Commit Graph

46 Commits

Author SHA1 Message Date
Peter Steinberger
1564c0719f ci: pin exact action version comments (#113386) 2026-07-24 12:05:51 -07:00
Peter Steinberger
73bba03e4c refactor: canonicalize session delivery state (#113225)
* refactor: canonicalize session delivery state

* test: canonicalize reply persistence fixtures

* test: canonicalize talk delivery fixtures

* test: canonicalize voice session routes

* test: canonicalize attachment delivery fixtures

* test: migrate gateway delivery fixtures

* fix: skip invalid session delivery rows

* test: align delivery SDK surface gates

* fix: preserve legacy delivery precedence

* test: canonicalize heartbeat delivery fixtures

* fix: preserve delivery route prompt identity

* test: canonicalize session delivery fixtures

* fix: preserve recoverable legacy delivery routes

* fix: canonicalize remaining session state

* fix: preserve canonical session classification

* style: format delivery state changes

* test: refresh plugin SDK delivery baseline

* test: avoid mutating session fixture input

* style: simplify delivery identity check

* style: simplify delivery origin spread

* fix: preserve fresh delivery route metadata

* test: assert canonical surface route switch

* fix: canonicalize doctor file-store imports

* fix: preserve transitional delivery migration state

* fix: satisfy canonical delivery CI gates

* ci: scope GitHub App token permissions

* test: infer canonical delivery projections

* test: canonicalize ACP requester delivery fixtures

* test: canonicalize harness rollback fixture

* style: apply pinned formatter
2026-07-24 01:01:19 -07:00
Peter Steinberger
169dad6224 fix: watch-pr-ci exits with false FAILURE when draft-to-ready cancels superseded runs (#113230)
* fix(scripts): ignore superseded workflow runs in watch-pr-ci rollup classification

Draft->ready re-triggers leave cancelled superseded runs on the head SHA
forever, and GitHub's aggregate rollup state counts them, so the watcher
emitted terminal FAILURE while the replacement run was still in progress
and could never reach GREEN (observed on PR #113150, head bd1b9a0e).

- fetch run identity per check and resolve same-name checks to the newest
  run/check id (GitHub latest-name-wins); drop cancelled checks from
  replaced runs; keep older runs' unique jobs visible
- paginate statusCheckRollup contexts (bounded, 10 pages) so >100-context
  rollups are not truncation-blind; changed or lost snapshots throw into
  the bounded retry
- classify GREEN when aggregate FAILURE is explained solely by superseded
  contexts with full visibility; truncation still fails conservatively

* ci: scope GitHub App token permissions in stale, labeler, auto-response, and pr-ci-sweeper

Fixes red main: #112963 bumped zizmor v1.22.0 -> v1.28.0, whose github-app
audit flags create-github-app-token mints without permission-* inputs (14
high findings, Workflow Sanity red on main since 3b7b2a2a1f). Most
workflows already migrated to scoped tokens; these four were stragglers.

Scopes follow each consumer's actual API surface: stale needs issues/PR
write plus actions read for its state-cache check; labeler needs label
CRUD (issues write), PR write, members read for maintainer gates, and
contents read where actions/labeler reads its config; auto-response needs
issues/PR write plus members read; pr-ci-sweeper needs actions write to
re-fire runs, checks read, and PR write. Verified locally with the exact
CI invocation (zizmor 1.28.0, repo config, regular persona, medium
severity/confidence): no findings, ignore/suppress counts match CI.
2026-07-23 22:46:04 -07:00
Vincent Koc
abb6f04e0c ci(release): harden release controls
One-time maintainer-authorized bootstrap merge for the release-gate verifier policy. Exact hosted CI and all supporting workflow gates passed on 66133de419.
2026-06-18 03:11:20 +08:00
Dallin Romney
cdeafd1895 chore: revert dependency guard backfill machinery (#87867)
* Revert "ci: isolate dependency guard backfill label (#87882)"

This reverts commit 21b33bd04d.

* Revert "ci: add dependency guard backfill label trigger (#87866)"

This reverts commit 5a6472718d.

* ci: preserve clawsweeper bot label filter
2026-05-28 22:50:59 -07:00
Dallin Romney
21b33bd04d ci: isolate dependency guard backfill label (#87882) 2026-05-28 21:21:13 -07:00
pashpashpash
70f34bf177 Require real behavior proof for external PRs (#77622)
* ci: require real behavior proof for external PRs

