Dallin Romney
6baf4dd15f
fix(release): validate candidates before Docker publication ( #117252 )
...
* fix(release): validate candidates before Docker publication
* fix(release): complete Docker publication gates
* fix(release): serialize Docker publication
2026-08-01 16:08:49 +08:00
Peter Steinberger
c16c0dbef4
fix(release): allow macOS snapshot selection in candidate smoke ( #114144 )
2026-07-26 14:08:31 -04:00
Peter Steinberger
f1538c6d6c
fix(release): validate complete package sets in candidate smoke ( #113600 )
...
* fix(release): pass only root dependencies to candidate smoke
* fix(release): stage plugin candidates for Parallels
* fix(release): bind plugin preflight package identity
* fix(test): stream upstream npm tarballs
* fix(test): retry post-update gateway startup
* fix(test): install fresh candidates through registry
* fix(test): route fresh candidates through registry
* test(release): update Parallels source contracts
* fix(test): split host and guest registry URLs
2026-07-25 07:59:06 -07:00
Peter Steinberger
79d4e4a3ad
fix(release): accept complete core tarball manifests ( #112813 )
...
* fix(release): consume complete core tarball manifest
* fix(release): declare core tarball selector
2026-07-22 21:02:47 -04:00
Peter Steinberger
26e7575780
fix(release): pin trusted candidate tooling across main advances
2026-07-18 23:33:42 +01:00
Peter Steinberger
dffb136784
fix(release): keep beta performance advisory
2026-07-17 03:06:39 +01:00
Peter Steinberger
9bd51e97fa
fix(release): run trusted tooling through symlink roots
2026-07-17 03:00:52 +01:00
Peter Steinberger
732fb5f9e6
fix(release): bind Telegram proof artifact identity
2026-07-15 08:02:17 +01:00
Peter Steinberger
ed49673307
fix(release): prepare trusted harness dependencies
2026-07-15 07:11:59 +01:00
Peter Steinberger
34b8a3fda0
fix(release): isolate trusted candidate dependencies
2026-07-15 07:08:00 +01:00
Peter Steinberger
c8733ea674
fix(release): run candidate smoke from trusted tooling
2026-07-15 06:56:04 +01:00
Peter Steinberger
6c0725e0d9
fix(release): tolerate exhausted GitHub read quota
2026-07-15 05:21:30 +01:00
Peter Steinberger
2372c71697
fix(release): preserve candidate Node runtime
2026-07-15 05:03:43 +01:00
Peter Steinberger
e297bc2ac5
fix(release): validate npm preflight workflow trust
2026-07-14 18:44:08 +01:00
Vincent Koc
6a0eecdb44
fix(release): separate code and release SHA validation ( #105948 )
2026-07-13 13:38:19 +08:00
Vincent Koc
c47ceb0f3d
improve(release): reuse exact-SHA validation evidence ( #104162 )
...
* perf(release): share changelog verification snapshots
* perf(release): reuse exact-SHA validation evidence
* feat(release): checkpoint candidate workflow state
* feat(release): watch CI transitions compactly
* fix(testbox): rotate stale reusable leases
* refactor(release): move CI verifier into scripts
* fix(release): preserve verifier executable mode
* fix(testbox): force noninteractive remote hydration
* perf(testbox): skip sync for proven clean heads
* fix(testbox): keep changed gates synchronized
* fix(testbox): isolate git state probes
* fix(testbox): isolate wrapper git commands
* fix(testbox): preserve git command contracts
* fix(release): validate reused SHA evidence
* fix(release): resume serialized plugin selections
* fix(testbox): sync source on every lease reuse
* fix(release): verify from trusted workflow checkout
* fix(release): gate evidence reuse on trusted lineage
* fix(release): support legacy verifier checkouts
* fix(testbox): export CI across shell snippets
* fix(release): revalidate reused evidence before publish
* fix(release): reject untrusted reuse before lookup
* fix(release): reuse SHA-pinned root evidence
* fix(ci): allow unreleased notes in QA packages
* fix(release): satisfy script lint contracts
* fix(release): handle Unicode workflow refs safely
2026-07-11 12:48:27 +08:00
Vincent Koc
54cc90b1b1
fix(release): publish ClawHub bootstrap artifacts immutably ( #103809 )
...
