lint: Require scripted-diff script to succeed
What the developer wrote
Authored by Hodlinator
lint: Require scripted-diff script to succeed
Previous version of commit-script-check.sh would succeed as long as git diff succeeded.
Can be verified through adding a failing scripted diff commit such as:
git commit --allow-empty -m $'scripted-diff: foo\n\n-BEGIN VERIFY SCRIPT-\nadsasd\n-END VERIFY SCRIPT-\n'
...and running...
cargo run --manifest-path ./test/lint/test_runner/Cargo.toml -- --lint=scripted_diff
What changed, and why it matters
This is a small fix to a developer linting tool that checks whether automated 'scripted-diff' commits actually run their embedded scripts. Previously, if the script itself failed, the check could still report success because the success/failure logic depended only on whether the git diff command succeeded. The patch makes the script's own exit status required for the overall check to pass. This is a tooling bug, not a vulnerability in Bitcoin Core's network or wallet code.
No urgent action needed beyond normal review and merge. This is a low-risk lint tooling fix. Users running Bitcoin Core nodes or wallets are unaffected. Developers relying on scripted-diff checks should ensure the patched version is used in CI.
Security signals we found
Logic error in CI lint script allowed failing verification scripts to be reported as passing
Fix enforces that scripted-diff embedded scripts must succeed before diff comparison
No change to consensus, networking, wallet, or cryptographic code
Evidence from the diff
The change modifies test/lint/commit-script-check.sh so that the embedded VERIFY SCRIPT must succeed (exit 0) before the subsequent git diff –exit-code check is evaluated. In the original code, the eval “$SCRIPT” result was not directly chained; the overall success was determined by git diff –exit-code “$commit” && echo OK || (echo Failed; false) || RET=1. A failing script could therefore leave the working tree unchanged, causing git diff to exit 0 and the check to report OK. The new line chains (eval “$SCRIPT”) && git diff …, so a script failure short-circuits to the failure path and sets RET=1. This is a correctness fix in CI lint tooling.
Changed components
test/lint/commit-script-check.shInspect captured patch +1 / −1
diff --git a/test/lint/commit-script-check.sh b/test/lint/commit-script-check.sh
index af7a0d2f..94b0708f 100755
--- a/test/lint/commit-script-check.sh
+++ b/test/lint/commit-script-check.sh
@@ -41,7 +41,7 @@ for commit in $(git rev-list --reverse "$1"); do
else
echo "Running script for: $commit" >&2
echo "$SCRIPT" >&2
- (eval "$SCRIPT")
+ (eval "$SCRIPT") && \
git --no-pager diff --exit-code "$commit" && echo "OK" >&2 || (echo "Failed" >&2; false) || RET=1
fi
git reset --quiet --hard HEAD
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.