What the developer wrote
Authored by MarcoFalke
ci: Bump GHA actions versions
What changed, and why it matters
This commit simply updates the version numbers of several GitHub Actions used in Bitcoin Core's automated build and test system. There is no indication of a security vulnerability being fixed; it is a routine maintenance change to keep CI dependencies current.
No security action required. Treat as routine CI hygiene; verify upstream release notes for any breaking changes before merging.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff bumps third-party GitHub Actions to their latest major versions: docker/setup-buildx-action v3→v4, actions/github-script v6→v8, actions/cache/restore and actions/cache/save v4→v5, actions/upload-artifact v6→v7, and actions/download-artifact v7→v8. No workflow logic, permissions, secrets handling, or build commands are changed.
Changed components
.github/actions/configure-docker/action.yml.github/workflows/ci.ymlInspect captured patch +8 / −8
diff --git a/.github/actions/configure-docker/action.yml b/.github/actions/configure-docker/action.yml
index 5c9531d3..b4abf7c2 100644
--- a/.github/actions/configure-docker/action.yml
+++ b/.github/actions/configure-docker/action.yml
@@ -15,7 +15,7 @@ runs:
print("::warning title=Unknown input to configure docker action::Provided value was ${{ inputs.cache-provider }}")
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
+ uses: docker/setup-buildx-action@v4
with:
# Use host network to allow access to cirrus gha cache running on the host
driver-opts: |
@@ -23,7 +23,7 @@ runs:
# This is required to allow buildkit to access the actions cache
- name: Expose actions cache variables
- uses: actions/github-script@v6
+ uses: actions/github-script@v8
with:
script: |
Object.keys(process.env).forEach(function (key) {
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70305f26..914b29ca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -186,7 +186,7 @@ jobs:
- name: Restore Ccache cache
id: ccache-cache
- uses: actions/cache/restore@v4
+ uses: actions/cache/restore@v5
with:
path: ${{ env.CCACHE_DIR }}
key: ${{ github.job }}-${{ matrix.job-type }}-ccache-${{ github.run_id }}
@@ -206,7 +206,7 @@ jobs:
FILE_ENV: ${{ matrix.file-env }}
- name: Save Ccache cache
- uses: actions/cache/save@v4
+ uses: actions/cache/save@v5
if: github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch && steps.ccache-cache.outputs.cache-hit != 'true'
with:
path: ${{ env.CCACHE_DIR }}
@@ -272,7 +272,7 @@ jobs:
restore-keys: ${{ github.job }}-vcpkg-tools-
- name: Restore vcpkg binary cache
- uses: actions/cache/restore@v4
+ uses: actions/cache/restore@v5
id: vcpkg-binary-cache
with:
path: ~/AppData/Local/vcpkg/archives
@@ -283,7 +283,7 @@ jobs:
py -3 .github/ci-windows.py ${{ matrix.job-type }} generate
- name: Save vcpkg binary cache
- uses: actions/cache/save@v4
+ uses: actions/cache/save@v5
if: github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch && steps.vcpkg-binary-cache.outputs.cache-hit != 'true' && matrix.job-type == 'standard'
with:
path: ~/AppData/Local/vcpkg/archives
@@ -378,7 +378,7 @@ jobs:
uses: ./.github/actions/save-caches
- name: Upload built executables
- uses: actions/upload-artifact@v6
+ uses: actions/upload-artifact@v7
with:
name: ${{ matrix.artifact-name }}-${{ github.run_id }}
path: |
@@ -416,7 +416,7 @@ jobs:
ref: ${{ needs.record-frozen-commit.outputs.commit }}
- name: Download built executables
- uses: actions/download-artifact@v7
+ uses: actions/download-artifact@v8
with:
name: ${{ matrix.artifact-name }}-${{ github.run_id }}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.