Task 60007136972

security: harden CI actions and subprocess calls

2026-01-10 13:23:35 completed security-hardening-ci-scripts 6cc01c12b2e93b5c28ec5461ba8af25a2371b59e

build_duration:14m0s
ccache_hitrate:27s
depends_build_duration:7s
docker_build_cached:true
docker_build_duration:6s
functional_test_duration:10m25s
unit_test_duration:1m53s

Commands that took longer than 1 second (total 28m45s)

line	duration	percentage	command
950	6s	0%	`docker buildx build --file=/home/runner/work/bitcoin/bitcoin/ci/test_imagefile --build-arg=CI_IMAGE_NAME_TAG=mirror.gcr.io/ubuntu:24.04 --build-arg=FILE_ENV=./ci/test/00_setup_env_arm.sh --build-arg=BASE_ROOT_DIR=/home/runner/work/_temp --platform=linux/arm64 --label=bitcoin-ci-test --tag=ci_arm_linux --cache-from type=gha,scope=ci_arm_linux --load /home/runner/work/bitcoin/bitcoin`
1088	6s	0%	`retry -- apt-get update`
1123	2s	0%	`retry -- apt-get install --no-install-recommends --no-upgrade -y python3-zmq g++-arm-linux-gnueabihf libc6:armhf libstdc++6:armhf libfontconfig1:armhf libxcb1:armhf build-essential pkgconf curl ca-certificates ccache python3-dev rsync git procps bison e2fsprogs cmake ninja-build`
1188	2s	0%	`g++-13`
1313	13s	0%	`arm64 4:13.2.0-7ubuntu1 [1082 B]`
1741	11s	0%	`(4:13.2.0-7ubuntu1) ...`
2131	1s	0%	`to provide /usr/bin/c++ (c++) in auto mode`
2162	42s	2%	`echo -n done`
2392	7s	0%	`bash -c 'CONFIG_SHELL= make -j4 -C depends HOST=arm-linux-gnueabihf LOG=1'`
2445	11s	0%	`- skipped`
2870	14m0s	48%	`cmake --build /home/runner/work/_temp/build -j4 --target all install`
4091	1m53s	6%	`ctest --test-dir /home/runner/work/_temp/build --stop-on-failure -j4 --timeout 2400`
4406	10m25s	36%	`/home/runner/work/_temp/build/test/functional/test_runner.py --ci -j4 --tmpdirprefix /home/runner/work/_temp/ci/scratch/test_runner/ --ansi --combinedlogslen=99999999 --timeout-factor=40 --quiet --failfast`
5780	5s	0%	`docker container kill 75b3efd7e4c542aa3f0d64b484db1c117cd7f522ed6b54b313db92ff8f1222dd`

Tags

security-hardening-ci-scripts