Informational 15 Bitcoin Committed Aug 20, 2026 · 09:26 UTC

Merge rust-bitcoin/rust-bitcoin#6761: Manual bump of dtolnay/rust-toolchain specifying toolchain

e42b17a3 View source ↗

Public commit record

What the developer wrote

Authored by Andrew Poelstra

91/100 · Strong

Merge rust-bitcoin/rust-bitcoin#6761: Manual bump of dtolnay/rust-toolchain specifying toolchain

4fa6b1c71d34e0121e834b78f486ac9b46f2cf57 ci: pass toolchain input to rust-toolchain action (satsfy (Renato Britto))
06ba6541bca755b6e7088f6a893218d96a9d2ad4 build(deps): update dtolnay/rust-toolchain requirement to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 (dependabot[bot])

Pull request description:

Supersedes https://github.com/rust-bitcoin/rust-bitcoin/pull/6751

The dependabot bump moved `stable` branch pin to `master`, which has no toolchain default and requires it to be specified. The solution here is inspired on Miri CI workflow and another rust.yml job, which already implements the same.

ACKs for top commit:
tcharding:
ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57
apoelstra:
ACK 4fa6b1c71d34e0121e834b78f486ac9b46f2cf57; successfully ran local tests

Tree-SHA512: 02de193e168a639ed9f4f191d3ca10f8d70824e4ae25163fe92475096103da3c4903c99e7cc8dbd21ce4839b5a48a42e57e8dec4edb162c50cdef8f721f217bb

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This commit updates the version of a third-party GitHub Action used to install Rust in automated CI workflows, and explicitly adds the 'stable' toolchain option where the newer version requires it. It is a routine infrastructure/maintenance change with no direct effect on the Rust Bitcoin library code or its security.

Recommended action

No security action required. Verify CI passes after the toolchain bump as normal maintenance.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The patch bumps dtolnay/rust-toolchain from pinned stable/e97e2d8/5d45857 to 6c977a6 across cron-daily-miri.yml, rust.yml, and semver-checks.yml. Because the new action default no longer auto-selects a toolchain, the commit adds ‘with: toolchain: stable’ (or the existing nightly variable) to each invocation. This is purely a CI configuration fix to restore workflow behavior after a Dependabot update changed the pinned branch.

Changed components

.github/workflows/cron-daily-miri.yml.github/workflows/rust.yml.github/workflows/semver-checks.yml

Inspect captured patch +20 / −8

### .github/workflows/cron-daily-miri.yml
@@ -26,7 +26,7 @@ jobs:
         id: read_toolchain
         run: echo "nightly_version=$(cargo metadata --format-version 1 | jq -r '.metadata.rbmt.toolchains.nightly')" >> $GITHUB_OUTPUT
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: ${{ steps.read_toolchain.outputs.nightly_version }}
           components: miri

### .github/workflows/rust.yml
@@ -146,7 +146,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Add architecture i386 and install dependencies"
         run: |
           sudo dpkg --add-architecture i386
@@ -179,7 +181,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: ${{ needs.Prepare.outputs.nightly_version }}
       - name: "Install rust-src"
@@ -217,7 +219,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Run policy script"
         run: ./contrib/check-for-policy-violations.sh
 
@@ -234,7 +238,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Run primitives API checker script"
         run: |
           contrib/generate-primitives-re-export-test.sh && (cd ./primitives && cargo test --all-features)
@@ -253,7 +259,9 @@ jobs:
         with:
           persist-credentials: false
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Check Encode coverage"
         run: ./contrib/check-encodable-coverage.sh
 
@@ -267,7 +275,9 @@ jobs:
           persist-credentials: false
           fetch-depth: 0 # required for full diff context
       - name: "Select toolchain"
-        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Fetch base branch for diff"
         run: git fetch origin master
       - name: "Retrieve relative diff"

### .github/workflows/semver-checks.yml
@@ -23,7 +23,9 @@ jobs:
           fetch-depth: 0 # we need full history for cargo semver-checks
           persist-credentials: false
       - name: "Install Rustup"
-        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
       - name: "Select stable-version"
         run: |
           rustup default $(cargo metadata --format-version 1 | jq -r '.metadata.rbmt.toolchains.stable')

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

ci: pass toolchain input to rust-toolchain action

Merge rust-bitcoin/rust-bitcoin#6757: ci: gen PR labels from master instead of fork

Merge rust-bitcoin/rust-bitcoin#6741: units: Add and standardise doc and comment links