From 0baa8c17631dbdcca67fa98aa4f54b047b9634a2 Mon Sep 17 00:00:00 2001 From: Ayaan Zaidi Date: Fri, 24 Apr 2026 11:10:47 +0530 Subject: [PATCH] ci(release): add manual npm telegram beta e2e --- .github/workflows/npm-telegram-beta-e2e.yml | 153 ++++++++++++++++++++ docs/help/testing.md | 3 + docs/reference/RELEASING.md | 3 + 3 files changed, 159 insertions(+) create mode 100644 .github/workflows/npm-telegram-beta-e2e.yml diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml new file mode 100644 index 00000000000..6b459598fee --- /dev/null +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -0,0 +1,153 @@ +name: NPM Telegram Beta E2E + +on: + workflow_dispatch: + inputs: + package_spec: + description: Published OpenClaw package spec to test + required: true + default: openclaw@beta + type: string + provider_mode: + description: QA provider mode + required: true + default: mock-openai + type: choice + options: + - mock-openai + - live-frontier + scenario: + description: Optional comma-separated Telegram scenario ids + required: false + type: string + +permissions: + contents: read + +concurrency: + group: npm-telegram-beta-e2e-${{ github.run_id }} + cancel-in-progress: false + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + NODE_VERSION: "24.x" + PNPM_VERSION: "10.33.0" + +jobs: + authorize_actor: + name: Authorize workflow actor + runs-on: blacksmith-8vcpu-ubuntu-2404 + steps: + - name: Require main workflow ref + env: + WORKFLOW_REF: ${{ github.ref }} + run: | + set -euo pipefail + if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]]; then + echo "NPM Telegram beta E2E must be dispatched from main so workflow logic stays controlled." >&2 + exit 1 + fi + + - name: Require maintainer-level repository access + uses: actions/github-script@v8 + with: + script: | + const allowed = new Set(["admin", "maintain", "write"]); + const { owner, repo } = context.repo; + const { data } = await github.rest.repos.getCollaboratorPermissionLevel({ + owner, + repo, + username: context.actor, + }); + const permission = data.permission; + core.info(`Actor ${context.actor} permission: ${permission}`); + if (!allowed.has(permission)) { + core.setFailed( + `Workflow requires write/maintain/admin access. Actor "${context.actor}" has "${permission}".`, + ); + } + + run_npm_telegram_beta_e2e: + name: Run published npm Telegram E2E + needs: authorize_actor + runs-on: blacksmith-32vcpu-ubuntu-2404 + timeout-minutes: 60 + environment: qa-live-shared + steps: + - name: Checkout main + uses: actions/checkout@v6 + with: + ref: ${{ github.sha }} + fetch-depth: 1 + + - name: Setup Node environment + uses: ./.github/actions/setup-node-env + with: + node-version: ${{ env.NODE_VERSION }} + pnpm-version: ${{ env.PNPM_VERSION }} + install-bun: "true" + + - name: Validate inputs and secrets + env: + PACKAGE_SPEC: ${{ inputs.package_spec }} + PROVIDER_MODE: ${{ inputs.provider_mode }} + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }} + OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }} + shell: bash + run: | + set -euo pipefail + + if [[ ! "${PACKAGE_SPEC}" =~ ^openclaw@(beta|latest|[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-[1-9][0-9]*|-beta\.[1-9][0-9]*)?)$ ]]; then + echo "package_spec must be openclaw@beta, openclaw@latest, or an exact OpenClaw release version; got: ${PACKAGE_SPEC}" >&2 + exit 1 + fi + + require_var() { + local key="$1" + if [[ -z "${!key:-}" ]]; then + echo "Missing required ${key}." >&2 + exit 1 + fi + } + + require_var OPENCLAW_QA_CONVEX_SITE_URL + require_var OPENCLAW_QA_CONVEX_SECRET_CI + if [[ "${PROVIDER_MODE}" == "live-frontier" ]]; then + require_var OPENAI_API_KEY + fi + + - name: Run npm Telegram beta E2E + id: run_lane + shell: bash + env: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + OPENCLAW_NPM_TELEGRAM_PACKAGE_SPEC: ${{ inputs.package_spec }} + OPENCLAW_NPM_TELEGRAM_PROVIDER_MODE: ${{ inputs.provider_mode }} + OPENCLAW_NPM_TELEGRAM_CREDENTIAL_SOURCE: convex + OPENCLAW_NPM_TELEGRAM_CREDENTIAL_ROLE: ci + OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }} + OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }} + OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1" + INPUT_SCENARIO: ${{ inputs.scenario }} + run: | + set -euo pipefail + + output_dir=".artifacts/qa-e2e/npm-telegram-beta-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" + echo "output_dir=${output_dir}" >> "$GITHUB_OUTPUT" + export OPENCLAW_NPM_TELEGRAM_OUTPUT_DIR="${output_dir}" + + if [[ -n "${INPUT_SCENARIO// }" ]]; then + export OPENCLAW_NPM_TELEGRAM_SCENARIOS="${INPUT_SCENARIO}" + fi + + pnpm test:docker:npm-telegram-live + + - name: Upload npm Telegram E2E artifacts + if: always() + uses: actions/upload-artifact@v4 + with: + name: npm-telegram-beta-e2e-${{ github.run_id }}-${{ github.run_attempt }} + path: ${{ steps.run_lane.outputs.output_dir }} + retention-days: 14 + if-no-files-found: warn diff --git a/docs/help/testing.md b/docs/help/testing.md index f187ff094ef..6703a568975 100644 --- a/docs/help/testing.md +++ b/docs/help/testing.md @@ -119,6 +119,9 @@ runs the same lanes before release approval. the Docker wrapper selects Convex automatically. - `OPENCLAW_NPM_TELEGRAM_CREDENTIAL_ROLE=ci|maintainer` overrides the shared `OPENCLAW_QA_CREDENTIAL_ROLE` for this lane only. + - GitHub Actions exposes this lane as the manual maintainer workflow + `NPM Telegram Beta E2E`. It does not run on merge. The workflow uses the + `qa-live-shared` environment and Convex CI credential leases. - `pnpm test:docker:bundled-channel-deps` - Packs and installs the current OpenClaw build in Docker, starts the Gateway with OpenAI configured, then enables bundled channel/plugins via config diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 2131c195297..b3ee390dd3b 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -93,6 +93,9 @@ OpenClaw has three public release lanes: against the published npm package using the shared leased Telegram credential pool. Local maintainer one-offs may omit the Convex vars and pass the three `OPENCLAW_QA_TELEGRAM_*` env credentials directly. +- Maintainers can run the same post-publish check from GitHub Actions via the + manual `NPM Telegram Beta E2E` workflow. It is intentionally manual-only and + does not run on every merge. - Maintainer release automation now uses preflight-then-promote: - real npm publish must pass a successful npm `preflight_run_id` - the real npm publish must be dispatched from the same `main` or