ci: Pin native tests on cross-builds to same commit
What the developer wrote
Authored by MarcoFalke
ci: Pin native tests on cross-builds to same commit
What changed, and why it matters
This commit changes Bitcoin Core's GitHub Actions CI workflow so that when a Windows cross-build job runs, a separate job records the exact commit ID being built, and the follow-on native Windows test job checks out that same recorded commit. This prevents a race condition where a new commit pushed during the cross-build could cause the native tests to run against different source code than what was compiled. It is a CI reliability improvement, not a security fix.
No security action required. Treat as a normal CI hardening change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch adds a new record-frozen-commit job in .github/workflows/ci.yml that outputs git rev-parse HEAD. The windows-cross and windows-native-test jobs now depend on it and use actions/checkout@v5 with ref: ${{ needs.record-frozen-commit.outputs.commit }} instead of the shared *CHECKOUT anchor (which presumably checked out the default ref). This pins the test job to the exact commit used by the build job, avoiding checkout drift between jobs in the same workflow run.
Changed components
.github/workflows/ci.ymlInspect captured patch +25 / −5
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2563c2e0..f5dc7721 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ defaults:
jobs:
runners:
- name: 'determine runners'
+ name: '[meta] determine runners'
runs-on: ubuntu-latest
outputs:
provider: ${{ steps.runners.outputs.provider }}
@@ -343,9 +343,23 @@ jobs:
run: |
py -3 test/fuzz/test_runner.py --par $NUMBER_OF_PROCESSORS --loglevel DEBUG "${RUNNER_TEMP}/qa-assets/fuzz_corpora"
+ record-frozen-commit:
+ # Record frozen commit, so that the native tests on cross-builds can run on
+ # the exact same commit id of the build.
+ name: '[meta] record frozen commit'
+ runs-on: ubuntu-latest
+ outputs:
+ commit: ${{ steps.record-commit.outputs.commit }}
+ steps:
+ - *ANNOTATION_PR_NUMBER
+ - *CHECKOUT
+ - name: Record commit
+ id: record-commit
+ run: echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
windows-cross:
name: 'Windows-cross to x86_64, ${{ matrix.crt }}'
- needs: runners
+ needs: [runners, record-frozen-commit]
runs-on: ${{ needs.runners.outputs.provider == 'cirrus' && 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-sm' || 'ubuntu-24.04' }}
if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}
@@ -368,7 +382,10 @@ jobs:
steps:
- *ANNOTATION_PR_NUMBER
- - *CHECKOUT
+ - name: Checkout
+ uses: actions/checkout@v5
+ with:
+ ref: ${{ needs.record-frozen-commit.outputs.commit }}
- name: Configure environment
uses: ./.github/actions/configure-environment
@@ -402,7 +419,7 @@ jobs:
windows-native-test:
name: 'Windows, ${{ matrix.crt }}, test cross-built'
runs-on: windows-2022
- needs: windows-cross
+ needs: [windows-cross, record-frozen-commit]
strategy:
fail-fast: false
@@ -421,7 +438,10 @@ jobs:
steps:
- *ANNOTATION_PR_NUMBER
- - *CHECKOUT
+ - name: Checkout
+ uses: actions/checkout@v5
+ with:
+ ref: ${{ needs.record-frozen-commit.outputs.commit }}
- name: Download built executables
uses: actions/download-artifact@v5
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.