta), path(input), path(input_index), path(intervals)
     path fasta
diff --git a/modules/nf-core/gatk4spark/markduplicates/main.nf b/modules/nf-core/gatk4spark/markduplicates/main.nf
index 2278afa1ef78..ed3ff8ef3bc8 100644
--- a/modules/nf-core/gatk4spark/markduplicates/main.nf
+++ b/modules/nf-core/gatk4spark/markduplicates/main.nf
@@ -7,6 +7,14 @@ process GATK4SPARK_MARKDUPLICATES {
         ? 'https://community-cr-prod.seqera.io/docker/registry/v2/blobs/sha256/49/498aea9c9bcaf736b9fb2a01366c1b7b38ccc0d38143178afc325d6a93241447/data'
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
+    // Spark's native UnixLoginModule fails to resolve a username for the container's UID
+    // (LoginException: invalid null input: name), because the container's own /etc/passwd
+    // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
+    // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
+    containerOptions { workflow.containerEngine in ['singularity', 'apptainer']
+        ? '--bind /etc/passwd:/etc/passwd:ro,/etc/group:/etc/group:ro'
+        : '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' }
+
     input:
     tuple val(meta), path(bam)
     path fasta

From 34343bd32e763c5e2ec3790829a86cf53a10cfb8 Mon Sep 17 00:00:00 2001
From: FriederikeHanssen <friederike.hanssen@seqera.io>
Date: Mon, 10 Aug 2026 13:30:02 +0200
Subject: [PATCH 2/6] Bind /etc/passwd only for docker and podman

Singularity/apptainer append the calling user to the container's
/etc/passwd themselves (config passwd = yes), charliecloud bind-mounts
generated passwd/group files, and shifter copies them in via etcPath.
None of them need the workaround, and charliecloud/shifter reject
docker's -v syntax that the old else branch was passing them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 modules/nf-core/gatk4spark/applybqsr/main.nf        | 4 +---
 modules/nf-core/gatk4spark/baserecalibrator/main.nf | 4 +---
 modules/nf-core/gatk4spark/markduplicates/main.nf   | 4 +---
 3 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/modules/nf-core/gatk4spark/applybqsr/main.nf b/modules/nf-core/gatk4spark/applybqsr/main.nf
index 3a81f4169473..ea38fe02d3c3 100644
--- a/modules/nf-core/gatk4spark/applybqsr/main.nf
+++ b/modules/nf-core/gatk4spark/applybqsr/main.nf
@@ -11,9 +11,7 @@ process GATK4SPARK_APPLYBQSR {
     // (LoginException: invalid null input: name), because the container's own /etc/passwd
     // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
     // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
-    containerOptions { workflow.containerEngine in ['singularity', 'apptainer']
-        ? '--bind /etc/passwd:/etc/passwd:ro,/etc/group:/etc/group:ro'
-        : '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' }
+    containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
 
     input:
     tuple val(meta), path(input), path(input_index), path(bqsr_table), path(intervals)
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/main.nf b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
index 88998549bcfb..c2344517036f 100644
--- a/modules/nf-core/gatk4spark/baserecalibrator/main.nf
+++ b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
@@ -11,9 +11,7 @@ process GATK4SPARK_BASERECALIBRATOR {
     // (LoginException: invalid null input: name), because the container's own /etc/passwd
     // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
     // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
-    containerOptions { workflow.containerEngine in ['singularity', 'apptainer']
-        ? '--bind /etc/passwd:/etc/passwd:ro,/etc/group:/etc/group:ro'
-        : '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' }
+    containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
 
     input:
     tuple val(meta), path(input), path(input_index), path(intervals)
diff --git a/modules/nf-core/gatk4spark/markduplicates/main.nf b/modules/nf-core/gatk4spark/markduplicates/main.nf
index ed3ff8ef3bc8..3b2dc4403be5 100644
--- a/modules/nf-core/gatk4spark/markduplicates/main.nf
+++ b/modules/nf-core/gatk4spark/markduplicates/main.nf
@@ -11,9 +11,7 @@ process GATK4SPARK_MARKDUPLICATES {
     // (LoginException: invalid null input: name), because the container's own /etc/passwd
     // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
     // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
-    containerOptions { workflow.containerEngine in ['singularity', 'apptainer']
-        ? '--bind /etc/passwd:/etc/passwd:ro,/etc/group:/etc/group:ro'
-        : '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' }
+    containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
 
     input:
     tuple val(meta), path(bam)

