What changed, and why it matters
This commit is a routine update to the project's internal continuous-integration tooling. It changes how a helper tool called cargo-rbmt is installed and where its version is recorded, but it does not modify the actual Bitcoin library code or any user-facing behavior. There is no security issue visible in this change.
No security action needed. Reviewers may verify that the new cargo-rbmt 0.5.3 release is trusted and that the crates.io install path is acceptable to the project.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit upgrades the CI helper cargo-rbmt to version 0.5.3 and moves its version pin from a dedicated rbmt-version file into workspace.metadata in Cargo.toml. It also switches installation from a git checkout by revision to a crates.io semver install, removes the ensure-maintainer-tools.sh wrapper, consolidates docs/docsrs CI tasks, and adds a separate Generate-API job that diffs the public API against a baseline. No Rust source code, cryptographic logic, or public API definitions are changed.
Changed components
.github/actions/setup-rbmt/action.yml.github/workflows/corpus-fuzzing.yml.github/workflows/cron-monthly-update-rbmt.yml.github/workflows/cron-weekly-update-nightly.yml.github/workflows/cron-weekly-update-stable.yml.github/workflows/rust.ymlCargo.tomlcontrib/ensure-maintainer-tools.shjustfilerbmt-versionInspect captured patch +49 / −55
### .github/actions/setup-rbmt/action.yml
@@ -12,10 +12,8 @@ runs:
shell: bash
run: |
cargo install \
- --git https://git.rust-bitcoin.org/rust-bitcoin/rust-bitcoin-maintainer-tools \
- --rev "$(cat rbmt-version)" \
- cargo-rbmt \
- --locked
+ --locked \
+ cargo-rbmt@$(grep "^rbmt.version" Cargo.toml | cut -d'"' -f2)
- name: "Install Rust toolchains via cargo-rbmt"
shell: bash
### .github/workflows/corpus-fuzzing.yml
@@ -76,17 +76,15 @@ jobs:
rust-bitcoin/fuzz/target
rust-bitcoin/target
# cached cargo-rbmt binary goes stale when it is bumped.
- key: fuzz-${{ hashFiles('rust-bitcoin/**/Cargo.toml', 'rust-bitcoin/rbmt-version') }}
+ key: fuzz-${{ hashFiles('rust-bitcoin/**/Cargo.toml') }}
# On cache miss this loads the latest cache and avoids a rebuild from scratch.
restore-keys: fuzz-
- name: Install cargo-rbmt
working-directory: rust-bitcoin
run: |
cargo install \
- --git https://git.rust-bitcoin.org/rust-bitcoin/rust-bitcoin-maintainer-tools \
- --rev "$(cat rbmt-version)" \
- cargo-rbmt \
- --locked
+ --locked \
+ cargo-rbmt@$(grep "^rbmt.version" Cargo.toml | cut -d'"' -f2)
- name: Install nightly toolchain
working-directory: rust-bitcoin
run: rustup toolchain install "$(cargo rbmt toolchains --nightly)" --profile minimal --no-self-update
### .github/workflows/cron-monthly-update-rbmt.yml
@@ -21,15 +21,14 @@ jobs:
git clone --filter=blob:none --no-checkout \
https://github.com/rust-bitcoin/rust-bitcoin-maintainer-tools.git /tmp/rbmt
LATEST_TAG=$(git -C /tmp/rbmt tag --sort=-version:refname | grep '^cargo-rbmt-' | head -1)
- LATEST_HASH=$(git -C /tmp/rbmt rev-parse "${LATEST_TAG}^{}")
- CURRENT_HASH=$(cat rbmt-version)
- if [ -n "${LATEST_HASH}" ] && [ "${LATEST_HASH}" != "${CURRENT_HASH}" ]; then
- echo "${LATEST_HASH}" > rbmt-version
- echo "rbmt_hash=${LATEST_HASH}" >> "${GITHUB_ENV}"
- echo "rbmt_semver=${LATEST_TAG#cargo-rbmt-}" >> "${GITHUB_ENV}"
+ LATEST_VERSION=${LATEST_TAG#cargo-rbmt-}
+ CURRENT_VERSION=$(grep "^rbmt.version" Cargo.toml | cut -d'"' -f2)
+ if [ -n "${LATEST_VERSION}" ] && [ "${LATEST_VERSION}" != "${CURRENT_VERSION}" ]; then
+ sed -i "s/^rbmt.version = \"${CURRENT_VERSION}\"/rbmt.version = \"${LATEST_VERSION}\"/" Cargo.toml
+ echo "rbmt_semver=${LATEST_VERSION}" >> "${GITHUB_ENV}"
echo "changes_made=true" >> "${GITHUB_ENV}"
else
- echo "rbmt-version is already at the latest release. Not opening any PR."
