Informational 15 Bitcoin Committed Aug 19, 2026 · 18:32 UTC

ci: pass toolchain input to rust-toolchain action

4fa6b1c7 View source ↗

Public commit record

What the developer wrote

Authored by satsfy (Renato Britto)

80/100 · Strong

ci: pass toolchain input to rust-toolchain action

The dependabot bump moved stable branch pin to master, which has no
default and requires the toolchain specified. Inspired on miri ci
workflow, which already implements this.

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This is a routine GitHub Actions CI maintenance patch. It updates workflow files to explicitly pass the Rust toolchain version ('stable') to a third-party GitHub Action after a dependency bump changed which branch of that action is being used. There is no change to the project's actual Bitcoin library code, no security fix, and no vulnerability being addressed.

Recommended action

No security action needed. This is a CI configuration fix. Reviewers may verify that the stable toolchain is the intended choice for these jobs, which the commit message confirms.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit modifies .github/workflows/rust.yml and .github/workflows/semver-checks.yml. The dtolnay/rust-toolchain action reference was moved from the ‘stable’ branch pin to the ‘v1’ release branch by an earlier Dependabot bump. The ‘v1’ branch requires callers to explicitly specify the desired toolchain via the ‘toolchain’ input, so this commit adds ‘with: toolchain: stable’ to all affected workflow steps. This restores the previous behavior of installing the stable Rust toolchain in CI jobs.

Changed components

.github/workflows/rust.yml.github/workflows/semver-checks.yml

Inspect captured patch +18 / −6

### .github/workflows/rust.yml
@@ -146,7 +146,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Add architecture i386 and install dependencies"
         run: |
           sudo dpkg --add-architecture i386
@@ -217,7 +219,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Run policy script"
         run: ./contrib/check-for-policy-violations.sh
 
@@ -234,7 +238,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Run primitives API checker script"
         run: |
           contrib/generate-primitives-re-export-test.sh && (cd ./primitives && cargo test --all-features)
@@ -253,7 +259,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Check Encode coverage"
         run: ./contrib/check-encodable-coverage.sh
 
@@ -267,7 +275,9 @@ jobs:
           persist-credentials: false
           fetch-depth: 0 # required for full diff context
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Fetch base branch for diff"
         run: git fetch origin master
       - name: "Retrieve relative diff"

### .github/workflows/semver-checks.yml
@@ -23,7 +23,9 @@ jobs:
           fetch-depth: 0 # we need full history for cargo semver-checks
           persist-credentials: false
       - name: "Install Rustup"
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Select stable-version"
         run: |
           rustup default $(cargo metadata --format-version 1 | jq -r '.metadata.rbmt.toolchains.stable')

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

Merge rust-bitcoin/rust-bitcoin#6761: Manual bump of dtolnay/rust-toolchain specifying toolchain

Merge rust-bitcoin/rust-bitcoin#6757: ci: gen PR labels from master instead of fork

Merge rust-bitcoin/rust-bitcoin#6741: units: Add and standardise doc and comment links