ci: Consistenly only cache on the default branch
What the developer wrote
Authored by MarcoFalke
ci: Consistenly only cache on the default branch
What changed, and why it matters
This change adjusts Bitcoin Core's GitHub Actions CI workflow so that build caches are only saved when running on the repository's default branch (e.g., 'master'). Previously, caches could be saved from non-default branches too. The patch is a hardening measure: it reduces the risk that a malicious or compromised branch could poison shared CI caches used by later builds. It is not a fix for an active exploit in Bitcoin Core's shipped software, but rather a defensive tightening of the project's own build infrastructure.
No immediate action required for Bitcoin Core users or operators. This is an internal CI hardening change. Reviewers should verify that all cache save steps in the workflow now include the default-branch guard, and consider applying the same pattern to any other cache write steps in the repository.
Security signals we found
CI cache write scope narrowed to default branch only
Prevents potential cache-poisoning from arbitrary branches or tags
Aligns with GitHub Actions cache security best practices
No change to shipped node software or consensus code
Evidence from the diff
The commit modifies two ‘Save cache’ steps in .github/workflows/ci.yml: the Ccache save step and the vcpkg binary cache save step. It adds the condition github.ref_name == github.event.repository.default_branch to the existing if expressions. GitHub Actions cache entries are scoped to a key and are accessible across branches in the same repository. Saving caches from non-default branches can allow cache poisoning if a branch writes crafted compiler outputs or vcpkg binaries under a key that later default-branch or pull-request runs may restore. By restricting saves to the default branch, the project ensures only trusted, reviewed default-branch artifacts populate the cache. This is consistent with GitHub’s own guidance and prior project practice for other cache steps.
Changed components
.github/workflows/ci.ymlGitHub Actions CI cache save steps (Ccache and vcpkg)Inspect captured patch +2 / −2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0265583b..944da984 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -196,7 +196,7 @@ jobs:
- name: Save Ccache cache
uses: actions/cache/save@v4
- if: github.event_name != 'pull_request' && steps.ccache-cache.outputs.cache-hit != 'true'
+ if: github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch && steps.ccache-cache.outputs.cache-hit != 'true'
with:
path: ${{ env.CCACHE_DIR }}
# https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
@@ -276,7 +276,7 @@ jobs:
- name: Save vcpkg binary cache
uses: actions/cache/save@v4
- if: github.event_name != 'pull_request' && steps.vcpkg-binary-cache.outputs.cache-hit != 'true' && matrix.job-type == 'standard'
+ if: github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch && steps.vcpkg-binary-cache.outputs.cache-hit != 'true' && matrix.job-type == 'standard'
with:
path: ~/AppData/Local/vcpkg/archives
key: ${{ github.job }}-vcpkg-binary-${{ hashFiles('cmake_version', 'msbuild_version', 'toolset_version', 'vcpkg.json') }}
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.