ci: match package Telegram harness to release ref

.github/workflows/full-release-validation.yml

@@ -272,6 +272,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           CHILD_WORKFLOW_REF: ${{ github.ref_name }}
+          TARGET_SHA: ${{ needs.resolve_target.outputs.sha }}
           PACKAGE_SPEC: ${{ inputs.npm_telegram_package_spec }}
           PROVIDER_MODE: ${{ inputs.npm_telegram_provider_mode }}
           SCENARIO: ${{ inputs.npm_telegram_scenario }}
@@ -280,7 +281,7 @@ jobs:
 
           before_json="$(gh run list --workflow npm-telegram-beta-e2e.yml --event workflow_dispatch --limit 100 --json databaseId --jq '[.[].databaseId]')"
 
-          args=(-f package_spec="$PACKAGE_SPEC" -f provider_mode="$PROVIDER_MODE")
+          args=(-f package_spec="$PACKAGE_SPEC" -f harness_ref="$TARGET_SHA" -f provider_mode="$PROVIDER_MODE")
           if [[ -n "${SCENARIO// }" ]]; then
             args+=(-f scenario="$SCENARIO")
           fi

.github/workflows/npm-telegram-beta-e2e.yml

@@ -18,6 +18,11 @@ on:
         required: false
         default: ""
         type: string
+      harness_ref:
+        description: Source ref for the private QA harness; defaults to the dispatched workflow ref
+        required: false
+        default: ""
+        type: string
       provider_mode:
         description: QA provider mode
         required: true
@@ -46,6 +51,11 @@ on:
         required: false
         default: ""
         type: string
+      harness_ref:
+        description: Source ref for the private QA harness; defaults to the called workflow ref
+        required: false
+        default: ""
+        type: string
       provider_mode:
         description: QA provider mode
         required: false
@@ -91,7 +101,7 @@ jobs:
       - name: Checkout dispatch ref
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ inputs.harness_ref || github.sha }}
           fetch-depth: 1
 
       - name: Set up Blacksmith Docker Builder

.github/workflows/package-acceptance.yml

@@ -480,6 +480,7 @@ jobs:
       package_spec: ${{ inputs.package_spec }}
       package_artifact_name: ${{ needs.resolve_package.outputs.package_artifact_name }}
       package_label: openclaw@${{ needs.resolve_package.outputs.package_version }}
+      harness_ref: ${{ inputs.source == 'ref' && inputs.package_ref || inputs.workflow_ref }}
       provider_mode: ${{ needs.resolve_package.outputs.telegram_mode }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

test/scripts/package-acceptance-workflow.test.ts

@@ -51,6 +51,9 @@ describe("package acceptance workflow", () => {
     expect(workflow).toContain(
       "package_label: openclaw@${{ needs.resolve_package.outputs.package_version }}",
     );
+    expect(workflow).toContain(
+      "harness_ref: ${{ inputs.source == 'ref' && inputs.package_ref || inputs.workflow_ref }}",
+    );
   });
 });
 
@@ -93,6 +96,8 @@ describe("package artifact reuse", () => {
     expect(workflow).toContain("workflow_call:");
     expect(workflow).toContain("package_artifact_name:");
     expect(workflow).toContain("Download package-under-test artifact");
+    expect(workflow).toContain("harness_ref:");
+    expect(workflow).toContain("ref: ${{ inputs.harness_ref || github.sha }}");
     expect(workflow).toContain("OPENCLAW_NPM_TELEGRAM_PACKAGE_TGZ");
     expect(workflow).toContain("provider_mode:");
     expect(workflow).toContain("provider_mode must be mock-openai or live-frontier");
@@ -154,6 +159,7 @@ describe("package artifact reuse", () => {
     expect(workflow).toContain(
       'gh workflow run npm-telegram-beta-e2e.yml --ref "$CHILD_WORKFLOW_REF" "${args[@]}"',
     );
+    expect(workflow).toContain('-f harness_ref="$TARGET_SHA"');
     expect(workflow).not.toContain("workflow_ref:");
     expect(workflow).not.toContain("inputs.workflow_ref");
   });