What the developer wrote
Authored by MarcoFalke
ci: Checkout latest merged pulls
What changed, and why it matters
This commit changes Bitcoin Core's GitHub Actions CI configuration so that when a CI job is re-run for a pull request, it checks out the latest merged state of that PR branch rather than a possibly stale cached version. The change is purely in the CI workflow file and does not touch Bitcoin Core's actual code, consensus logic, wallet, or networking. It is a reliability/correctness improvement for automated testing, not a fix for a vulnerability in the Bitcoin software itself.
No security response required. Treat as a normal CI reliability improvement. Reviewers may optionally verify the GitHub Actions expression behaves as intended for re-runs and non-PR events.
Security signals we found
CI configuration change only
No modification of application, consensus, wallet, or P2P code
Change addresses CI checkout consistency, not product security
No secrets, permissions, or runner hardening changes
Evidence from the diff
The patch refactors the workflow to use a YAML anchor (&CHECKOUT) and an anchor for the ref expression (&CHECKOUT_REF_TMPL). It sets actions/checkout’s ref to ${{ github.event_name == 'pull_request' && github.ref || '' }} for most jobs, and reuses that expression in the one job that already had a with: block. This ensures checkout uses the PR merge ref on pull_request events, avoiding stale refs on workflow re-runs. No application code is modified.
Changed components
.github/workflows/ci.ymlInspect captured patch +10 / −9
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6876b832..b8958602 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -132,8 +132,12 @@ jobs:
BASE_ROOT_DIR: ${{ github.workspace }}
steps:
- - name: Checkout
+ - &CHECKOUT
+ name: Checkout
uses: actions/checkout@v5
+ with:
+ # Ensure the latest merged pull request state is used, even on re-runs.
+ ref: &CHECKOUT_REF_TMPL ${{ github.event_name == 'pull_request' && github.ref || '' }}
- name: Clang version
run: |
@@ -199,8 +203,7 @@ jobs:
job-name: 'Windows native, fuzz, VS 2022'
steps:
- - name: Checkout
- uses: actions/checkout@v5
+ - *CHECKOUT
- name: Configure Developer Command Prompt for Microsoft Visual C++
# Using microsoft/setup-msbuild is not enough.
@@ -310,8 +313,7 @@ jobs:
DANGER_CI_ON_HOST_FOLDERS: 1
steps:
- - name: Checkout
- uses: actions/checkout@v5
+ - *CHECKOUT
- name: Configure environment
uses: ./.github/actions/configure-environment
@@ -351,8 +353,7 @@ jobs:
TEST_RUNNER_TIMEOUT_FACTOR: 40
steps:
- - name: Checkout
- uses: actions/checkout@v5
+ - *CHECKOUT
- name: Download built executables
uses: actions/download-artifact@v4
@@ -493,8 +494,7 @@ jobs:
file-env: './ci/test/00_setup_env_native_msan.sh'
steps:
- - name: Checkout
- uses: actions/checkout@v5
+ - *CHECKOUT
- name: Configure environment
uses: ./.github/actions/configure-environment
@@ -537,6 +537,7 @@ jobs:
- name: Checkout
uses: actions/checkout@v5
with:
+ ref: *CHECKOUT_REF_TMPL
fetch-depth: 0
- name: Configure Docker
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.