ci: bump cargo-rbmt and switch to upstream setup-rbmt action

Rust Bitcoin/rust-bitcoin

ca9550ca View source ↗

Public commit record

What the developer wrote

Authored by Nick Johnson

62/100 · Adequate

ci: bump cargo-rbmt and switch to upstream setup-rbmt action

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This is a routine maintenance change to the project's automated testing setup. It replaces a custom GitHub Actions helper with an equivalent upstream action and updates the version of an internal tool (cargo-rbmt). There is no change to the actual Bitcoin library code that users run, and nothing in the commit suggests a security problem or fix.

Recommended action

No security action needed. Treat as normal CI tooling update.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit removes the local .github/actions/prepare composite action and switches all CI jobs to use rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9. It also bumps the pinned cargo-rbmt revision in rbmt-version from b5a97cc14517f12db07caa4b90822ef28f7f2420 to 9de0de1f36f65a2cb9c617358d88aecd319282d9. The cargo rbmt CLI invocations are updated to use explicit –toolchain flags. No Rust source code, dependencies consumed by users, or cryptographic logic is modified.

Changed components

.github/actions/prepare/action.yml.github/workflows/rust.ymlrbmt-version

Inspect captured patch +11 / −62

diff --git a/.github/actions/prepare/action.yml b/.github/actions/prepare/action.yml
deleted file mode 100644
index ff615d17..00000000
--- a/.github/actions/prepare/action.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: 'Prepare Rust Environment'
-description: 'Setup Rust toolchain and install RBMT'
-inputs:
-  toolchain:
-    description: 'Rust toolchain to use (nightly reads from nightly-version file)'
-    required: false
-    default: 'stable'
-  components:
-    description: 'Rust components to install (e.g., clippy, rustfmt)'
-    required: false
-    default: ''
-runs:
-  using: "composite"
-  steps:
-    - name: "Determine toolchain"
-      id: toolchain
-      shell: bash
-      run: |
-        if [ "${INPUTS_TOOLCHAIN}" = "nightly" ]; then
-          TOOLCHAIN="$(cat nightly-version)"
-        else
-          TOOLCHAIN="${INPUTS_TOOLCHAIN}"
-        fi
-        echo "version=$TOOLCHAIN" >> $GITHUB_OUTPUT
-      env:
-        INPUTS_TOOLCHAIN: ${{ inputs.toolchain }}
-
-    - name: "Setup requested toolchain"
-      uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
-      with:
-        toolchain: stable,${{ steps.toolchain.outputs.version }}
-        components: ${{ inputs.components }}
-
-    - name: "Install RBMT"
-      shell: bash
-      run: cargo +stable install --git https://github.com/rust-bitcoin/rust-bitcoin-maintainer-tools.git --rev "$(cat rbmt-version)" cargo-rbmt --locked
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 08369d5c..502d7adb 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -40,11 +40,9 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: stable
+      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9
       - name: "Run tests"
-        run: cargo rbmt test stable --lock-file ${{ matrix.dep }}
+        run: cargo rbmt test --toolchain stable --lock-file ${{ matrix.dep }}
 
   Nightly:                      # 2 jobs, one per manifest.
     name: Test - nightly toolchain
@@ -59,11 +57,9 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: nightly
+      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9
       - name: "Run tests"
-        run: cargo rbmt test nightly --lock-file ${{ matrix.dep }}
+        run: cargo rbmt test --toolchain nightly --lock-file ${{ matrix.dep }}
 
   MSRV:                         # 2 jobs, one per manifest.
     name: Test - MSRV toolchain
@@ -78,11 +74,9 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: "1.74.0"
+      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9
       - name: "Run tests"
-        run: cargo rbmt test msrv --lock-file ${{ matrix.dep }}
+        run: cargo rbmt test --toolchain msrv --lock-file ${{ matrix.dep }}
 
   Lint:
     name: Lint - nightly toolchain
@@ -97,10 +91,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: nightly
-          components: clippy
+      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9
       - name: "Run lint"
         run: cargo rbmt lint
 
@@ -117,9 +108,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: stable
+      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9
       - name: "Build docs"
         run: cargo rbmt docs
 
@@ -136,9 +125,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: nightly
+      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9
       - name: "Build docs.rs docs"
         run: cargo rbmt docsrs
 
@@ -155,9 +142,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: nightly
+      - uses: rust-bitcoin/rust-bitcoin-maintainer-tools/.github/actions/setup-rbmt@9de0de1f36f65a2cb9c617358d88aecd319282d9
       - name: "Run benches"
         run: cargo rbmt bench --lock-file ${{ matrix.dep }}
 
diff --git a/rbmt-version b/rbmt-version
index ed695f88..ca561624 100644
--- a/rbmt-version
+++ b/rbmt-version
@@ -1 +1 @@
-b5a97cc14517f12db07caa4b90822ef28f7f2420
+9de0de1f36f65a2cb9c617358d88aecd319282d9

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

Merge rust-bitcoin/rust-bitcoin#6671: units: reword docs from height to count in relative locktime

Merge rust-bitcoin/rust-bitcoin#6670: ci: fix labeller permissions

Merge rust-bitcoin/rust-bitcoin#6657: Release tracking PR: `base58ck 0.5.0`