What the developer wrote
Authored by will
ci: add configure-docker action
Another action to reduce boilerplate in the main ci.yml file.
This action will set up a docker builder compatible with caching build
layers to a container registry using the `gha` build driver.
It will then configure the docker build cache args.
What changed, and why it matters
This commit adds a new GitHub Actions helper that sets up Docker Buildx and configures Docker layer caching for Bitcoin Core's continuous integration (CI). It does not change any Bitcoin node code, wallet logic, or network behavior. There is no indication it fixes or introduces a security vulnerability.
No security action required. Review as normal CI maintenance; if desired, verify that `CIRRUS_CACHE_HOST` and `CONTAINER_NAME` are defined in the calling workflow and that exposing `ACTIONS_RUNTIME_TOKEN` to build steps is acceptable for the repository's threat model.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The new composite action .github/actions/configure-docker/action.yml installs docker/setup-buildx-action@v3 with network=host, exposes GitHub Actions cache variables to the build environment, and constructs --cache-from / --cache-to arguments for the gha Docker cache backend. It optionally points cache traffic at a Cirrus cache host when use-cirrus: true. The action is purely CI infrastructure automation.
Changed components
.github/actions/configure-docker/action.ymlInspect captured patch +52 / −0
diff --git a/.github/actions/configure-docker/action.yml b/.github/actions/configure-docker/action.yml
new file mode 100644
index 00000000..c78df86b
--- /dev/null
+++ b/.github/actions/configure-docker/action.yml
@@ -0,0 +1,52 @@
+name: 'Configure Docker'
+description: 'Set up Docker build driver and configure build cache args'
+inputs:
+ use-cirrus:
+ description: 'Use cirrus cache'
+ required: true
+runs:
+ using: 'composite'
+ steps:
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+ with:
+ # Use host network to allow access to cirrus gha cache running on the host
+ driver-opts: |
+ network=host
+
+ # This is required to allow buildkit to access the actions cache
+ - name: Expose actions cache variables
+ uses: actions/github-script@v6
+ with:
+ script: |
+ core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
+ core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
+
+ - name: Construct docker build cache args
+ shell: bash
+ run: |
+ # Configure docker build cache backend
+ #
+ # On forks the gha cache will work but will use Github's cache backend.
+ # Docker will check for variables $ACTIONS_CACHE_URL, $ACTIONS_RESULTS_URL and $ACTIONS_RUNTIME_TOKEN
+ # which are set automatically when running on GitHub infra: https://docs.docker.com/build/cache/backends/gha/#synopsis
+
+ # Use cirrus cache host
+ if [[ ${{ inputs.use-cirrus }} == 'true' ]]; then
+ url_args="url=${CIRRUS_CACHE_HOST},url_v2=${CIRRUS_CACHE_HOST}"
+ else
+ url_args=""
+ fi
+
+ # Always optimistically --cache‑from in case a cache blob exists
+ args=(--cache-from "type=gha${url_args:+,${url_args}},scope=${CONTAINER_NAME}")
+
+ # If this is a push to the default branch, also add --cache‑to to save the cache
+ if [[ ${{ github.event_name }} == "push" && ${{ github.ref_name }} == ${{ github.event.repository.default_branch }} ]]; then
+ args+=(--cache-to "type=gha${url_args:+,${url_args}},mode=max,ignore-error=true,scope=${CONTAINER_NAME}")
+ fi
+
+ # Always `--load` into docker images (needed when using the `docker-container` build driver).
+ args+=(--load)
+
+ echo "DOCKER_BUILD_CACHE_ARG=${args[*]}" >> $GITHUB_ENV
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.