ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup
What the developer wrote
Authored by Hennadii Stepanov
ci: Replace `ilammy/msvc-dev-cmd` with manual MSVC setup
The `ilammy/msvc-dev-cmd` repository seems abandoned and should be
considered unsafe. This updates the workflow to load the MSVC
environment variables directly via `vcvars64.bat`.
See https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line.
What changed, and why it matters
This change updates the project's automated testing setup for Windows builds. It stops using a third-party GitHub Action called `ilammy/msvc-dev-cmd` to prepare the Microsoft C++ compiler, and instead runs a built-in Microsoft batch file directly. The commit message says the third-party tool is considered abandoned and unsafe, so this is a preventive security hygiene change rather than a fix for an active vulnerability in the project's own code.
No immediate action is required for downstream users of libsecp256k1. Repository maintainers should monitor other workflows for similar dependencies on `ilammy/msvc-dev-cmd` or other unmaintained third-party actions, and consider pinning remaining actions to commit SHAs or replacing them with vendor-provided equivalents. Review the permissions of the GitHub Actions workflow token to ensure least privilege.
Security signals we found
Supply-chain risk reduction: removal of third-party GitHub Action
Commit message labels external dependency as 'abandoned and should be considered unsafe'
No change to cryptographic or consensus-critical code
CI-only change with no runtime effect on libsecp256k1 binaries
Evidence from the diff
The patch modifies .github/workflows/ci.yml in the libsecp256k1 repository. It removes the ilammy/msvc-dev-cmd@v1 GitHub Action step and replaces it with an explicit call to vcvars64.bat from the installed Visual Studio 2022 Enterprise image, then compiles the public C headers with cl.exe. This reduces supply-chain risk by removing a dependency on an externally maintained action that the commit author describes as abandoned and unsafe. There is no change to cryptographic code, build logic, or CI secrets handling.
Changed components
.github/workflows/ci.ymlCI job 'cxx_windows' (Microsoft Visual C++ public header compile test)Inspect captured patch +2 / −3
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 152f9a1..9b836cd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -604,11 +604,10 @@ jobs:
steps:
- *CHECKOUT
- - name: Add cl.exe to PATH
- uses: ilammy/msvc-dev-cmd@v1
-
- name: C++ (public headers)
+ shell: cmd
run: |
+ call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
cl.exe -c -WX -TP include/*.h
cxx_fpermissive_debian:
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.