build: reuse release preflight artifacts

.github/workflows/openclaw-npm-release.yml

@@ -12,6 +12,10 @@ on:
         required: true
         default: false
         type: boolean
+      preflight_run_id:
+        description: Existing preflight workflow run id to promote without rebuilding
+        required: false
+        type: string
 
 concurrency:
   group: openclaw-npm-release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
@@ -97,6 +101,28 @@ jobs:
       - name: Verify release contents
         run: pnpm release:check
 
+      - name: Pack prepared npm tarball
+        id: packed_tarball
+        env:
+          OPENCLAW_PREPACK_PREPARED: "1"
+        run: |
+          set -euo pipefail
+          PACK_JSON="$(npm pack --json)"
+          echo "$PACK_JSON"
+          PACK_PATH="$(printf '%s\n' "$PACK_JSON" | node -e 'const chunks=[]; process.stdin.on("data", (chunk) => chunks.push(chunk)); process.stdin.on("end", () => { const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8")); const first = Array.isArray(parsed) ? parsed[0] : null; if (!first || typeof first.filename !== "string" || !first.filename) { process.exit(1); } process.stdout.write(first.filename); });')"
+          if [[ -z "$PACK_PATH" || ! -f "$PACK_PATH" ]]; then
+            echo "npm pack did not produce a tarball file." >&2
+            exit 1
+          fi
+          echo "path=$PACK_PATH" >> "$GITHUB_OUTPUT"
+
+      - name: Upload prepared npm tarball
+        uses: actions/upload-artifact@v7
+        with:
+          name: openclaw-npm-preflight-${{ inputs.tag }}
+          path: ${{ steps.packed_tarball.outputs.path }}
+          if-no-files-found: error
+
   validate_publish_dispatch_ref:
     if: ${{ !inputs.preflight_only }}
     runs-on: ubuntu-latest
@@ -120,6 +146,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: npm-release
     permissions:
+      actions: read
       contents: read
       id-token: write
     steps:
@@ -159,10 +186,22 @@ jobs:
 
           echo "Publishing openclaw@${PACKAGE_VERSION}"
 
+      - name: Download prepared npm tarball
+        if: ${{ inputs.preflight_run_id != '' }}
+        uses: actions/download-artifact@v8
+        with:
+          name: openclaw-npm-preflight-${{ inputs.tag }}
+          path: preflight-tarball
+          repository: ${{ github.repository }}
+          run-id: ${{ inputs.preflight_run_id }}
+          github-token: ${{ github.token }}
+
       - name: Build
+        if: ${{ inputs.preflight_run_id == '' }}
         run: pnpm build
 
       - name: Build Control UI
+        if: ${{ inputs.preflight_run_id == '' }}
         run: pnpm ui:build
 
       - name: Validate release tag and package metadata
@@ -178,5 +217,20 @@ jobs:
           git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
           pnpm release:openclaw:npm:check
 
+      - name: Resolve publish tarball
+        id: publish_tarball
+        if: ${{ inputs.preflight_run_id != '' }}
+        run: |
+          set -euo pipefail
+          TARBALL_PATH="$(find preflight-tarball -maxdepth 1 -type f -name '*.tgz' -print | sort | tail -n 1)"
+          if [[ -z "$TARBALL_PATH" ]]; then
+            echo "Prepared preflight tarball not found." >&2
+            ls -la preflight-tarball >&2 || true
+            exit 1
+          fi
+          echo "path=$TARBALL_PATH" >> "$GITHUB_OUTPUT"
+
       - name: Publish
-        run: bash scripts/openclaw-npm-publish.sh --publish
+        env:
+          OPENCLAW_PREPACK_PREPARED: "1"
+        run: bash scripts/openclaw-npm-publish.sh --publish "${{ steps.publish_tarball.outputs.path }}"