ci: Rewrite lint task Bash snippet to Python
What the developer wrote
Authored by MarcoFalke
ci: Rewrite lint task Bash snippet to Python
The Bash snippet was shorter, but relying on implicit word splitting
(see the shellcheck SC2086 warning).
For example, the DOCKER_BUILD_CACHE_ARG shlex.split is now done
identical to how ci/test/02_run_container.py does it.
Moreover, the Python will hopefully be easier to modify in the future,
as the dev notes recommend Python over Bash.
What changed, and why it matters
This commit rewrites a small GitHub Actions CI step from Bash to Python. It does not change what the CI step does; it only changes how the command is built and executed. The rewrite fixes a shell-script lint warning about unsafe word splitting and makes the code easier to maintain. There is no security vulnerability here.
No security action needed. Treat as a normal CI maintenance/refactor commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change converts the lint CI job’s inline run: script in .github/workflows/ci.yml from Bash to Python. The Python version uses shlex.split() for DOCKER_BUILD_CACHE_ARG and shlex.join() for trace logging, mirroring the pattern already used in ci/test/02_run_container.py. It preserves the same Docker build and run behavior, including the conditional CIRRUS_PR=1 environment variable for pull requests. This is a code-quality/maintenance refactor, not a security fix.
Changed components
.github/workflows/ci.ymlInspect captured patch +33 / −7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d4336462..323d0a71 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -599,11 +599,37 @@ jobs:
cache-provider: ${{ needs.runners.outputs.provider }}
- name: CI script
+ shell: python
run: |
- set -o xtrace
- docker buildx build -t "$CONTAINER_NAME" $DOCKER_BUILD_CACHE_ARG --file "./ci/lint_imagefile" .
- CIRRUS_PR_FLAG=""
- if [ "${{ github.event_name }}" = "pull_request" ]; then
- CIRRUS_PR_FLAG="-e CIRRUS_PR=1"
- fi
- docker run --rm $CIRRUS_PR_FLAG -v "$(pwd)":/bitcoin "$CONTAINER_NAME"
+ import os, shlex, subprocess, sys
+
+ def run(cmd, **kwargs):
+ print("+ " + shlex.join(cmd), flush=True)
+ kwargs.setdefault("check", True)
+ try:
+ return subprocess.run(cmd, **kwargs)
+ except Exception as e:
+ sys.exit(e)
+
+ CONTAINER_NAME = os.environ["CONTAINER_NAME"]
+
+ build_cmd = [
+ "docker", "buildx", "build",
+ f"--tag={CONTAINER_NAME}",
+ *shlex.split(os.getenv("DOCKER_BUILD_CACHE_ARG", "")),
+ "--file=./ci/lint_imagefile",
+ "."
+ ]
+
+ run(build_cmd)
+
+ CIRRUS_PR_FLAG = []
+ if '${{ github.event_name }}' == "pull_request":
+ CIRRUS_PR_FLAG = ["-e", "CIRRUS_PR=1"]
+
+ run([
+ "docker", "run", "--rm",
+ *CIRRUS_PR_FLAG,
+ f"--volume={os.getcwd()}:/bitcoin",
+ CONTAINER_NAME,
+ ])
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.