ci: Run macos tasks in a git archive, not git checkout
What the developer wrote
Authored by MarcoFalke
ci: Run macos tasks in a git archive, not git checkout
This confirms that compiling this way is possible at all.
What changed, and why it matters
This is a routine change to Bitcoin Core's automated testing setup. It switches the macOS CI jobs from running directly on a Git checkout to running on a snapshot of the source code created by 'git archive'. The commit message says the goal is simply to verify that compilation works this way. There is no security-relevant change here.
No security action needed. This is a benign CI workflow change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies .github/workflows/ci.yml for macOS CI jobs. It changes BASE_ROOT_DIR to point into a new repo_archive directory, adds a step that creates a tar archive of HEAD with a repo_archive/ prefix, and adjusts the CI script invocation to run inside that extracted archive. This tests that the build system can operate from a git archive export rather than a full git working tree. No code, build logic, secrets, permissions, or network behavior is changed in a security-relevant way.
Changed components
.github/workflows/ci.ymlInspect captured patch +10 / −2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ffaafe3..d2eecbfb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -138,7 +138,7 @@ jobs:
env:
DANGER_RUN_CI_ON_HOST: 1
- BASE_ROOT_DIR: ${{ github.workspace }}
+ BASE_ROOT_DIR: ${{ github.workspace }}/repo_archive
steps:
- &CHECKOUT
@@ -176,8 +176,16 @@ jobs:
key: ${{ github.job }}-${{ matrix.job-type }}-ccache-${{ github.run_id }}
restore-keys: ${{ github.job }}-${{ matrix.job-type }}-ccache-
+ - name: Create git archive
+ run: |
+ git log -1
+ git archive --format=tar --prefix=repo_archive/ --output=repo.tar HEAD
+ tar -xf repo.tar
+
- name: CI script
- run: ./ci/test_run_all.sh
+ run: |
+ cd repo_archive
+ ./ci/test_run_all.sh
env:
FILE_ENV: ${{ matrix.file-env }}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.