doc: CI - Clarify how important `env -i` is and why
What the developer wrote
Authored by Hodlinator
doc: CI - Clarify how important `env -i` is and why
Would hopefully have helped me in this case: https://github.com/bitcoin/bitcoin/pull/31176#issuecomment-2526410039
Since then however, fd813bf863b1ffa91429de6342285b35bab2bfa4 also made sure a minimal environment is used.
What changed, and why it matters
This commit only updates a documentation file (ci/README.md) to explain more clearly why the CI system should be run inside a clean environment using the `env -i` command. It does not change any code, build scripts, or configuration that could affect Bitcoin Core's runtime security. There is no vulnerability or security fix here.
No action required; the commit is documentation-only and has no security relevance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is a four-line documentation edit in ci/README.md. It clarifies that env -i restricts environment-variable propagation when running CI locally. No executable code, CI logic, or build/test behavior is modified. The change is purely informational.
Changed components
ci/README.mdInspect captured patch +4 / −2
diff --git a/ci/README.md b/ci/README.md
index a7291284..91a3cee3 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -28,8 +28,10 @@ the CI locally you may need to reduce that entropy by running:
sudo sysctl -w vm.mmap_rnd_bits=28
```
-It is recommended to run the ci system in a clean env. To run the test stage
-with a specific configuration,
+It is recommended to run the CI system in a clean environment. The `env -i`
+command below ensures that *only* specified environment variables are propagated
+into the local CI.
+To run the test stage with a specific configuration:
```
env -i HOME="$HOME" PATH="$PATH" USER="$USER" bash -c 'FILE_ENV="./ci/test/00_setup_env_arm.sh" ./ci/test_run_all.sh'
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.