+ echo "rbmt version is already at the latest release. Not opening any PR."
echo "changes_made=false" >> "${GITHUB_ENV}"
fi
- name: Create Pull Request
@@ -41,6 +40,6 @@ jobs:
committer: Update RBMT Bot <bot@example.com>
title: Automated update to cargo-rbmt (to ${{ env.rbmt_semver }})
body: |
- Automated update to rbmt-version by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action
+ Automated update to Cargo.toml workspace metadata by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action
commit-message: Automated update to cargo-rbmt-${{ env.rbmt_semver }}
branch: create-pull-request/auto-rbmt-update
### .github/workflows/cron-weekly-update-nightly.yml
@@ -21,8 +21,7 @@ jobs:
with:
ref: ${{ matrix.branch }}
persist-credentials: false
- - name: Install cargo-rbmt
- run: cargo install --git https://github.com/rust-bitcoin/rust-bitcoin-maintainer-tools.git --rev $(cat rbmt-version) cargo-rbmt
+ - uses: ./.github/actions/setup-rbmt
- name: Update nightly toolchain in Cargo.toml
run: |
cargo rbmt toolchains --update-nightly
### .github/workflows/cron-weekly-update-stable.yml
@@ -20,8 +20,7 @@ jobs:
with:
ref: ${{ matrix.branch }}
persist-credentials: false
- - name: Install cargo-rbmt
- run: cargo install --git https://github.com/rust-bitcoin/rust-bitcoin-maintainer-tools.git --rev $(cat rbmt-version) cargo-rbmt
+ - uses: ./.github/actions/setup-rbmt
- name: Update stable toolchain in Cargo.toml
run: |
cargo rbmt toolchains --update-stable
### .github/workflows/rust.yml
@@ -37,7 +37,7 @@ jobs:
strategy:
fail-fast: false
matrix:
- task: [api, lint, docs, docsrs]
+ task: [lint, docs]
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
@@ -46,6 +46,19 @@ jobs:
- name: "Run ${{ matrix.task }}"
run: cargo rbmt ${{ matrix.task }}
+ Generate-API:
+ runs-on: ubuntu-24.04
+ permissions:
+ contents: read
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ fetch-depth: 0 # History required for API diff.
+ - uses: ./.github/actions/setup-rbmt
+ - name: "Run API check"
+ run: cargo rbmt api --baseline ${{ github.event.pull_request.base.sha || github.event.before }}
+
Bench:
runs-on: ubuntu-24.04
permissions:
### Cargo.toml
@@ -3,9 +3,10 @@ members = ["addresses", "base58", "bip158", "bitcoin", "chacha20_poly1305", "con
exclude = ["benches"]
resolver = "2"
-[workspace.metadata.rbmt.toolchains]
-nightly = "nightly-2026-07-02"
-stable = "1.97.1"
+[workspace.metadata]
+rbmt.version = "0.5.3"
+rbmt.toolchains.nightly = "nightly-2026-07-02"
+rbmt.toolchains.stable = "1.97.1"
[workspace.lints.rust]
unexpected_cfgs = { level = "deny", check-cfg = ['cfg(bench)', 'cfg(chacha20_poly1305_fuzz)', 'cfg(fuzzing)', 'cfg(hashes_fuzz)', 'cfg(kani)'] }
### contrib/ensure-maintainer-tools.sh
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-#
-# Ensure maintainer tools are available locally for CI task execution.
-
-set -euo pipefail
-
-REPO_DIR=$(git rev-parse --show-toplevel)
-
-cd "$REPO_DIR"
-
-if ! command -v cargo-rbmt >/dev/null 2>&1; then
- echo "Error: cargo-rbmt is required for maintainer tools but not found in PATH" >&2
- echo "Please ensure it's available in your environment or install cargo-rbmt using:" >&2
- echo "cargo +stable install --git https://github.com/rust-bitcoin/rust-bitcoin-maintainer-tools.git --rev \"$(cat "$REPO_DIR/rbmt-version")\" cargo-rbmt --locked" >&2
- exit 1
-fi
### justfile
@@ -1,30 +1,34 @@
alias ulf := update-lock-files
+export RBMT_LOG_LEVEL := env("RBMT_LOG_LEVEL", "progress")
+
_default:
@just --list
# Install necessary dev tools on system.
[group('system')]
-tools:
- @{{justfile_directory()}}/contrib/ensure-maintainer-tools.sh
-
-# Install workspace toolchains.
-[group('system')]
-@toolchains: tools
- RBMT_LOG_LEVEL=quiet cargo rbmt toolchains > /dev/null
+@tools:
+ cargo install --quiet --locked cargo-rbmt@$(grep "^rbmt.version" {{justfile_directory()}}/Cargo.toml | cut -d'"' -f2)
# Setup rbmt and run with given args.
-@rbmt *args: toolchains
- RBMT_LOG_LEVEL=quiet cargo rbmt {{args}}
+@rbmt *args: tools
+ cargo rbmt {{args}}
# Format workspace.
-@fmt: (rbmt "fmt")
+fmt: (rbmt "fmt")
-# Check for API changes.
-check-api: (rbmt "api")
+# Lint everything.
+lint: (rbmt "lint")
+
+# Test everything.
+test: (rbmt "test")
# Update the recent and minimal lock files.
-@update-lock-files: (rbmt "lock")
+update-lock-files: (rbmt "lock")
+
+# Check error re-exports.
+check-error-reexports:
+ {{justfile_directory()}}/contrib/check-error-reexports.sh
# Query the current API.
[group('scripts')]
### rbmt-version
@@ -1 +0,0 @@
-0361e3b0147b799d6e3965bedec8f4be68b21361Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.