From 6e3e2c932430a3e603361677d4edde822314f987 Mon Sep 17 00:00:00 2001
From: FriederikeHanssen <friederike.hanssen@seqera.io>
Date: Mon, 10 Aug 2026 14:06:53 +0200
Subject: [PATCH 3/6] Fix gatk4spark test configs

Declare a default for params.module_suffix: the three applybqsr tests
that do not set it still evaluate `ext.suffix = { params.module_suffix
?: "" }`, and nextflow.enable.strict in tests/config/nf-test.config
turns the undefined-parameter warning into a hard error.

Also drop the /etc/passwd and /etc/group bind mounts from the test
configs' docker.runOptions, now that the modules request them
themselves via containerOptions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../nf-core/gatk4spark/applybqsr/tests/nextflow.config    | 8 +++++++-
 .../gatk4spark/baserecalibrator/tests/nextflow.config     | 3 ++-
 .../gatk4spark/markduplicates/tests/nextflow.config       | 3 ++-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config b/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config
index 3525ef1278ab..eeb008008cfb 100644
--- a/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config
+++ b/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config
@@ -1,4 +1,10 @@
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/passwd:/etc/passwd:ro -v /etc/shadow:/etc/shadow:ro -v /etc/group:/etc/group:ro -v $HOME:$HOME'
+// /etc/passwd and /etc/group are bind-mounted by the module's own containerOptions
+docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/shadow:/etc/shadow:ro -v $HOME:$HOME'
+
+// Tests that do not set this param still evaluate ext.suffix below, and
+// nextflow.enable.strict makes an undefined param a hard error.
+params.module_suffix = null
+
 process {
     withName: GATK4SPARK_APPLYBQSR {
         ext.prefix = { "${meta.id}" }
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config b/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
index 85142680d89f..70742a3111b5 100644
--- a/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
+++ b/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
@@ -1 +1,2 @@
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/passwd:/etc/passwd:ro -v /etc/shadow:/etc/shadow:ro -v /etc/group:/etc/group:ro -v $HOME:$HOME'
+// /etc/passwd and /etc/group are bind-mounted by the module's own containerOptions
+docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/shadow:/etc/shadow:ro -v $HOME:$HOME'
diff --git a/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config b/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config
index 85142680d89f..70742a3111b5 100644
--- a/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config
+++ b/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config
@@ -1 +1,2 @@
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/passwd:/etc/passwd:ro -v /etc/shadow:/etc/shadow:ro -v /etc/group:/etc/group:ro -v $HOME:$HOME'
+// /etc/passwd and /etc/group are bind-mounted by the module's own containerOptions
+docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/shadow:/etc/shadow:ro -v $HOME:$HOME'

From 93718d506b58d32aae548b972f5abba78f9deb20 Mon Sep 17 00:00:00 2001
From: FriederikeHanssen <friederike.hanssen@seqera.io>
Date: Mon, 10 Aug 2026 15:40:21 +0200
Subject: [PATCH 4/6] Reword comment so nf-core lint can parse the input block

nf-core lint's main.nf parser treats the literal token "input:" as the
start of the input block, even inside a // comment. The phrase
"invalid null input: name" quoting the Java exception therefore made
lint see zero inputs, failing correct_meta_inputs and escalating
main_nf_ext_key from a warning to a failure.

