ci: speed up full release validation

scripts/github/resolve-openclaw-ref.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REMOTE_URL="${OPENCLAW_REF_REMOTE:-https://github.com/openclaw/openclaw.git}"
+REF=""
+EXPECTED_SHA=""
+FALLBACK_OK=0
+GITHUB_OUTPUT_FILE="${GITHUB_OUTPUT:-}"
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: resolve-openclaw-ref.sh --ref <ref> [--expected-sha <sha>] [--fallback-ok] [--github-output <file>]
+
+Fast-resolves OpenClaw branch and tag refs with git ls-remote. Full commit SHAs
+are returned as fallback refs so callers can decide whether to run deeper
+reachability validation.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --ref)
+      REF="${2:-}"
+      shift 2
+      ;;
+    --expected-sha)
+      EXPECTED_SHA="${2:-}"
+      shift 2
+      ;;
+    --fallback-ok)
+      FALLBACK_OK=1
+      shift
+      ;;
+    --github-output)
+      GITHUB_OUTPUT_FILE="${2:-}"
+      shift 2
+      ;;
+    --help|-h)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+trim() {
+  local value="$1"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  printf '%s' "$value"
+}
+
+write_output() {
+  local key="$1"
+  local value="$2"
+  if [[ -n "$GITHUB_OUTPUT_FILE" ]]; then
+    printf '%s=%s\n' "$key" "$value" >> "$GITHUB_OUTPUT_FILE"
+  else
+    printf '%s=%s\n' "$key" "$value"
+  fi
+}
+
+resolve_unique_remote_ref() {
+  local refspec
+  local -a matches=()
+  for refspec in "$@"; do
+    [[ -n "$refspec" ]] || continue
+    mapfile -t matches < <(
+      git ls-remote "$REMOTE_URL" "$refspec" | awk '{print $1}' | awk '!seen[$0]++'
+    )
+    if [[ "${#matches[@]}" -eq 0 ]]; then
+      continue
+    fi
+    if [[ "${#matches[@]}" -ne 1 ]]; then
+      return 2
+    fi
+    printf '%s\n' "${matches[0]}"
+    return 0
+  done
+  return 1
+}
+
+REF="$(trim "$REF")"
+EXPECTED_SHA="$(trim "$EXPECTED_SHA")"
+if [[ -z "$REF" ]] || [[ "$REF" == -* ]]; then
+  echo "Expected a branch, tag, or full commit SHA; got: ${REF}" >&2
+  exit 1
+fi
+if [[ -n "$EXPECTED_SHA" ]] && [[ ! "$EXPECTED_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
+  echo "Expected --expected-sha to be a full commit SHA; got: ${EXPECTED_SHA}" >&2
+  exit 1
+fi
+
+if [[ "$REF" =~ ^[0-9a-fA-F]{40}$ ]]; then
+  if [[ -n "$EXPECTED_SHA" ]] && [[ "${REF,,}" != "${EXPECTED_SHA,,}" ]]; then
+    echo "Ref SHA ${REF} does not match expected SHA ${EXPECTED_SHA}." >&2
+    exit 1
+  fi
+  write_output sha "${REF,,}"
+  write_output ref_kind sha
+  write_output fast false
+  write_output fallback true
+  exit 0
+fi
+
+declare -a matches=()
+if [[ "$REF" == refs/heads/* ]]; then
+  mapfile -t matches < <(resolve_unique_remote_ref "$REF" || true)
+elif [[ "$REF" == refs/tags/* ]]; then
+  mapfile -t matches < <(resolve_unique_remote_ref "${REF}^{}" "$REF" || true)
+elif [[ "$REF" == refs/* ]]; then
+  mapfile -t matches < <(resolve_unique_remote_ref "$REF" || true)
+else
+  mapfile -t branch_matches < <(resolve_unique_remote_ref "refs/heads/${REF}" || true)
+  mapfile -t tag_matches < <(resolve_unique_remote_ref "refs/tags/${REF}^{}" "refs/tags/${REF}" || true)
+  match_count=$(( ${#branch_matches[@]} + ${#tag_matches[@]} ))
+  if [[ "$match_count" -eq 1 ]]; then
+    if [[ "${#branch_matches[@]}" -eq 1 ]]; then
+      matches=("${branch_matches[0]}")
+      ref_kind=branch
+    else
+      matches=("${tag_matches[0]}")
+      ref_kind=tag
+    fi
+  elif [[ "$match_count" -gt 1 ]]; then
+    echo "Ref resolved ambiguously as both branch and tag: ${REF}" >&2
+    exit 1
+  fi
+fi
+
+if [[ "${#matches[@]}" -eq 1 ]]; then
+  resolved="${matches[0],,}"
+  if [[ -n "$EXPECTED_SHA" ]] && [[ "$resolved" != "${EXPECTED_SHA,,}" ]]; then
+    echo "Ref ${REF} resolved to ${resolved}, expected ${EXPECTED_SHA}." >&2
+    exit 1
+  fi
+  if [[ -z "${ref_kind:-}" ]]; then
+    if [[ "$REF" == refs/tags/* ]]; then
+      ref_kind=tag
+    elif [[ "$REF" == refs/heads/* ]]; then
+      ref_kind=branch
+    else
+      ref_kind=ref
+    fi
+  fi
+  write_output sha "$resolved"
+  write_output ref_kind "$ref_kind"
+  write_output fast true
+  write_output fallback false
+  exit 0
+fi
+
+if [[ "$FALLBACK_OK" -eq 1 ]]; then
+  write_output sha "$EXPECTED_SHA"
+  write_output ref_kind unknown
+  write_output fast false
+  write_output fallback true
+  exit 0
+fi
+
+echo "Failed to resolve OpenClaw ref: ${REF}" >&2
+exit 1

