ci: Add check_manifests to ci-windows.py
What changed, and why it matters
This commit moves the Windows CI manifest-checking logic from inline PowerShell in a GitHub Actions workflow file into a shared Python helper script. It does not change what is checked, only where the code lives and where a temporary bitcoind.manifest file is written during the CI run. There is no user-facing or security-relevant behavior change.
No security action needed. This is a routine CI refactor.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff refactors the Windows CI pipeline. The PowerShell block in .github/workflows/ci.yml that invokes mt.exe to extract and validate embedded application manifests is replaced by a call to .github/ci-windows.py check_manifests. A new check_manifests(ci_type) function is added to ci-windows.py, mirroring the original logic: extract bitcoind.exe’s manifest with mt.exe, print it, skip known manifest-less executables, and validate manifests on the remaining Release/*.exe files. The only functional difference is that bitcoind.manifest is now written to build/bin/Release/ instead of build/.
Changed components
.github/ci-windows.py.github/workflows/ci.ymlInspect captured patch +44 / −18
diff --git a/.github/ci-windows.py b/.github/ci-windows.py
index 693a0154..7697021c 100755
--- a/.github/ci-windows.py
+++ b/.github/ci-windows.py
@@ -8,6 +8,7 @@ import os
import shlex
import subprocess
import sys
+from pathlib import Path
def run(cmd, **kwargs):
@@ -69,6 +70,45 @@ def build():
run(command + ["-j1", "--verbose"])
+def check_manifests(ci_type):
+ if ci_type != "standard":
+ print(f"Skipping manifest validation for '{ci_type}' ci type.")
+ return
+
+ release_dir = Path.cwd() / "build" / "bin" / "Release"
+ manifest_path = release_dir / "bitcoind.manifest"
+ cmd_bitcoind_manifest = [
+ "mt.exe",
+ "-nologo",
+ f"-inputresource:{release_dir / 'bitcoind.exe'}",
+ f"-out:{manifest_path}",
+ ]
+ run(cmd_bitcoind_manifest)
+ print(manifest_path.read_text())
+
+ skips = { # Skip as they currently do not have manifests
+ "fuzz.exe",
+ "bench_bitcoin.exe",
+ "test_bitcoin-qt.exe",
+ "test_kernel.exe",
+ "bitcoin-chainstate.exe",
+ }
+ for entry in release_dir.iterdir():
+ if entry.suffix.lower() != ".exe":
+ continue
+ if entry.name in skips:
+ print(f"Skipping {entry.name} (no manifest present)")
+ continue
+ print(f"Checking {entry.name}")
+ cmd_check_manifest = [
+ "mt.exe",
+ "-nologo",
+ f"-inputresource:{entry}",
+ "-validate_manifest",
+ ]
+ run(cmd_check_manifest)
+
+
def prepare_tests(ci_type):
if ci_type == "standard":
run([sys.executable, "-m", "pip", "install", "pyzmq"])
@@ -150,6 +190,7 @@ def main():
steps = [
"generate",
"build",
+ "check_manifests",
"prepare_tests",
"run_tests",
]
@@ -160,6 +201,8 @@ def main():
generate(args.ci_type)
elif args.step == "build":
build()
+ elif args.step == "check_manifests":
+ check_manifests(args.ci_type)
elif args.step == "prepare_tests":
prepare_tests(args.ci_type)
elif args.step == "run_tests":
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d09433fc..d862a88c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -284,25 +284,8 @@ jobs:
py -3 .github/ci-windows.py ${{ matrix.job-type }} build
- name: Check executable manifests
- if: matrix.job-type == 'standard'
- working-directory: build
- shell: pwsh -Command "$PSVersionTable; $PSNativeCommandUseErrorActionPreference = $true; $ErrorActionPreference = 'Stop'; & '{0}'"
run: |
- mt.exe -nologo -inputresource:bin\Release\bitcoind.exe -out:bitcoind.manifest
- Get-Content bitcoind.manifest
-
- Get-ChildItem -Filter "bin\Release\*.exe" | ForEach-Object {
- $exeName = $_.Name
-
- # Skip as they currently do not have manifests
- if ($exeName -eq "fuzz.exe" -or $exeName -eq "bench_bitcoin.exe" -or $exeName -eq "test_bitcoin-qt.exe" -or $exeName -eq "test_kernel.exe" -or $exeName -eq "bitcoin-chainstate.exe") {
- Write-Host "Skipping $exeName (no manifest present)"
- return
- }
-
- Write-Host "Checking $exeName"
- & mt.exe -nologo -inputresource:$_.FullName -validate_manifest
- }
+ py -3 .github/ci-windows.py ${{ matrix.job-type }} check_manifests
- name: Prepare tests
run: |
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.