ci: Rotate Docker cache keys every 4 weeks
What the developer wrote
Authored by Hennadii Stepanov
ci: Rotate Docker cache keys every 4 weeks
This forces a periodic clean build to ensure we do not rely on stale
cache layers indefinitely.
What changed, and why it matters
This commit changes how Bitcoin Core's libsecp256k1 project manages its automated build cache for Docker images. It makes the cache key include the current week number divided by 4, so the cache is effectively thrown away and rebuilt about once a month. This is a routine maintenance improvement to avoid relying on stale cached build layers forever. It is not a security fix and does not change any cryptographic or network code.
No security action needed. This is a CI hygiene change. Reviewers may verify that the new cache scope is propagated consistently to all consumers of run-in-docker-action.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies two GitHub Actions workflow files. It removes the default value for the ‘scope’ input in the run-in-docker-action composite action and makes it required. In the CI workflow, it adds a new job output ‘cache_scope’ computed as the ISO week number divided by 4, and appends that value to the Docker Buildx GitHub Actions cache scope (runner.arch + ‘-’ + period). Downstream jobs that call run-in-docker-action now pass the same scope explicitly. The effect is cache invalidation roughly every four weeks, forcing clean Docker image rebuilds.
Changed components
.github/actions/run-in-docker-action/action.yml.github/workflows/ci.ymlInspect captured patch +11 / −4
diff --git a/.github/actions/run-in-docker-action/action.yml b/.github/actions/run-in-docker-action/action.yml
index 5d46ca1..0884d3a 100644
--- a/.github/actions/run-in-docker-action/action.yml
+++ b/.github/actions/run-in-docker-action/action.yml
@@ -6,8 +6,7 @@ inputs:
required: true
scope:
description: 'A cached image scope'
- required: false
- default: ${{ runner.arch }}
+ required: true
command:
description: 'A command to run in a container'
required: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 59d2251..3e74f3d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,6 +48,8 @@ jobs:
docker_cache:
name: "Build ${{ matrix.arch }} Docker image"
runs-on: ${{ matrix.runner }}
+ outputs:
+ cache_scope: ${{ steps.cache_timestamp.outputs.period }}
strategy:
fail-fast: false
@@ -59,6 +61,10 @@ jobs:
runner: ubuntu-24.04-arm
steps:
+ - name: Get cache validity period
+ id: cache_timestamp
+ run: echo "period=$(($(date +%V) / 4))" >> "$GITHUB_OUTPUT"
+
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
with:
@@ -70,8 +76,8 @@ jobs:
uses: docker/build-push-action@v6
with:
file: ./ci/linux-debian.Dockerfile
- cache-from: type=gha,scope=${{ runner.arch }}
- cache-to: type=gha,scope=${{ runner.arch }},mode=min
+ cache-from: type=gha,scope=${{ runner.arch }}-${{ steps.cache_timestamp.outputs.period }}
+ cache-to: type=gha,scope=${{ runner.arch }}-${{ steps.cache_timestamp.outputs.period }},mode=min
x86_64-debian:
name: "x86_64: Linux (Debian stable)"
@@ -117,6 +123,7 @@ jobs:
uses: ./.github/actions/run-in-docker-action
with:
dockerfile: ./ci/linux-debian.Dockerfile
+ scope: ${{ runner.arch }}-${{ needs.docker_cache.outputs.cache_scope }}
command: ./ci/ci.sh
- &PRINT_LOGS
@@ -636,6 +643,7 @@ jobs:
uses: ./.github/actions/run-in-docker-action
with:
dockerfile: ./ci/linux-debian.Dockerfile
+ scope: ${{ runner.arch }}-${{ needs.docker_cache.outputs.cache_scope }}
command: |
g++ -Werror include/*.h
clang -Werror -x c++-header include/*.h
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.