ci: remove 3rd party js from windows dll gha job
What the developer wrote
Authored by Max Edwards
ci: remove 3rd party js from windows dll gha job
We can use vswhere.exe directly to create a vs developer
prompt and so can remove this third party dependency.
Co-authored-by: David Gumberg <davidzgumberg@gmail.com>
What changed, and why it matters
This change updates a Bitcoin Core GitHub Actions workflow so that it no longer downloads and runs a third-party JavaScript action (ilammy/msvc-dev-cmd) to set up the Microsoft Visual Studio build environment on Windows. Instead, it uses a small PowerShell script that runs a tool already installed with Visual Studio (vswhere.exe) and then calls the official Microsoft batch file (vsdevcmd.bat). The main benefit is reducing supply-chain risk: the project no longer depends on an external, pinned-but-third-party action that could be compromised or behave unexpectedly. There is no direct vulnerability being fixed in Bitcoin Core's own code.
No urgent action required. Review the PowerShell script for correctness and robustness, ensure vswhere.exe path handling works on all supported Windows runner images, and consider pinning the runner image version if not already pinned. Treat as routine CI hardening.
Security signals we found
Removes third-party GitHub Action dependency from CI pipeline
Reduces supply-chain attack surface in build workflow
Uses Microsoft-shipped tooling (vswhere.exe, vsdevcmd.bat) instead of community action wrapper
No direct code vulnerability or exploit mechanism present in diff
Evidence from the diff
The commit modifies .github/workflows/ci.yml in the Windows DLL CI job. It replaces the third-party GitHub Action ilammy/msvc-dev-cmd@v1 with a native PowerShell step that invokes vswhere.exe to locate the latest Visual Studio installation, then runs vsdevcmd.bat -arch=x64 and exports the resulting environment variables to GITHUB_ENV. This removes a third-party dependency from the CI supply chain. The change is defensive hardening rather than a patch for a known exploitable bug.
Changed components
.github/workflows/ci.ymlWindows DLL CI jobVisual Studio developer prompt setup stepInspect captured patch +9 / −5
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 52d21ef3..91a7b53f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -211,11 +211,15 @@ jobs:
steps:
- *CHECKOUT
- - name: Configure Developer Command Prompt for Microsoft Visual C++
- # Using microsoft/setup-msbuild is not enough.
- uses: ilammy/msvc-dev-cmd@v1
- with:
- arch: x64
+ - name: Set up VS Developer Prompt
+ shell: pwsh -Command "$PSVersionTable; $PSNativeCommandUseErrorActionPreference = $true; $ErrorActionPreference = 'Stop'; & '{0}'"
+ run: |
+ $vswherePath = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+ $installationPath = & $vswherePath -latest -property installationPath
+ & "${env:COMSPEC}" /s /c "`"$installationPath\Common7\Tools\vsdevcmd.bat`" -arch=x64 -no_logo && set" | foreach-object {
+ $name, $value = $_ -split '=', 2
+ echo "$name=$value" >> $env:GITHUB_ENV
+ }
- name: Get tool information
shell: pwsh
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.