scripts/lib/docker-e2e-scenarios.mjs

@@ -418,11 +418,14 @@ const releasePathPluginRuntimeLanes = [
   ),
 ];
 
-const releasePathPluginRuntimeCoreLanes = [
+const releasePathPluginRuntimePluginLanes = [
   lane("plugins", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugins", {
     resources: ["npm", "service"],
     weight: 6,
   }),
+];
+
+const releasePathPluginRuntimeServiceLanes = [
   serviceLane(
     "cron-mcp-cleanup",
     "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:cron-mcp-cleanup",
@@ -438,6 +441,11 @@ const releasePathPluginRuntimeCoreLanes = [
   ),
 ];
 
+const releasePathPluginRuntimeCoreLanes = [
+  ...releasePathPluginRuntimePluginLanes,
+  ...releasePathPluginRuntimeServiceLanes,
+];
+
 const releasePathBundledChannelLanes = [
   npmLane("plugin-update", "OPENCLAW_SKIP_DOCKER_BUILD=1 pnpm test:docker:plugin-update"),
   ...bundledScenarioLanes,
@@ -508,9 +516,12 @@ const primaryReleasePathChunks = {
   "package-update-openai": releasePathPackageInstallOpenAiLanes,
   "package-update-anthropic": releasePathPackageInstallAnthropicLanes,
   "package-update-core": releasePathPackageUpdateCoreLanes,
-  "plugins-runtime-core": releasePathPluginRuntimeCoreLanes,
-  "plugins-runtime-install-a": bundledPluginInstallUninstallLanes.slice(0, 4),
-  "plugins-runtime-install-b": bundledPluginInstallUninstallLanes.slice(4),
+  "plugins-runtime-plugins": releasePathPluginRuntimePluginLanes,
+  "plugins-runtime-services": releasePathPluginRuntimeServiceLanes,
+  "plugins-runtime-install-a": bundledPluginInstallUninstallLanes.slice(0, 2),
+  "plugins-runtime-install-b": bundledPluginInstallUninstallLanes.slice(2, 4),
+  "plugins-runtime-install-c": bundledPluginInstallUninstallLanes.slice(4, 6),
+  "plugins-runtime-install-d": bundledPluginInstallUninstallLanes.slice(6),
   "bundled-channels-core": [releasePathBundledChannelLanes[0], ...bundledChannelSmokeLanes],
   "bundled-channels-update-a": [bundledChannelUpdateLanes[0], bundledChannelUpdateLanes[4]],
   "bundled-channels-update-discord": [bundledChannelUpdateLanes[1]],
@@ -529,6 +540,7 @@ const legacyReleasePathChunks = {
     ...releasePathPackageInstallAnthropicLanes,
     ...releasePathPackageUpdateCoreLanes,
   ],
+  "plugins-runtime-core": releasePathPluginRuntimeCoreLanes,
   "plugins-runtime": releasePathPluginRuntimeLanes,
   "plugins-integrations": [...releasePathPluginRuntimeLanes, ...releasePathBundledChannelLanes],
   "bundled-channels": releasePathBundledChannelLanes,
@@ -560,7 +572,8 @@ export function releasePathChunkLanes(chunk, options = {}) {
     return options.includeOpenWebUI ? [openWebUILane()] : [];
   }
   if (
-    (chunk !== "plugins-runtime-core" &&
+    (chunk !== "plugins-runtime-services" &&
+      chunk !== "plugins-runtime-core" &&
       chunk !== "plugins-runtime" &&
       chunk !== "plugins-integrations") ||
     !options.includeOpenWebUI

scripts/openclaw-cross-os-release-checks.ts

@@ -155,7 +155,7 @@ export function resolveRunnerMatrix(params) {
     {
       os_id: "ubuntu",
       display_name: "Linux",
-      runner: pick(params.ubuntuRunner, params.varUbuntuRunner, "ubuntu-latest"),
+      runner: pick(params.ubuntuRunner, params.varUbuntuRunner, "blacksmith-8vcpu-ubuntu-2404"),
       artifact_name: "linux",
     },
     {