ci: Move buildx command to python script
What the developer wrote
Authored by MarcoFalke
ci: Move buildx command to python script
This has a few benefits:
* The shellcheck SC2086 warning is disabled for the whole command, but
is only needed for the DOCKER_BUILD_CACHE_ARG env var. So in Python,
only pass this one env var to shlex.split() for proper word splitting.
* Future logic improvements can be implemented in Python.
The comments are moved, which can be checked via the git options:
--color-moved=dimmed-zebra --color-moved-ws=ignore-all-space
What changed, and why it matters
This commit is a routine cleanup of Bitcoin Core's continuous integration (CI) scripts. It moves a Docker image-building command from a shell script into a Python script. There is no security-relevant change here—only how the CI tooling internally constructs the same Docker command.
No security action needed. Treat as normal CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch refactors CI container setup by relocating the docker buildx build invocation from ci/test/02_run_container.sh to ci/test/02_run_container.py. The Python version reconstructs the same command as a list and uses shlex.split() only for the optional DOCKER_BUILD_CACHE_ARG environment variable, avoiding a prior shellcheck SC2086 suppression. The functional behavior (image build arguments, labels, tags, platform, cache arg handling) is unchanged. The shell script now only creates Docker volumes.
Changed components
ci/test/02_run_container.pyci/test/02_run_container.shInspect captured patch +21 / −16
diff --git a/ci/test/02_run_container.py b/ci/test/02_run_container.py
index 513ecaca..c1c6b940 100755
--- a/ci/test/02_run_container.py
+++ b/ci/test/02_run_container.py
@@ -45,6 +45,27 @@ def main():
file.write(f"{k}={v}\n")
run(["cat", env_file])
+ if not os.getenv("DANGER_RUN_CI_ON_HOST"):
+ CI_IMAGE_LABEL = "bitcoin-ci-test"
+
+ # Use buildx unconditionally
+ # Using buildx is required to properly load the correct driver, for use with registry caching. Neither build, nor BUILDKIT=1 currently do this properly
+ cmd_build = ["docker", "buildx", "build"]
+ cmd_build += [
+ f"--file={os.environ['BASE_READ_ONLY_DIR']}/ci/test_imagefile",
+ f"--build-arg=CI_IMAGE_NAME_TAG={os.environ['CI_IMAGE_NAME_TAG']}",
+ f"--build-arg=FILE_ENV={os.environ['FILE_ENV']}",
+ f"--build-arg=BASE_ROOT_DIR={os.environ['BASE_ROOT_DIR']}",
+ f"--platform={os.environ['CI_IMAGE_PLATFORM']}",
+ f"--label={CI_IMAGE_LABEL}",
+ f"--tag={os.environ['CONTAINER_NAME']}",
+ ]
+ cmd_build += shlex.split(os.getenv("DOCKER_BUILD_CACHE_ARG", ""))
+ cmd_build += [os.environ["BASE_READ_ONLY_DIR"]]
+
+ print(f"Building {os.environ['CONTAINER_NAME']} image tag to run in")
+ run(cmd_build)
+
run(["./ci/test/02_run_container.sh"]) # run the remainder
diff --git a/ci/test/02_run_container.sh b/ci/test/02_run_container.sh
index b26cc1b8..2e976773 100755
--- a/ci/test/02_run_container.sh
+++ b/ci/test/02_run_container.sh
@@ -10,22 +10,6 @@ export CI_IMAGE_LABEL="bitcoin-ci-test"
set -o errexit -o pipefail -o xtrace
if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
- echo "Creating $CI_IMAGE_NAME_TAG container to run in"
-
- # Use buildx unconditionally
- # Using buildx is required to properly load the correct driver, for use with registry caching. Neither build, nor BUILDKIT=1 currently do this properly
- # shellcheck disable=SC2086
- docker buildx build \
- --file "${BASE_READ_ONLY_DIR}/ci/test_imagefile" \
- --build-arg "CI_IMAGE_NAME_TAG=${CI_IMAGE_NAME_TAG}" \
- --build-arg "FILE_ENV=${FILE_ENV}" \
- --build-arg "BASE_ROOT_DIR=${BASE_ROOT_DIR}" \
- --platform="${CI_IMAGE_PLATFORM}" \
- --label="${CI_IMAGE_LABEL}" \
- --tag="${CONTAINER_NAME}" \
- $DOCKER_BUILD_CACHE_ARG \
- "${BASE_READ_ONLY_DIR}"
-
docker volume create "${CONTAINER_NAME}_ccache" || true
docker volume create "${CONTAINER_NAME}_depends" || true
docker volume create "${CONTAINER_NAME}_depends_sources" || true
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.