ci: Re-enable LINT_CI_SANITY_CHECK_COMMIT_SIG
What the developer wrote
Authored by MarcoFalke
ci: Re-enable LINT_CI_SANITY_CHECK_COMMIT_SIG
With the move from cirrus-ci to GHA, the CIRRUS_REPO_FULL_NAME env var
was always unset, never triggering the sanity check.
Fix this by introducing a new vendor-agnostic env var and setting it
properly.
What changed, and why it matters
This commit fixes a broken CI safety check. When Bitcoin Core moved from Cirrus CI to GitHub Actions, an automated check that verifies commit signatures on the official repository stopped running because it looked for an old environment variable that no longer existed. The patch introduces a new environment variable so the signature check runs again on non-pull-request pushes to the official bitcoin/bitcoin repository. It is a CI hardening fix, not a vulnerability in the Bitcoin software itself.
No immediate action required for users or node operators. For maintainers, verify that the re-enabled check correctly catches missing or invalid commit signatures in master/release branch pushes and that the GITHUB_REPOSITORY comparison is robust against forks.
Security signals we found
Restores a missing cryptographic signature verification step in CI
Fixes a regression caused by CI platform migration (Cirrus -> GitHub Actions)
Limits the check to the official bitcoin/bitcoin repository and non-PR events
No change to consensus, networking, wallet, or P2P code
Evidence from the diff
The commit re-enables the LINT_CI_SANITY_CHECK_COMMIT_SIG sanity check. In .github/ci-lint-exec.py, it sets LINT_CI_SANITY_CHECK_COMMIT_SIG=1 when the GitHub event is not a pull request and the repository is bitcoin/bitcoin. In ci/lint/06_script.sh, it replaces the stale CIRRUS_REPO_FULL_NAME condition with a check for LINT_CI_SANITY_CHECK_COMMIT_SIG=1. This restores signature verification for recent commits on the canonical repo after the CI migration from Cirrus to GitHub Actions.
Changed components
Bitcoin Core CI lint pipeline.github/ci-lint-exec.pyci/lint/06_script.shInspect captured patch +3 / −1
diff --git a/.github/ci-lint-exec.py b/.github/ci-lint-exec.py
index f0a6adca..73749acc 100755
--- a/.github/ci-lint-exec.py
+++ b/.github/ci-lint-exec.py
@@ -38,6 +38,8 @@ def main():
extra_env = []
if os.environ["GITHUB_EVENT_NAME"] == "pull_request":
extra_env = ["--env", "LINT_CI_IS_PR=1"]
+ if os.environ["GITHUB_EVENT_NAME"] != "pull_request" and os.environ["GITHUB_REPOSITORY"] == "bitcoin/bitcoin":
+ extra_env = ["--env", "LINT_CI_SANITY_CHECK_COMMIT_SIG=1"]
run([
"docker",
diff --git a/ci/lint/06_script.sh b/ci/lint/06_script.sh
index 536427f1..82e499c2 100755
--- a/ci/lint/06_script.sh
+++ b/ci/lint/06_script.sh
@@ -18,7 +18,7 @@ fi
RUST_BACKTRACE=1 cargo run --manifest-path "./test/lint/test_runner/Cargo.toml"
-if [ "$CIRRUS_REPO_FULL_NAME" = "bitcoin/bitcoin" ] && [ "${LINT_CI_IS_PR}" = "" ] ; then
+if [ "${LINT_CI_SANITY_CHECK_COMMIT_SIG}" = "1" ] ; then
# Sanity check only the last few commits to get notified of missing sigs,
# missing keys, or expired keys. Usually there is only one new merge commit
# per push on the master branch and a few commits on release branches, so
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.