* fix: tighten real behavior proof heuristics

* fix: reject test-only real behavior proof labels

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-05-05 05:45:30 +01:00
Vincent Koc
2f6615d2ee fix(triage): extract barnacle workflow 2026-04-25 17:43:08 -07:00
Vincent Koc
727e0e013e fix(triage): classify low-signal prs 2026-04-25 17:19:50 -07:00
Vincent Koc
fc334cda13 chore(pr-triage): route low-signal cleanup to ClawHub 2026-04-25 16:49:15 -07:00
Peter Steinberger
c73f7d6596 ci: move lightweight automation off blacksmith 2026-04-22 15:44:34 +01:00
dependabot[bot]
bcadf60b4d chore(deps): bump actions/create-github-app-token from 2 to 3.0.0 (#65099)
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2 to 3.0.0.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-21 21:19:58 -07:00
dependabot[bot]
7550d426dd chore(deps): bump actions/github-script from 8 to 9 (#65098)
Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v8...v9)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-21 21:19:26 -07:00
Tak Hoffman
3bf1b69ece CI: make bad-barnacle bypass PR auto-response 2026-04-04 12:28:03 -05:00
Vincent Koc
a97188ceb3 ci: start required checks earlier (#53844)
* ci: start required checks earlier

* ci: restore pnpm in security-fast

* ci: skip docs-only payloads in early check jobs

* ci: harden untrusted pull request execution

* ci: pin gradle setup action

* ci: normalize pull request concurrency cancellation

* ci: remove duplicate early-lane setup

* ci: keep install-smoke push runs unique
2026-03-24 11:37:58 -07:00
Tak Hoffman
1e4688a584 CI: exempt bad-barnacle from dirty auto-close 2026-03-21 20:23:17 -05:00
Peter Steinberger
6a812b621d ci: modernize GitHub Actions workflow versions 2026-03-13 16:57:23 +00:00
Peter Steinberger
966653e174 ci: suppress expected zizmor pull_request_target findings 2026-03-13 16:48:34 +00:00
Peter Steinberger
41718404a1 ci: opt workflows into Node 24 action runtime 2026-03-13 16:41:22 +00:00
Shadow
b16ee34c34 fix(ci): auto-close and lock r: spam items 2026-03-10 15:58:24 -05:00
Shadow
1720174757 fix: auto-close no-ci PR label and document triage labels 2026-03-09 21:30:47 -05:00
Tak Hoffman
bdf9739e59 Add too-many-prs override label handling 2026-03-08 13:13:53 -05:00
Shadow
91494b2596 fix: repair auto-response workflow YAML 2026-03-06 16:24:50 -06:00
Shadow
c301c5d083 fix: add no-ci-pr auto-response label 2026-03-06 15:53:59 -06:00
Vincent Koc
e3390bfb70 CI: add Barnacle r: too-many-prs guard
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
2026-03-06 11:37:00 -06:00
Tak Hoffman
ff563eef0f Issues: unify bug form and subtype auto-labeling (openclaw#30733) thanks @Takhoffman
Verified:
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: Takhoffman <781889+Takhoffman@users.noreply.github.com>
2026-03-01 09:20:57 -06:00
Shadow
a5b1e86535 chore: add fallback GitHub App token 2026-02-27 22:49:58 -06:00
Shadow
03159f3942 CI: add maintainer ping auto-response 2026-02-26 13:30:12 -06:00
Shadow
df002ef840 Workflow: clarify dirty PR response 2026-02-20 16:32:05 -06:00
Peter Steinberger
ce1f0c0a10 ci: move workflows to blacksmith 16vcpu runners 2026-02-19 17:25:15 +01:00
Shadow
2e3219ff66 Update auto-response message for third-party extensions 2026-02-17 10:47:22 -06:00
Shadow
e391827ea9 CI: use self-hosted for labeler/automation 2026-02-16 22:16:20 -06:00
Shadow
68b00a5388 CI: add dirty label auto-response 2026-02-14 11:22:00 -06:00
Shadow
f6232bc2b4 CI: close invalid items without response 2026-02-13 13:41:13 -06:00
Shadow
2f9c523bbe CI: run auto-response on label events (#15657) 2026-02-13 12:14:49 -06:00
Shadow
4aa035f38f CI: gate auto-response with trigger label 2026-02-12 15:41:16 -06:00
Shadow
978effcf26 CI: close PRs with excessive labels 2026-02-12 15:35:32 -06:00
Shadow
e7f0769c82 CI: configure stale automation 2026-02-09 23:37:12 -06:00
Shadow
f38dfe4544 Chore: add testflight auto-response 2026-02-09 22:52:46 -06:00
Shadow
20a603de01 Update auto-response messages with new links 2026-02-01 11:25:55 -06:00
Shadow
29de43d307 CI: auto-label moltbook issues 2026-01-31 19:45:48 -06:00
Peter Steinberger
85dd070dea chore: pin workflow actions + tighten permissions 2026-01-31 06:22:48 +01:00
Shadow
6fc3ca4996 CI: add auto-response labels 2026-01-27 23:17:22 -06:00
Shadow
bdea265704 CI: run auto-response on pull_request_target 2026-01-26 14:37:39 -06:00
Shadow
ec75e0b3dc CI: use app token for auto-response 2026-01-26 14:36:29 -06:00
Shadow
6b6284c69c CI: add PR labeler + label sync 2026-01-25 20:37:31 -06:00