ci: hw: bump actions/checkout, actions/upload-artifact

Trezor/Trezor firmware

a3bc309b View source ↗

Public commit record

What the developer wrote

Authored by Martin Milata

62/100 · Adequate

ci: hw: bump actions/checkout, actions/upload-artifact

[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit updates the versions of two GitHub-provided helper actions used in Trezor's automated hardware testing workflows. It also disables the 'persist-credentials' option on checkout steps, which is a security-hardening setting that prevents later workflow steps from accidentally keeping long-lived repository access tokens. The change is routine CI maintenance with a small defensive-security benefit, not a fix for an active vulnerability in the Trezor firmware itself.

Recommended action

No urgent action required. Review the upstream release notes for actions/checkout v6.0.2 and actions/upload-artifact v7.0.0 to confirm they do not introduce breaking changes for the hardware test workflow. Continue monitoring CI logs after merge.

Security signals we found

CI action version bump with potential upstream security fixes

persist-credentials: false added to reduce token exposure

Artifact upload scope narrowed by device model

No firmware, crypto, or bootloader code changed

Technical analysis

Evidence from the diff

The diff bumps actions/checkout to v6.0.2 and actions/upload-artifact to v7.0.0 in .github/workflows/core-hw.yml. It also sets persist-credentials: false on checkout steps and restricts artifact upload to non-T2B1/T2T1 models in one job. These are supply-chain/CI hardening changes: newer action versions may include security patches, and persist-credentials: false reduces the window for credential leakage in self-hosted or hardware-test runners. There is no change to firmware, bootloader, or device cryptography.

Changed components

.github/workflows/core-hw.ymlGitHub Actions CI pipeline for hardware tests

Inspect captured patch +13 / −4

diff --git a/.github/workflows/core-hw.yml b/.github/workflows/core-hw.yml
index 872b9da4..38b39db2 100644
--- a/.github/workflows/core-hw.yml
+++ b/.github/workflows/core-hw.yml
@@ -52,6 +52,13 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # actions/checkout@v4.3.1
         with:
           submodules: recursive
+          persist-credentials: false
+        if: matrix.model == 'T2B1' || matrix.model == 'T2T1'
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
+        with:
+          submodules: recursive
+          persist-credentials: false
+        if: matrix.model != 'T2B1' && matrix.model != 'T2T1'
       - uses: ./.github/actions/environment
       - run: nix-shell --arg hardwareTest true --run uhubctl
       - run: nix-shell --run "uv run make -C core build_firmware"
@@ -63,14 +70,14 @@ jobs:
           nix-shell --run "uv run pytest -v --verbose-log-file pytest.log tests/device_tests $TESTOPTS"
       - run: tail -n50 trezor.log || true
         if: failure()
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # actions/upload-artifact@v4.6.2
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
         with:
           name: core-hardware-${{ matrix.model }}-${{ matrix.coins }}
           path: |
             trezor.log
             pytest.log
           retention-days: 7
-        if: always()
+        if: always() && matrix.model != 'T2B1' && matrix.model != 'T2T1'
 
   core_monero_test:
     name: Monero tests
@@ -93,9 +100,10 @@ jobs:
       BOOTLOADER_DEVEL: ${{ matrix.model == 'T2T1' && '0' || '1' }}
       TT_UHUB_PORT: all
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # actions/checkout@v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: ./.github/actions/environment
         with:
           full-deps: "true"
@@ -109,7 +117,7 @@ jobs:
           nix-shell --arg fullDeps true --run "./core/tests/run_tests_device_emu_monero.sh --trezor-path webusb:"
       - run: tail -n50 trezor.log || true
         if: failure()
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # actions/upload-artifact@v4.6.2
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
         with:
           name: core-hardware-monero-${{ matrix.model }}
           path: trezor.log
@@ -137,6 +145,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # actions/checkout@v4.3.1
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: ./.github/actions/environment
       - run: nix-shell --arg hardwareTest true --run uhubctl
       - run: nix-shell --run "uv run legacy/script/setup"

Risk score

Why this scored 18/100

Our methodology →

Potential impact 3/30

Exploitability 2/25

Stealth signal 2/15

Affected reach 2/15

Confidence 6/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 18/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters