test(ci): harden installer smoke coverage

.github/workflows/install-smoke.yml

@@ -454,10 +454,10 @@ jobs:
 
       - name: Run installer docker tests
         env:
-          OPENCLAW_INSTALL_URL: https://openclaw.ai/install.sh
-          OPENCLAW_INSTALL_CLI_URL: https://openclaw.ai/install-cli.sh
+          OPENCLAW_INSTALL_URL: file:///tmp/openclaw-install.sh
+          OPENCLAW_INSTALL_CLI_URL: file:///tmp/openclaw-install-cli.sh
           OPENCLAW_NO_ONBOARD: "1"
-          OPENCLAW_INSTALL_SMOKE_SKIP_CLI: "1"
+          OPENCLAW_INSTALL_SMOKE_SKIP_CLI: "0"
           OPENCLAW_INSTALL_SMOKE_SKIP_IMAGE_BUILD: "1"
           OPENCLAW_INSTALL_NONROOT_SKIP_IMAGE_BUILD: "1"
           OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT: "0"
@@ -468,6 +468,15 @@ jobs:
           OPENCLAW_INSTALL_SMOKE_UPDATE_SKIP_LOCAL_BUILD: "1"
         run: bash scripts/test-install-sh-docker.sh
 
+      - name: Run Rocky Linux installer smoke
+        run: |
+          timeout 20m docker run --rm \
+            -e OPENCLAW_NO_ONBOARD=1 \
+            -e OPENCLAW_NO_PROMPT=1 \
+            -v "$PWD/scripts/install.sh:/tmp/install.sh:ro" \
+            rockylinux:9@sha256:d7be1c094cc5845ee815d4632fe377514ee6ebcf8efaed6892889657e5ddaaa6 \
+            bash -lc 'dnf install -y -q ca-certificates tar gzip xz findutils which sudo >/dev/null && bash /tmp/install.sh --install-method npm --version latest --no-onboard --no-prompt --verify && openclaw --version'
+
   bun_global_install_smoke:
     needs: [preflight, root_dockerfile_image]
     if: needs.preflight.outputs.run_full_install_smoke == 'true' && needs.preflight.outputs.run_bun_global_install_smoke == 'true'

scripts/docker/install-sh-smoke/run.sh

@@ -149,11 +149,22 @@ resolve_update_baseline_version() {
   UPDATE_BASELINE_VERSION="$resolved_version"
 }
 
+run_installer_for_package_spec() {
+  local install_url="$1"
+  local package_spec="$2"
+
+  timeout --foreground "${INSTALL_COMMAND_TIMEOUT}s" \
+    bash -c "curl -fsSL \"\$1\" | bash -s -- --install-method npm --version \"\$2\" --no-prompt --no-onboard" \
+    _ "$install_url" "$package_spec"
+}
+
 run_install_smoke() {
   if [[ -n "$FRESH_VERSION" && -n "$FRESH_TAG_URL" ]]; then
     echo "package=$PACKAGE_NAME latest=$FRESH_VERSION source=$FRESH_TAG_URL"
-    echo "==> Install latest release tarball"
-    npm_install_global "install latest release tarball" --omit=optional "$FRESH_TAG_URL"
+    echo "==> Run official installer one-liner for latest release tarball"
+    OPENCLAW_NO_ONBOARD=1 OPENCLAW_NO_PROMPT=1 \
+      run_with_heartbeat "installer latest release tarball" \
+        run_installer_for_package_spec "$INSTALL_URL" "$FRESH_TAG_URL"
     print_install_audit "fresh install"
 
     echo "==> Verify installed version"

scripts/test-install-sh-docker.sh

@@ -403,6 +403,7 @@ else
     --platform "$SMOKE_PLATFORM" \
     ${UPDATE_DOCKER_HOST_ARGS[@]+"${UPDATE_DOCKER_HOST_ARGS[@]}"} \
     "${NPM_CACHE_DOCKER_ARGS[@]}" \
+    -v "$ROOT_DIR/scripts/install.sh:/tmp/openclaw-install.sh:ro" \
     -v "${LATEST_DIR}:/out" \
     -e OPENCLAW_INSTALL_URL="$INSTALL_URL" \
     -e OPENCLAW_INSTALL_PACKAGE="$PACKAGE_NAME" \
@@ -501,6 +502,7 @@ else
     -e OPENCLAW_INSTALL_PACKAGE="$PACKAGE_NAME" \
     -e OPENCLAW_INSTALL_METHOD=npm \
     -e OPENCLAW_INSTALL_EXPECT_VERSION="$LATEST_VERSION" \
+    -v "$ROOT_DIR/scripts/install.sh:/tmp/openclaw-install.sh:ro" \
     -e OPENCLAW_NO_ONBOARD=1 \
     -e OPENCLAW_NO_PROMPT=1 \
     -e DEBIAN_FRONTEND=noninteractive \
@@ -523,6 +525,7 @@ docker run --rm -t \
   --entrypoint /bin/bash \
   -e OPENCLAW_INSTALL_URL="$INSTALL_URL" \
   -e OPENCLAW_INSTALL_CLI_URL="$CLI_INSTALL_URL" \
+  -v "$ROOT_DIR/scripts/install-cli.sh:/tmp/openclaw-install-cli.sh:ro" \
   -e OPENCLAW_NO_ONBOARD=1 \
   -e OPENCLAW_NO_PROMPT=1 \
   -e DEBIAN_FRONTEND=noninteractive \

test/scripts/test-install-sh-docker.test.ts

@@ -161,6 +161,17 @@ describe("test-install-sh-docker", () => {
     expect(script).toContain("quiet_npm pack --ignore-scripts");
     expect(script).toContain("node scripts/check-openclaw-package-tarball.mjs");
   });
+
+  it("runs candidate tarballs through the installer script instead of direct npm", () => {
+    const wrapper = readFileSync(SCRIPT_PATH, "utf8");
+    const runner = readFileSync(SMOKE_RUNNER_PATH, "utf8");
+
+    expect(wrapper).toContain('-v "$ROOT_DIR/scripts/install.sh:/tmp/openclaw-install.sh:ro"');
+    expect(runner).toContain("Run official installer one-liner for latest release tarball");
+    expect(runner).toContain("run_installer_for_package_spec");
+    expect(runner).toContain('bash -c "curl -fsSL \\"\\$1\\" | bash -s --');
+    expect(runner).not.toContain('npm_install_global "install latest release tarball"');
+  });
 });
 
 describe("install-sh smoke runner", () => {
@@ -270,6 +281,11 @@ describe("bun global install smoke", () => {
     expect(workflow).not.toContain('timeout 300s docker pull "$IMAGE_REF"');
     expect(workflow).toContain("--progress=plain");
     expect(workflow).toContain("--load");
+    expect(workflow).toContain("OPENCLAW_INSTALL_URL: file:///tmp/openclaw-install.sh");
+    expect(workflow).toContain("OPENCLAW_INSTALL_CLI_URL: file:///tmp/openclaw-install-cli.sh");
+    expect(workflow).toContain('OPENCLAW_INSTALL_SMOKE_SKIP_CLI: "0"');
+    expect(workflow).toContain("Run Rocky Linux installer smoke");
+    expect(workflow).toContain("rockylinux:9@sha256:");
     expect(workflow).toContain("pnpm-workspace.yaml");
     expect(workflow).toContain("workspace.patchedDependencies");
     expect(workflow).not.toContain("pkg.pnpm?.patchedDependencies");