ci: revert to local action for setup-rbmt
What changed, and why it matters
This commit is a routine GitHub Actions maintenance change. It copies a small reusable workflow step (called 'setup-rbmt') from a separate repository into this one, so the project no longer has to reference an external repository version. There is no change to the actual Bitcoin library code, no user-facing behavior change, and no security fix or vulnerability introduced.
No security action required. Reviewers may optionally verify that the local action content matches the previously pinned remote action and that the cargo install --rev still pins a known-good commit hash.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch reverts CI usage of a remote composite action (rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@
Changed components
.github/actions/setup-rbmt/action.yml.github/workflows/cron-weekly-rustfmt.yml.github/workflows/rust.ymlInspect captured patch +29 / −6
diff --git a/.github/actions/setup-rbmt/action.yml b/.github/actions/setup-rbmt/action.yml
new file mode 100644
index 00000000..5a11b7e7
--- /dev/null
+++ b/.github/actions/setup-rbmt/action.yml
@@ -0,0 +1,24 @@
+name: 'Setup RBMT'
+description: 'Install cargo-rbmt, toolchains, and a no_std env for testing.'
+
+runs:
+ using: "composite"
+ steps:
+ - name: "Install cargo-rbmt"
+ shell: bash
+ run: |
+ cargo install \
+ --git https://git.rust-bitcoin.org/rust-bitcoin/rust-bitcoin-maintainer-tools \
+ --rev "$(cat rbmt-version)" \
+ cargo-rbmt \
+ --locked
+
+ - name: "Install Rust toolchains via cargo-rbmt"
+ shell: bash
+ run: cargo rbmt toolchains
+
+ - name: "Install ARM cross-compiler"
+ shell: bash
+ run: |
+ sudo apt-get install -y --no-install-recommends gcc-arm-none-eabi
+ echo "CC_thumbv7m_none_eabi=arm-none-eabi-gcc" >> $GITHUB_ENV
diff --git a/.github/workflows/cron-weekly-rustfmt.yml b/.github/workflows/cron-weekly-rustfmt.yml
index 088a828a..a0287a49 100644
--- a/.github/workflows/cron-weekly-rustfmt.yml
+++ b/.github/workflows/cron-weekly-rustfmt.yml
@@ -15,7 +15,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@64715bab0d6fa1f3ebd6f9be336c4c5089bb5eb9
+ - uses: ./.github/actions/setup-rbmt
- name: Run Nightly rustfmt
run: cargo rbmt fmt
- name: Get the current date
@@ -27,6 +27,5 @@ jobs:
title: Automated nightly rustfmt (${{ env.date }})
body: |
Automated nightly `rustfmt` changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action
- commit-message: ${{ env.date }} automated rustfmt nightly
+ commit-message: ${{ env.date }} automated rustfmt nightly
labels: rustfmt
-
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 720b8d0e..f201ac30 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -25,7 +25,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@af3c2868415b17eedc808da6d0589e10b7482660
+ - uses: ./.github/actions/setup-rbmt
- name: "Run tests"
run: cargo rbmt test --toolchain ${{ matrix.toolchain }} --lock-file ${{ matrix.dep }}
@@ -41,7 +41,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@af3c2868415b17eedc808da6d0589e10b7482660
+ - uses: ./.github/actions/setup-rbmt
- name: "Run ${{ matrix.task }}"
run: cargo rbmt ${{ matrix.task }}
@@ -54,7 +54,7 @@ jobs:
with:
persist-credentials: false
fetch-depth: 0 # History required for version bump detection.
- - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@af3c2868415b17eedc808da6d0589e10b7482660
+ - uses: ./.github/actions/setup-rbmt
- name: "Run pre-release checks"
run: cargo rbmt prerelease --baseline ${{ github.event.pull_request.base.sha || github.event.before }}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.