CI: update GitHub Actions versions to ensure GA runtime compatibility
What changed, and why it matters
This commit only updates version numbers and pinned commit hashes for GitHub Actions used in the project's automated CI (continuous integration) workflows. It does not change any of the actual Bitcoin library code that users or applications interact with. There is no indication of a security vulnerability being fixed or introduced.
No security action required. Treat as routine CI maintenance. If desired, verify the new pinned SHA hashes correspond to the claimed upstream releases.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff bumps several third-party GitHub Actions to newer major versions (actions/cache v4.3.0→v5.0.0, actions/upload-artifact v5.0.0→v6.0.0, actions/download-artifact v6.0.0→v7.0.0, actions/checkout comment v4→v5.0.0, github/codeql-action/upload-sarif v3→v4) across workflow YAML files and the fuzz file generator shell script. All actions remain pinned to specific commit SHA hashes. No Rust source code, build logic, or cryptographic code is modified.
Changed components
.github/workflows/cron-daily-fuzz.yml.github/workflows/cron-weekly-cargo-mutants.yml.github/workflows/cron-zizmor.yml.github/workflows/semver-checks.yml.github/workflows/zizmor.ymlfuzz/generate-files.shInspect captured patch +11 / −11
diff --git a/.github/workflows/cron-daily-fuzz.yml b/.github/workflows/cron-daily-fuzz.yml
index b3ffff81..a3c3751a 100644
--- a/.github/workflows/cron-daily-fuzz.yml
+++ b/.github/workflows/cron-daily-fuzz.yml
@@ -57,7 +57,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ - uses: actions/cache@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
id: cache-fuzz
with:
path: |
@@ -76,7 +76,7 @@ jobs:
echo "Using RUSTFLAGS $RUSTFLAGS"
cd fuzz && ./fuzz.sh "${{ matrix.fuzz_target }}"
- run: echo "${{ matrix.fuzz_target }}" >executed_${{ matrix.fuzz_target }}
- - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+ - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: executed_${{ matrix.fuzz_target }}
path: executed_${{ matrix.fuzz_target }}
@@ -91,7 +91,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+ - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
- run: cargo install --locked --version 0.12.0 cargo-fuzz
- name: Display structure of downloaded files
run: ls -R
diff --git a/.github/workflows/cron-weekly-cargo-mutants.yml b/.github/workflows/cron-weekly-cargo-mutants.yml
index 1b0a989f..d34c9d70 100644
--- a/.github/workflows/cron-weekly-cargo-mutants.yml
+++ b/.github/workflows/cron-weekly-cargo-mutants.yml
@@ -18,7 +18,7 @@ jobs:
with:
tool: cargo-mutants
- run: cargo mutants --in-place --no-shuffle
- - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+ - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
if: always()
with:
name: mutants.out
diff --git a/.github/workflows/cron-zizmor.yml b/.github/workflows/cron-zizmor.yml
index 8d70f3fe..6b6940d2 100644
--- a/.github/workflows/cron-zizmor.yml
+++ b/.github/workflows/cron-zizmor.yml
@@ -14,7 +14,7 @@ jobs:
security-events: write
steps:
- name: Checkout repository
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
@@ -27,7 +27,7 @@ jobs:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3
+ uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
with:
sarif_file: results.sarif
category: zizmor
diff --git a/.github/workflows/semver-checks.yml b/.github/workflows/semver-checks.yml
index ef0d6ea0..82d3a761 100644
--- a/.github/workflows/semver-checks.yml
+++ b/.github/workflows/semver-checks.yml
@@ -43,7 +43,7 @@ jobs:
echo "$PR_NUMBER" > ./semver-break
- name: "Save breaking state"
if: ${{ hashFiles('semver-break') != '' }}
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+ uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: semver-break
path: semver-break
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 85a0c9a6..507b3111 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -14,7 +14,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
diff --git a/fuzz/generate-files.sh b/fuzz/generate-files.sh
index 7777c348..1fe312e9 100755
--- a/fuzz/generate-files.sh
+++ b/fuzz/generate-files.sh
@@ -89,7 +89,7 @@ $(for name in $(cargo fuzz list); do echo " $name,"; done)
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ - uses: actions/cache@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
id: cache-fuzz
with:
path: |
@@ -108,7 +108,7 @@ $(for name in $(cargo fuzz list); do echo " $name,"; done)
echo "Using RUSTFLAGS \$RUSTFLAGS"
cd fuzz && ./fuzz.sh "\${{ matrix.fuzz_target }}"
- run: echo "\${{ matrix.fuzz_target }}" >executed_\${{ matrix.fuzz_target }}
- - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+ - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
name: executed_\${{ matrix.fuzz_target }}
path: executed_\${{ matrix.fuzz_target }}
@@ -123,7 +123,7 @@ $(for name in $(cargo fuzz list); do echo " $name,"; done)
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+ - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
- run: cargo install --locked --version 0.12.0 cargo-fuzz
- name: Display structure of downloaded files
run: ls -R
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.