From 6325b0f3c456fb39634d5eede2cf96fcfd4838b3 Mon Sep 17 00:00:00 2001
From: Dallin Romney <dallinromney@gmail.com>
Date: Sat, 18 Jul 2026 12:29:13 -0700
Subject: [PATCH] fix(qa): hydrate full profile live credentials (#110897)

---
 .github/workflows/qa-profile-evidence.yml | 38 +++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/qa-profile-evidence.yml b/.github/workflows/qa-profile-evidence.yml
index 6f0015d3896a..880df77dda67 100644
--- a/.github/workflows/qa-profile-evidence.yml
+++ b/.github/workflows/qa-profile-evidence.yml
@@ -39,6 +39,12 @@ on:
       OPENAI_API_KEY:
         description: OpenAI API key used by live QA profile scenarios
         required: true
+      OPENCLAW_QA_CONVEX_SITE_URL:
+        description: Optional Convex credential broker URL supplied by qa-live-shared
+        required: false
+      OPENCLAW_QA_CONVEX_SECRET_CI:
+        description: Optional Convex CI credential supplied by qa-live-shared
+        required: false
     outputs:
       artifact_name:
         description: Uploaded QA profile evidence artifact name
@@ -191,7 +197,7 @@ jobs:
     name: Generate QA profile evidence
     needs: validate_selected_ref
     runs-on: blacksmith-8vcpu-ubuntu-2404
-    timeout-minutes: 60
+    timeout-minutes: ${{ inputs.qa_profile == 'all' && 240 || 60 }}
     permissions:
       contents: read
     outputs:
@@ -240,11 +246,34 @@ jobs:
             throw new Error(`Unknown QA profile ${requested}. Available profiles: ${available}`);
           }
 
-          fs.appendFileSync(process.env.GITHUB_OUTPUT, `profile=${profile.id}\n`);
+          fs.appendFileSync(
+            process.env.GITHUB_OUTPUT,
+            `profile=${profile.id}\nchannel_driver=${profile.channelDriver}\n`,
+          );
           NODE
 
           echo "QA profile: \`${QA_PROFILE}\`" >> "$GITHUB_STEP_SUMMARY"
 
+      - name: Require live profile credentials
+        if: steps.profile.outputs.channel_driver == 'live'
+        env:
+          OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
+          OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          require_var() {
+            local name="$1"
+            if [[ -z "${!name:-}" ]]; then
+              echo "Missing required qa-live-shared secret: ${name}" >&2
+              exit 1
+            fi
+          }
+
+          require_var OPENCLAW_QA_CONVEX_SITE_URL
+          require_var OPENCLAW_QA_CONVEX_SECRET_CI
+
       - name: Build private QA runtime
         env:
           NODE_OPTIONS: --max-old-space-size=8192
@@ -258,6 +287,11 @@ jobs:
         env:
           QA_PROFILE: ${{ steps.profile.outputs.profile }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
+          OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
+          OPENCLAW_QA_CREDENTIAL_ACQUIRE_TIMEOUT_MS: "1800000"
+          OPENCLAW_QA_CREDENTIAL_ROLE: ci
+          OPENCLAW_QA_CREDENTIAL_SOURCE: convex
         shell: bash
         run: |
           set -euo pipefail