Note that `nf-core modules lint --fix` "fixes" this by rewriting
meta.yml to `input: []`, deleting every input definition.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 modules/nf-core/gatk4spark/applybqsr/main.nf        | 2 +-
 modules/nf-core/gatk4spark/baserecalibrator/main.nf | 2 +-
 modules/nf-core/gatk4spark/markduplicates/main.nf   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/nf-core/gatk4spark/applybqsr/main.nf b/modules/nf-core/gatk4spark/applybqsr/main.nf
index ea38fe02d3c3..0a13a1879266 100644
--- a/modules/nf-core/gatk4spark/applybqsr/main.nf
+++ b/modules/nf-core/gatk4spark/applybqsr/main.nf
@@ -8,7 +8,7 @@ process GATK4SPARK_APPLYBQSR {
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
     // Spark's native UnixLoginModule fails to resolve a username for the container's UID
-    // (LoginException: invalid null input: name), because the container's own /etc/passwd
+    // (LoginException "invalid null input" for name), because the container's own /etc/passwd
     // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
     // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
     containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/main.nf b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
index c2344517036f..77adb975307c 100644
--- a/modules/nf-core/gatk4spark/baserecalibrator/main.nf
+++ b/modules/nf-core/gatk4spark/baserecalibrator/main.nf
@@ -8,7 +8,7 @@ process GATK4SPARK_BASERECALIBRATOR {
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
     // Spark's native UnixLoginModule fails to resolve a username for the container's UID
-    // (LoginException: invalid null input: name), because the container's own /etc/passwd
+    // (LoginException "invalid null input" for name), because the container's own /etc/passwd
     // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
     // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
     containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }
diff --git a/modules/nf-core/gatk4spark/markduplicates/main.nf b/modules/nf-core/gatk4spark/markduplicates/main.nf
index 3b2dc4403be5..a2941d87adb4 100644
--- a/modules/nf-core/gatk4spark/markduplicates/main.nf
+++ b/modules/nf-core/gatk4spark/markduplicates/main.nf
@@ -8,7 +8,7 @@ process GATK4SPARK_MARKDUPLICATES {
         : 'community.wave.seqera.io/library/gatk4-spark:4.6.2.0--8b5cd67ee60a714e'}"
 
     // Spark's native UnixLoginModule fails to resolve a username for the container's UID
-    // (LoginException: invalid null input: name), because the container's own /etc/passwd
+    // (LoginException "invalid null input" for name), because the container's own /etc/passwd
     // has no entry for the host UID that docker.runOptions maps it to. Bind-mounting the
     // host's /etc/passwd/group (which do have that entry) fixes the native lookup.
     containerOptions { workflow.containerEngine in ['docker', 'podman'] ? '-v /etc/passwd:/etc/passwd:ro -v /etc/group:/etc/group:ro' : '' }

From 4139bc2f4ca54685701a44f7ad584fef072b1efe Mon Sep 17 00:00:00 2001
From: FriederikeHanssen <friederike.hanssen@seqera.io>
Date: Mon, 10 Aug 2026 16:42:50 +0200
Subject: [PATCH 5/6] Drop the docker.runOptions overrides from the test
 configs

The modules request /etc/passwd and /etc/group themselves now, and the
rest of the override was either duplication or unexplained: -u and
--platform are already set by the docker profile in
tests/config/nf-test.config, and /etc/shadow cannot be read by the
non-root uid the container runs as.

That leaves HOME. It is plausibly needed *because* of the passwd mount
-- the host user's entry points at a home directory that does not exist
in the container -- but nothing established that, and singularity gets
$HOME bound automatically, so it has never been exercised there. This
removes it to find out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test  | 1 -
 .../nf-core/gatk4spark/baserecalibrator/tests/nextflow.config   | 2 --
 modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test    | 1 -
 modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config | 2 --
 4 files changed, 6 deletions(-)
 delete mode 100644 modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
 delete mode 100644 modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config

diff --git a/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test b/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test
index d2b3238b0b34..c8863029ccd2 100644
--- a/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test
+++ b/modules/nf-core/gatk4spark/baserecalibrator/tests/main.nf.test
@@ -2,7 +2,6 @@ nextflow_process {
 
