What the developer wrote
Authored by willcl-ark
ci: expose all ACTIONS_* vars
When using `docker buildx build` in conjunction with the `gha` backend
cache type, it's important to specify the URL and TOKEN needed to
authenticate.
On Cirrus runners this is working with only `ACTIONS_CACHE_URL` and
`ACTIONS_RUNTIME_TOKEN`, but this is not enough for the GitHub backend.
Fix this by exporting all `ACTIONS_*` variables.
This fixes cache restore/save on forks or where GH-hosted runners are
being used.
What changed, and why it matters
This change updates a Bitcoin Core GitHub Actions helper so that every environment variable starting with 'ACTIONS_' is passed into Docker builds, rather than only two specific ones. The stated goal is to fix Docker build caching on forks and GitHub-hosted runners. It is a CI/infrastructure-only change and does not alter Bitcoin node code, consensus rules, wallet handling, or network behavior. There is no direct security vulnerability in the diff, but it slightly widens the set of GitHub Actions secrets/tokens that are forwarded into the Docker build environment.
No immediate security action required. Reviewers may want to confirm that no overly sensitive ACTIONS_ variables are unintentionally exposed to untrusted Docker build steps, and consider whether an allowlist would be safer than a prefix wildcard. Treat as a normal CI improvement.
Security signals we found
CI secret forwarding scope expanded from two known variables to all variables matching ACTIONS_*
No change to Bitcoin Core node, consensus, wallet, or P2P code
No authentication bypass, buffer overflow, or cryptographic weakness introduced in the diff
Potential minor concern: broader secret exposure surface inside Docker build environment if an ACTIONS_ variable contains sensitive material not intended for build context
Evidence from the diff
The commit modifies .github/actions/configure-docker/action.yml. Previously it explicitly exported ACTIONS_CACHE_URL and ACTIONS_RUNTIME_TOKEN. Now it iterates over all process.env keys and exports any key beginning with ACTIONS_. The change is framed as fixing docker buildx build with the gha backend cache type, which needs additional variables beyond the two previously exported. This is a CI configuration change only; no C/C++/Python/Rust source code is changed.
Changed components
.github/actions/configure-docker/action.ymlInspect captured patch +6 / −2
diff --git a/.github/actions/configure-docker/action.yml b/.github/actions/configure-docker/action.yml
index 09a1e6fd..9c2ce93f 100644
--- a/.github/actions/configure-docker/action.yml
+++ b/.github/actions/configure-docker/action.yml
@@ -22,8 +22,12 @@ runs:
uses: actions/github-script@v6
with:
script: |
- core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
- core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
+ Object.keys(process.env).forEach(function (key) {
+ if (key.startsWith('ACTIONS_')) {
+ core.info(`Exporting ${key}`);
+ core.exportVariable(key, process.env[key]);
+ }
+ });
- name: Construct docker build cache args
shell: bash
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.