nix: Upgrade channel and flake checker actions

Elements Project/Core Lightning

8f67da33 View source ↗

Public commit record

What the developer wrote

Authored by Christian Decker

45/100 · Thin

nix: Upgrade channel and flake checker actions

✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

The short version

What changed, and why it matters

This commit updates two third-party GitHub Actions used in the project's automated CI pipeline to newer versions and bumps the NixOS channel reference from 24.05 to 25.05. It does not change Core Lightning's runtime code, cryptographic logic, or network behavior. There is no indication in the commit or supplied references that this fixes or introduces a security vulnerability.

Recommended action

No security action required. Treat as routine CI maintenance. If reviewing for supply-chain risk, verify the release notes of flake-checker-action@v12 and install-nix-action@V31 for any breaking changes or security fixes, but the commit itself does not indicate such relevance.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The diff modifies .github/workflows/ci.yaml only. It upgrades DeterminateSystems/flake-checker-action from v8 to v12, cachix/install-nix-action from V27 to V31, and the nix_path channel from nixos-24.05 to nixos-25.05. These are routine dependency/maintenance updates for the Nix CI job. No application code, tests, or build scripts outside the GitHub Actions workflow are touched.

Changed components

.github/workflows/ci.yaml

Inspect captured patch +3 / −3

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4aabb1de..d635abbd 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -605,11 +605,11 @@ jobs:
         with:
           submodules: "recursive"
       - name: Check Nix flake inputs
-        uses: DeterminateSystems/flake-checker-action@v8
+        uses: DeterminateSystems/flake-checker-action@v12
       - name: Install Nix
-        uses: cachix/install-nix-action@V27
+        uses: cachix/install-nix-action@V31
         with:
-          nix_path: nixpkgs=channel:nixos-24.05
+          nix_path: nixpkgs=channel:nixos-25.05
       - name: Check flake
         run: nix flake check .?submodules=1#

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

Revert "doc: require Homebrew GNU make and gpatch on macOS"

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

doc: require Homebrew GNU make and gpatch on macOS