     name "Test Process GATK4SPARK_BASERECALIBRATOR"
     script "../main.nf"
-    config "./nextflow.config"
     process "GATK4SPARK_BASERECALIBRATOR"
 
     tag "modules"
diff --git a/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config b/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
deleted file mode 100644
index 70742a3111b5..000000000000
--- a/modules/nf-core/gatk4spark/baserecalibrator/tests/nextflow.config
+++ /dev/null
@@ -1,2 +0,0 @@
-// /etc/passwd and /etc/group are bind-mounted by the module's own containerOptions
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/shadow:/etc/shadow:ro -v $HOME:$HOME'
diff --git a/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test b/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test
index 3e7272bb4d91..4e939369aadb 100644
--- a/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test
+++ b/modules/nf-core/gatk4spark/markduplicates/tests/main.nf.test
@@ -2,7 +2,6 @@ nextflow_process {
 
     name "Test Process GATK4SPARK_MARKDUPLICATES"
     script "../main.nf"
-    config "./nextflow.config"
     process "GATK4SPARK_MARKDUPLICATES"
 
     tag "modules"
diff --git a/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config b/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config
deleted file mode 100644
index 70742a3111b5..000000000000
--- a/modules/nf-core/gatk4spark/markduplicates/tests/nextflow.config
+++ /dev/null
@@ -1,2 +0,0 @@
-// /etc/passwd and /etc/group are bind-mounted by the module's own containerOptions
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/shadow:/etc/shadow:ro -v $HOME:$HOME'

From beb9a45fa7f575f3efd0d36f76d01a980fe7f1c7 Mon Sep 17 00:00:00 2001
From: FriederikeHanssen <friederike.hanssen@seqera.io>
Date: Mon, 10 Aug 2026 16:43:31 +0200
Subject: [PATCH 6/6] Take the output format as an input instead of ext.suffix

nf-core lint rejects ext.suffix (main_nf_ext_key), and the non-Spark
gatk4/applybqsr already solves this by taking `val output_suffix` as a
process input. Match it, so the two applybqsr modules agree.

This also removes tests/nextflow.config entirely, along with the
params.module_suffix indirection that only existed to feed ext.suffix
through nf-test.

Output emits, filenames and snapshots are unchanged. The stub keeps
gatk4spark's own file layout rather than the sibling's, which writes a
different set of index files.

Breaking change: callers gain a fifth input and must pass "bam" or
"cram" instead of setting ext.suffix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 modules/nf-core/gatk4spark/applybqsr/main.nf  |  5 +++--
 modules/nf-core/gatk4spark/applybqsr/meta.yml |  3 +++
 .../gatk4spark/applybqsr/tests/main.nf.test   | 19 ++++++-------------
 .../applybqsr/tests/nextflow.config           | 13 -------------
 4 files changed, 12 insertions(+), 28 deletions(-)
 delete mode 100644 modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config

diff --git a/modules/nf-core/gatk4spark/applybqsr/main.nf b/modules/nf-core/gatk4spark/applybqsr/main.nf
index 0a13a1879266..a87a06da9dda 100644
--- a/modules/nf-core/gatk4spark/applybqsr/main.nf
+++ b/modules/nf-core/gatk4spark/applybqsr/main.nf
@@ -18,6 +18,7 @@ process GATK4SPARK_APPLYBQSR {
     path fasta
     path fai
     path dict
+    val output_suffix
 
     output:
     tuple val(meta), path("${prefix}.bam"), emit: bam, optional: true
@@ -32,7 +33,7 @@ process GATK4SPARK_APPLYBQSR {
     def args = task.ext.args ?: ''
     prefix = task.ext.prefix ?: "${meta.id}"
     // suffix can only be bam or cram, cram being the sensible default
-    def suffix = task.ext.suffix && task.ext.suffix == "bam" ? "bam" : "cram"
+    def suffix = output_suffix == "bam" ? "bam" : "cram"
     def interval_command = intervals ? "--intervals ${intervals}" : ""
 
