ci: [refactor] Rename CIRRUS_PR env var to LINT_CI_IS_PR
What changed, and why it matters
This is a routine internal cleanup of the Bitcoin Core continuous integration (CI) lint scripts. It renames an environment variable from a Cirrus-specific name to a provider-agnostic one and enables a stricter shell option for catching pipeline failures. There is no user-facing change and no security-relevant behavior change.
No action required. This is a benign CI refactor with no security implications.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit refactors CI lint execution. In .github/ci-lint-exec.py, the CIRRUS_PR flag is renamed to LINT_CI_IS_PR and passed via –env. In ci/lint/06_script.sh, the shell set flags are expanded from ‘set -ex’ to ‘set -o errexit -o pipefail -o xtrace’, and references to CIRRUS_PR are replaced with LINT_CI_IS_PR. The change is explicitly labeled as a refactor and is preparatory for a subsequent commit.
Changed components
.github/ci-lint-exec.pyci/lint/06_script.shInspect captured patch +11 / −9
diff --git a/.github/ci-lint-exec.py b/.github/ci-lint-exec.py
index b0f78983..f0a6adca 100755
--- a/.github/ci-lint-exec.py
+++ b/.github/ci-lint-exec.py
@@ -35,13 +35,15 @@ def main():
time.sleep(3)
run(build_cmd)
- CIRRUS_PR_FLAG = []
- if os.environ.get("GITHUB_EVENT_NAME") == "pull_request":
- CIRRUS_PR_FLAG = ["-e", "CIRRUS_PR=1"]
+ extra_env = []
+ if os.environ["GITHUB_EVENT_NAME"] == "pull_request":
+ extra_env = ["--env", "LINT_CI_IS_PR=1"]
run([
- "docker", "run", "--rm",
- *CIRRUS_PR_FLAG,
+ "docker",
+ "run",
+ "--rm",
+ *extra_env,
f"--volume={os.getcwd()}:/bitcoin",
CONTAINER_NAME,
])
diff --git a/ci/lint/06_script.sh b/ci/lint/06_script.sh
index 6d637c2a..536427f1 100755
--- a/ci/lint/06_script.sh
+++ b/ci/lint/06_script.sh
@@ -6,19 +6,19 @@
export LC_ALL=C
-set -ex
+set -o errexit -o pipefail -o xtrace
-if [ -n "$CIRRUS_PR" ]; then
+if [ -n "${LINT_CI_IS_PR}" ]; then
export COMMIT_RANGE="HEAD~..HEAD"
if [ "$(git rev-list -1 HEAD)" != "$(git rev-list -1 --merges HEAD)" ]; then
- echo "Error: The top commit must be a merge commit, usually the remote 'pull/${PR_NUMBER}/merge' branch."
+ echo "Error: The top commit must be a merge commit, usually the remote 'pull/<PR_NUMBER>/merge' branch."
false
fi
fi
RUST_BACKTRACE=1 cargo run --manifest-path "./test/lint/test_runner/Cargo.toml"
-if [ "$CIRRUS_REPO_FULL_NAME" = "bitcoin/bitcoin" ] && [ "$CIRRUS_PR" = "" ] ; then
+if [ "$CIRRUS_REPO_FULL_NAME" = "bitcoin/bitcoin" ] && [ "${LINT_CI_IS_PR}" = "" ] ; then
# Sanity check only the last few commits to get notified of missing sigs,
# missing keys, or expired keys. Usually there is only one new merge commit
# per push on the master branch and a few commits on release branches, so
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.