ci: migrate semver check labeller to ci labeller
What changed, and why it matters
This commit is a routine cleanup of GitHub automation. It merges two separate PR-labeling workflows into one, removing duplicated code. There is no change to the actual Bitcoin library code or to how user funds or data are handled.
No security action needed. This is a CI refactoring change and can be reviewed as normal maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change consolidates the semver-break PR labeler into the existing CI labeller workflow. The deleted workflow used actions/github-script to download an artifact, unzip it, parse a PR number, and add a label/comment. The new code does the same labeling/commenting via shell commands in the existing workflow. The trigger list now includes both ‘Continuous integration’ and ‘Check semver breaks’. No application code, cryptography, or consensus logic is modified.
Changed components
.github/workflows/ci-labeller.yml.github/workflows/semver-checks-pr-label.ymlInspect captured patch +12 / −91
diff --git a/.github/workflows/ci-labeller.yml b/.github/workflows/ci-labeller.yml
index e210a188..00f73f82 100644
--- a/.github/workflows/ci-labeller.yml
+++ b/.github/workflows/ci-labeller.yml
@@ -1,5 +1,5 @@
-# This workflow is triggered on completion of a CI job. It handles adding
-# labels to the PR which triggered the job. It is a separate workflow from
+# This workflow is triggered on completion of CI and semver check jobs. It handles adding
+# labels and comments to the PR which triggered the job. It is a separate workflow from
# the CI workflow itself in order to follow security best practices.
#
# Since only workflows on the default branch (`master`) can be triggered, this
@@ -9,7 +9,7 @@
on: # yamllint disable-line rule:truthy
workflow_run: # zizmor: ignore[dangerous-triggers]
- workflows: [Continuous integration]
+ workflows: [Continuous integration, Check semver breaks]
types: [completed]
name: CI Labeller
@@ -40,3 +40,12 @@ jobs:
exit_code=$(tail -n1 api-diff)
toggle=$([ "$exit_code" -eq 0 ] && echo "--remove-label" || echo "--add-label")
gh pr edit $issue_number $toggle "API diff"
+ # The semver break artifact must have the PR number on the first line.
+ - name: "Comment and Label on API break"
+ if: ${{ hashFiles('semver-break') != '' }}
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
+ issue_number=$(cat semver-break)
+ gh pr comment $issue_number --body 'API BREAKING CHANGE DETECTED!'
+ gh pr edit $issue_number --add-label "API break"
diff --git a/.github/workflows/semver-checks-pr-label.yml b/.github/workflows/semver-checks-pr-label.yml
deleted file mode 100644
index 2b1138ce..00000000
--- a/.github/workflows/semver-checks-pr-label.yml
+++ /dev/null
@@ -1,88 +0,0 @@
-on: # yamllint disable-line rule:truthy
- workflow_run: # zizmor: ignore[dangerous-triggers]
- workflows: [Check semver breaks]
- types: [completed]
-
-name: Check semver breaks - Label and Comment PR
-
-permissions: {}
-
-jobs:
- Download:
- name: Download, Unzip and Add Labels/Comments
- runs-on: ubuntu-24.04
- permissions:
- actions: read
- contents: read
- pull-requests: write
- # only run if CI passes on the "Check semver breaks" workflow
- if: ${{ github.event.workflow_run.conclusion == 'success' }}
- steps:
- - name: "Download artifact"
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
- with:
- script: |
- // get all artifacts from the workflow run
- let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
- owner: context.repo.owner,
- repo: context.repo.repo,
- run_id: context.payload.workflow_run.id,
- });
-
- // find the artifact that starts with 'semver-break'
- let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
- return artifact.name.startsWith('semver-break');
- })[0];
-
- // if no artifact found, exit
- if (!matchArtifact) {
- console.log('No semver-break artifact found');
- process.exit(0);
- }
-
- // otherwise download the artifact
- let download = await github.rest.actions.downloadArtifact({
- owner: context.repo.owner,
- repo: context.repo.repo,
- artifact_id: matchArtifact.id,
- archive_format: 'zip',
- });
-
- // write the artifact to the workspace
- let fs = require('fs');
- fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/semver-break.zip`, Buffer.from(download.data));
- - name: "Unzip artifact"
- if: ${{ hashFiles('semver-break.zip') != '' }}
- run: unzip -n semver-break.zip
- - name: "Comment and add label on PR - Semver break"
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
- if: ${{ hashFiles('semver-break') != '' }}
- with:
- github-token: ${{ secrets.GITHUB_TOKEN }}
- script: |
- // sanitize and get the PR number from the semver-break file
- const fs = require('fs');
- let issue_number = parseInt(fs.readFileSync('semver-break', 'utf8'), 10);
-
- // assure that is not NaN using Number.isNaN
- // since does not coerce the value to a number like isNaN
- if (Number.isNaN(issue_number)) {
- console.log('PR_NUMBER is not a number');
- process.exit(1);
- }
-
- // comment on the PR
- await github.rest.issues.createComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: issue_number,
- body: ':rotating_light: API BREAKING CHANGE DETECTED\n\nTo see the changes click details on "Continuous integration / Check (api)" job then expand "Run api" and scroll to the end of the section.'
- });
-
- // add the label to the PR
- await github.rest.issues.addLabels({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: issue_number,
- labels: ['API break']
- });
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.