     def avail_mem = 3072
@@ -57,7 +58,7 @@ process GATK4SPARK_APPLYBQSR {
 
     stub:
     prefix = task.ext.prefix ?: "${meta.id}"
-    def suffix = task.ext.suffix ?: "cram"
+    def suffix = output_suffix == "bam" ? "bam" : "cram"
     """
     touch ${prefix}.${suffix}
     if [[ ${suffix} == bam ]]; then
diff --git a/modules/nf-core/gatk4spark/applybqsr/meta.yml b/modules/nf-core/gatk4spark/applybqsr/meta.yml
index 4d5c25821c4d..29f894ab8e51 100644
--- a/modules/nf-core/gatk4spark/applybqsr/meta.yml
+++ b/modules/nf-core/gatk4spark/applybqsr/meta.yml
@@ -57,6 +57,9 @@ input:
       description: GATK sequence dictionary
       pattern: "*.dict"
       ontologies: []
+  - output_suffix:
+      type: string
+      description: Output file format, either "bam" or "cram" (cram is the default)
 output:
   bam:
     - - meta:
diff --git a/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test b/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test
index b0f1ce00f22b..677ff9665cf8 100644
--- a/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test
+++ b/modules/nf-core/gatk4spark/applybqsr/tests/main.nf.test
@@ -2,7 +2,6 @@ nextflow_process {
 
     name "Test Process GATK4SPARK_APPLYBQSR"
     script "../main.nf"
-    config "./nextflow.config"
     process "GATK4SPARK_APPLYBQSR"
 
     tag "modules"
@@ -13,10 +12,6 @@ nextflow_process {
     test("sarscov2 - bam") {
 
         when {
-            params {
-                module_suffix = "bam"
-            }
-
             process {
                 """
                 input[0] = [
@@ -29,6 +24,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "bam"
                 """
             }
         }
@@ -56,6 +52,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "cram"
                 """
             }
         }
@@ -74,10 +71,6 @@ nextflow_process {
     test("sarscov2 - bam - intervals") {
 
         when {
-            params {
-                module_suffix = "bam"
-            }
-
             process {
                 """
                 input[0] = [
@@ -90,6 +83,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "bam"
                 """
             }
         }
@@ -117,6 +111,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.dict', checkIfExists: true)
+                input[4] = "cram"
                 """
             }
         }
@@ -149,6 +144,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/homo_sapiens/genome/genome.dict', checkIfExists: true)
+                input[4] = "cram"
                 """
             }
         }
@@ -165,10 +161,6 @@ nextflow_process {
 
         options "-stub"
         when {
-            params {
-                module_suffix = "bam"
-            }
-
             process {
                 """
                 input[0] = [
@@ -181,6 +173,7 @@ nextflow_process {
                 input[1] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta', checkIfExists: true)
                 input[2] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.fasta.fai', checkIfExists: true)
                 input[3] = file(params.modules_testdata_base_path + 'genomics/sarscov2/genome/genome.dict', checkIfExists: true)
+                input[4] = "bam"
                 """
             }
         }
diff --git a/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config b/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config
deleted file mode 100644
index eeb008008cfb..000000000000
--- a/modules/nf-core/gatk4spark/applybqsr/tests/nextflow.config
+++ /dev/null
@@ -1,13 +0,0 @@
-// /etc/passwd and /etc/group are bind-mounted by the module's own containerOptions
-docker.runOptions = '-u $(id -u):$(id -g) --platform=linux/amd64 -e "HOME=${HOME}" -v /etc/shadow:/etc/shadow:ro -v $HOME:$HOME'
-
-// Tests that do not set this param still evaluate ext.suffix below, and
-// nextflow.enable.strict makes an undefined param a hard error.
-params.module_suffix = null
-
-process {
-    withName: GATK4SPARK_APPLYBQSR {
-        ext.prefix = { "${meta.id}" }
-        ext.suffix = { params.module_suffix ?: "" }
-    }
-}