← Watch feed
ci: update cargo-rbmt ever month instead of week
Public commit record
80/100 · Strong
What the developer wrote
Authored by Nick Johnson
ci: update cargo-rbmt ever month instead of week
The week updates have been too noisy with the rbmt churn, hoping the
monthly schedule gives us a poke if we fall behind, but isn't noisy.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
What changed, and why it matters
This commit simply renames a GitHub Actions workflow file and changes its schedule from weekly to monthly. It is a routine CI maintenance change with no security relevance.
Recommended action
No security action needed. This is a benign CI scheduling change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit deletes .github/workflows/cron-weekly-update-rbmt.yml and creates .github/workflows/cron-monthly-update-rbmt.yml. The only functional changes are the cron schedule (from Saturdays to the 1st of each month), the job name, and the PR title/branch strings. The workflow still clones the rust-bitcoin-maintainer-tools repository, checks the latest cargo-rbmt tag, compares it to the rbmt-version file, and opens a pull request if needed. No code, dependencies, permissions, or secrets were altered in a security-relevant way.
Changed components
.github/workflows/cron-weekly-update-rbmt.yml.github/workflows/cron-monthly-update-rbmt.ymlInspect captured patch +46 / −46
diff --git a/.github/workflows/cron-monthly-update-rbmt.yml b/.github/workflows/cron-monthly-update-rbmt.yml
new file mode 100644
index 00000000..5aecb3bc
--- /dev/null
+++ b/.github/workflows/cron-monthly-update-rbmt.yml
@@ -0,0 +1,46 @@
+name: Update Rust Bitcoin Maintainer Tools
+on:
+ schedule:
+ - cron: "10 0 1 * *" # 1st of every month at 00:10
+ workflow_dispatch: # allows manual triggering
+permissions: {}
+jobs:
+ update-rbmt:
+ name: Update cargo-rbmt
+ runs-on: ubuntu-24.04
+ permissions:
+ contents: write
+ pull-requests: write
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ - name: Update cargo-rbmt version to latest release
+ run: |
+ set -euo pipefail
+ git clone --filter=blob:none --no-checkout \
+ https://github.com/rust-bitcoin/rust-bitcoin-maintainer-tools.git /tmp/rbmt
+ LATEST_TAG=$(git -C /tmp/rbmt tag --sort=-version:refname | grep '^cargo-rbmt-' | head -1)
+ LATEST_HASH=$(git -C /tmp/rbmt rev-parse "${LATEST_TAG}^{}")
+ CURRENT_HASH=$(cat rbmt-version)
+ if [ -n "${LATEST_HASH}" ] && [ "${LATEST_HASH}" != "${CURRENT_HASH}" ]; then
+ echo "${LATEST_HASH}" > rbmt-version
+ echo "rbmt_hash=${LATEST_HASH}" >> "${GITHUB_ENV}"
+ echo "rbmt_semver=${LATEST_TAG#cargo-rbmt-}" >> "${GITHUB_ENV}"
+ echo "changes_made=true" >> "${GITHUB_ENV}"
+ else
+ echo "rbmt-version is already at the latest release. Not opening any PR."
+ echo "changes_made=false" >> "${GITHUB_ENV}"
+ fi
+ - name: Create Pull Request
+ if: env.changes_made == 'true'
+ uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+ with:
+ token: ${{ secrets.APOELSTRA_CREATE_PR_TOKEN }}
+ author: Update RBMT Bot <bot@example.com>
+ committer: Update RBMT Bot <bot@example.com>
+ title: Automated update to cargo-rbmt (to ${{ env.rbmt_semver }})
+ body: |
+ Automated update to rbmt-version by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action
+ commit-message: Automated update to cargo-rbmt-${{ env.rbmt_semver }}
+ branch: create-pull-request/auto-rbmt-update
diff --git a/.github/workflows/cron-weekly-update-rbmt.yml b/.github/workflows/cron-weekly-update-rbmt.yml
deleted file mode 100644
index bd1e5d1a..00000000
--- a/.github/workflows/cron-weekly-update-rbmt.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-name: Update Rust Bitcoin Maintainer Tools
-on:
- schedule:
- - cron: "10 0 * * 6" # Saturday at 00:10
- workflow_dispatch: # allows manual triggering
-permissions: {}
-jobs:
- format:
- name: Update cargo rbmt
- runs-on: ubuntu-24.04
- permissions:
- contents: write
- pull-requests: write
- steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- with:
- persist-credentials: false
- - name: Update cargo-rbmt version to latest release
- run: |
- set -euo pipefail
- git clone --filter=blob:none --no-checkout \
- https://github.com/rust-bitcoin/rust-bitcoin-maintainer-tools.git /tmp/rbmt
- LATEST_TAG=$(git -C /tmp/rbmt tag --sort=-version:refname | grep '^cargo-rbmt-' | head -1)
- LATEST_HASH=$(git -C /tmp/rbmt rev-parse "${LATEST_TAG}^{}")
- CURRENT_HASH=$(cat rbmt-version)
- if [ -n "${LATEST_HASH}" ] && [ "${LATEST_HASH}" != "${CURRENT_HASH}" ]; then
- echo "${LATEST_HASH}" > rbmt-version
- echo "rbmt_hash=${LATEST_HASH}" >> "${GITHUB_ENV}"
- echo "rbmt_semver=${LATEST_TAG#cargo-rbmt-}" >> "${GITHUB_ENV}"
- echo "changes_made=true" >> "${GITHUB_ENV}"
- else
- echo "rbmt-version is already at the latest release. Not opening any PR."
- echo "changes_made=false" >> "${GITHUB_ENV}"
- fi
- - name: Create Pull Request
- if: env.changes_made == 'true'
- uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
- with:
- token: ${{ secrets.APOELSTRA_CREATE_PR_TOKEN }}
- author: Update RBMT Bot <bot@example.com>
- committer: Update RBMT Bot <bot@example.com>
- title: Automated weekly update to cargo-rbmt (to ${{ env.rbmt_semver }})
- body: |
- Automated update to rbmt-version by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action
- commit-message: Automated update to cargo-rbmt-${{ env.rbmt_semver }}
- branch: create-pull-request/weekly-rbmt-update
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.