ci: consider secfix/ as release branches too
What the developer wrote
Authored by Martin Milata
ci: consider secfix/ as release branches too
What changed, and why it matters
This commit updates Trezor's GitHub CI automation so that branches whose names start with 'secfix/' are treated the same as release branches. It also tightens a couple of upload jobs so they only run in the official repository, and changes one commit-message check to run on any push. The change itself is about build/release plumbing, not a fix for a security bug in the firmware.
No immediate action required. Treat this as a CI hygiene change. If a 'secfix/' branch is created, review the actual firmware/security fix in that branch separately.
Security signals we found
Branch naming convention 'secfix/' implies future security-fix branches will use CI paths previously reserved for release branches
Repository guard added to emulator upload jobs reduces risk of artifact leakage from forks
No product/firmware code is patched in this commit
Evidence from the diff
The diff modifies four GitHub Actions workflow files. It adds ‘secfix/’ to the branch filters that already included ‘release/’ for push triggers. In core.yml the device matrix condition is broadened from ‘startsWith(refs/heads/release/)’ to ‘github.event_name == push’, and emulator upload jobs are restricted to the canonical repo. In prebuild.yml the release commit message check is also broadened to any push. There is no firmware code change.
Changed components
.github/workflows/common.yml.github/workflows/core.yml.github/workflows/legacy.yml.github/workflows/prebuild.ymlInspect captured patch +9 / −5
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 817444a8..aee3add0 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -8,6 +8,7 @@ on:
push:
branches:
- 'release/**'
+ - 'secfix/**'
# cancel any previous runs on the same PR
diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index 9d88428f..1b2fca40 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -13,6 +13,7 @@ on:
push:
branches:
- 'release/**'
+ - 'secfix/**'
# cancel any previous runs on the same PR
concurrency:
@@ -51,7 +52,7 @@ jobs:
strategy:
fail-fast: false
matrix:
- model: ${{ fromJSON(startsWith(github.ref, 'refs/heads/release/') && '["T2B1", "T2T1", "T3B1", "T3T1", "T3W1"]' || '["T2T1", "T3B1", "T3T1", "T3W1"]') }}
+ model: ${{ fromJSON(github.event_name == 'push' && '["T2B1", "T2T1", "T3B1", "T3T1", "T3W1"]' || '["T2T1", "T3B1", "T3T1", "T3W1"]') }}
coins: [universal, btconly]
type: ${{ fromJSON(github.event_name == 'schedule' && '["normal", "debuglink", "production"]' || '["normal", "debuglink"]') }}
include:
@@ -720,7 +721,7 @@ jobs:
core_upload_emu:
name: Upload emulator binaries
- if: github.event_name == 'schedule'
+ if: github.event_name == 'schedule' && github.repository == 'trezor/trezor-firmware'
runs-on: ubuntu-latest
needs:
- core_emu
@@ -743,7 +744,7 @@ jobs:
core_upload_emu_branch:
name: Upload emulator binaries for the current branch
# Not building it for nightly CI
- if: github.event_name != 'schedule'
+ if: github.event_name != 'schedule' && github.repository == 'trezor/trezor-firmware'
runs-on: ubuntu-latest
needs:
# Do not include ARM, they are only built on nightly
diff --git a/.github/workflows/legacy.yml b/.github/workflows/legacy.yml
index b7f807d5..35384b43 100644
--- a/.github/workflows/legacy.yml
+++ b/.github/workflows/legacy.yml
@@ -8,6 +8,7 @@ on:
push:
branches:
- 'release/**'
+ - 'secfix/**'
# cancel any previous runs on the same PR
concurrency:
@@ -201,7 +202,7 @@ jobs:
legacy_upload_emu:
name: Upload emulator binaries
- if: github.event_name == 'schedule'
+ if: github.event_name == 'schedule' && github.repository == 'trezor/trezor-firmware'
runs-on: ubuntu-latest
needs:
- legacy_emu
diff --git a/.github/workflows/prebuild.yml b/.github/workflows/prebuild.yml
index 61d18839..90783ddf 100644
--- a/.github/workflows/prebuild.yml
+++ b/.github/workflows/prebuild.yml
@@ -8,6 +8,7 @@ on:
push:
branches:
- 'release/**'
+ - 'secfix/**'
# cancel any previous runs on the same PR
concurrency:
@@ -86,7 +87,7 @@ jobs:
# Checking the format of release commit messages.
release_commit_msg_check:
name: Release commit message check
- if: ${{ startsWith(github.ref, 'refs/heads/release/') && github.repository == 'trezor/trezor-firmware' }}
+ if: ${{ github.event_name == 'push' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.