ci: Add `scope` parameter to `cache-{to,from}` options
What the developer wrote
Authored by Hennadii Stepanov
ci: Add `scope` parameter to `cache-{to,from}` options
This change fixes an issue where only the latest image cache was
available.
What changed, and why it matters
This commit changes how Bitcoin Core's libsecp256k1 project caches Docker images in its automated testing system. It adds a 'scope' label to GitHub Actions cache settings so that separate caches are kept for different CPU architectures (like x86_64 vs ARM). Previously, all architectures shared one cache, meaning only the most recently used image was kept. This is a CI infrastructure improvement, not a security fix.
No security action required. Treat as a normal CI reliability improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies .github/actions/run-in-docker-action/action.yml and .github/workflows/ci.yml to add a scope=${{ runner.arch }} parameter to Docker Buildx cache-from/cache-to options using GitHub Actions cache (type=gha). This prevents cache collisions between multi-arch CI jobs, ensuring each architecture retains its own Docker layer cache. The change is purely operational and has no effect on cryptographic code, build outputs, or runtime behavior of libsecp256k1.
Changed components
.github/actions/run-in-docker-action/action.yml.github/workflows/ci.ymlInspect captured patch +8 / −4
diff --git a/.github/actions/run-in-docker-action/action.yml b/.github/actions/run-in-docker-action/action.yml
index 7493368..f9bd474 100644
--- a/.github/actions/run-in-docker-action/action.yml
+++ b/.github/actions/run-in-docker-action/action.yml
@@ -7,6 +7,10 @@ inputs:
tag:
description: 'A tag of an image'
required: true
+ scope:
+ description: 'A cached image scope'
+ required: false
+ default: ${{ runner.arch }}
command:
description: 'A command to run in a container'
required: false
@@ -24,7 +28,7 @@ runs:
file: ${{ inputs.dockerfile }}
tags: ${{ inputs.tag }}
load: true
- cache-from: type=gha
+ cache-from: type=gha,scope=${{ inputs.scope }}
- uses: docker/build-push-action@v5
id: retry_builder
@@ -34,7 +38,7 @@ runs:
file: ${{ inputs.dockerfile }}
tags: ${{ inputs.tag }}
load: true
- cache-from: type=gha
+ cache-from: type=gha,scope=${{ inputs.scope }}
- # Workaround for https://github.com/google/sanitizers/issues/1614 .
# The underlying issue has been fixed in clang 18.1.3.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9783251..83b3824 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -71,8 +71,8 @@ jobs:
with:
file: ./ci/linux-debian.Dockerfile
tags: ${{ matrix.arch }}-debian-image
- cache-from: type=gha
- cache-to: type=gha,mode=min
+ cache-from: type=gha,scope=${{ runner.arch }}
+ cache-to: type=gha,scope=${{ runner.arch }},mode=min
x86_64-debian:
name: "x86_64: Linux (Debian stable)"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.