ci: Load Docker image by ID from builder step
What the developer wrote
Authored by Hennadii Stepanov
ci: Load Docker image by ID from builder step
What changed, and why it matters
This is a small GitHub Actions CI maintenance change. It changes how the workflow picks which Docker image to run, switching from 'use the most recently built image found on the runner' to 'use the exact image ID produced by a specific build step'. This makes the CI pipeline more reliable and predictable, but it is not a security fix and does not change any cryptographic or network-facing code in the secp256k1 library itself.
No security action required. Treat as ordinary CI hygiene.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies .github/actions/run-in-docker-action/action.yml. Previously the run step selected the Docker image via $(docker images -q | head -n1), which is fragile because it depends on image ordering on the local daemon. The new expression ${{ case(steps.main_builder.outcome == 'success', steps.main_builder.outputs.imageid, steps.retry_builder.outputs.imageid) }} explicitly references the image ID output by the named build step (or its retry step). This is a CI robustness improvement; no secp256k1 source code, build scripts consumed by end users, or release artifacts are affected.
Changed components
.github/actions/run-in-docker-action/action.ymlInspect captured patch +1 / −1
diff --git a/.github/actions/run-in-docker-action/action.yml b/.github/actions/run-in-docker-action/action.yml
index 0884d3a..bbbcf32 100644
--- a/.github/actions/run-in-docker-action/action.yml
+++ b/.github/actions/run-in-docker-action/action.yml
@@ -44,7 +44,7 @@ runs:
$(echo '${{ toJSON(env) }}' | jq -r 'keys[] | "--env \(.) "') \
--volume ${{ github.workspace }}:${{ github.workspace }} \
--workdir ${{ github.workspace }} \
- $(docker images -q | head -n1) \
+ ${{ case(steps.main_builder.outcome == 'success', steps.main_builder.outputs.imageid, steps.retry_builder.outputs.imageid) }} \
bash -c "
git config --global --add safe.directory ${{ github.workspace }}
${{ inputs.command }}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.