* fix(release): harden ClawHub bootstrap
* fix(release): centralize publication artifact verification
* fix(release): harden publication artifact verification
* fix(release): lock ClawHub bootstrap toolchain
* test(release): assert locked ClawHub binary
* fix(release): pack with trusted ClawHub harness
* fix(release): bound beta verifier artifact reads
* fix(release): bind target and tooling identities
* fix(release): stabilize signed package ordering
* fix(release): bind ClawHub pretag proof
* fix(release): bind ClawHub OIDC readback
* fix(release): bind ClawHub OIDC readback
2026-07-10 13:33:20 -07:00
Peter Steinberger
fece8c9f54
fix(release): keep validation evidence immutable across reruns ( #103906 )
...
* fix(release): bind validation evidence to exact attempts
* test(release): cover exact validation attempts
2026-07-10 20:16:19 +01:00
Peter Steinberger
eefe2e8837
fix(release): let alpha tags publish from their exact changelog heading
...
Shipped alpha tags carry a dedicated ## X-alpha.N heading with no base
section (see v2026.6.20-alpha.1's tagged CHANGELOG.md); the renderer and
candidate provenance now prefer that dedicated heading for alpha and
correction tags while beta/stable remain pinned to the stable base
section per #103222 .
2026-07-10 02:06:53 -07:00
Peter Steinberger
c2b4ac02da
fix(release): align correction sections, retries, and merged ledger semantics
...
Codex review + test findings on the pipeline convergence:
- candidate changelog provenance now validates the same section the
renderer publishes (correction tags may carry their own heading) via a
shared correctionVersionForTag helper
- guard_existing_public_release accepts a canonical proofless body with
intact dependency evidence, matching the renderer's documented
proof-omitted-at-limit state; retries re-append the proof
- ledgerFor regains main's noteReferences threading so prose-cited PRs
keep their contribution-record rows, and the ledger/verify tests pin
the merged entry shape (externalReferences) and highlight gate
2026-07-10 02:06:52 -07:00
Peter Steinberger
336e43c314
fix(release): converge on the render-github-release-notes pipeline
...
Two competing release-notes pipelines existed: the release branch's
hardened render/verify/provenance pipeline (a486f3ab08dcee1da876#103222 ). Repo policy is one canonical path; the release-branch
pipeline wins and main's unique value is grafted in:
- scripts/render-github-release-notes.mjs becomes the canonical release
body renderer (full/compact 125k char+byte modes, tag-pinned record
link, verification tail, canonical shipped-baseline format), now also
preferring a correction tag's dedicated changelog section (from
prepare's heading matrix).
- verify-release-notes.mjs is a three-way merge: release's --shipped-ref
cumulative baselines, provenance checks, highlights gate, and the
excluded-record rewrite fix, plus main's compact contribution rows,
externalReferences threading, and both-heading parser compat.
- release-candidate-checklist.mjs gains validateCandidateCheckout and
changelog-provenance gates that run before any dispatch.
- openclaw-release-publish.yml keeps main's fail-before-mutation early
notes gate (retargeted to the renderer) and adopts release's
render/verify_release_tag_target/canonical_release_body_matches flow.
- scripts/prepare-github-release-notes.mjs and its test are deleted;
release-notes-ledger.test.ts stays and pins the merged verify exports.
- .gitignore tracks every repo skill for Git-aware syncs; SKILL.md
runbooks and RELEASING.md document the converged contract.
2026-07-10 02:06:52 -07:00
Vincent Koc
0535679083
fix(release): validate exact prepared npm package sets ( #102759 )
...
* fix(release): validate prepared npm package sets
Forward-port the beta3 package-set preflight, Telegram, and Parallels validation to main while preserving main's existing Bun install smoke. Recompute decoded proxy response lengths and require artifact tarballs to exactly match the verified manifest.
* fix(release): lock fixture registry proxy origin
2026-07-09 05:19:24 -07:00
Vincent Koc
c638f2beda
fix(release): reject duplicate candidate checklist options
2026-06-23 14:30:29 +02:00
Vincent Koc
023394000c
fix(release): reject malformed candidate API timeouts
2026-06-23 10:04:15 +02:00
Vincent Koc
7de3e0e0bb
fix(release): require exact candidate workflow runs
2026-06-20 10:24:59 +02:00
Vincent Koc
6c82a9fb18
fix(release): bound GitHub API body reads
2026-06-19 05:13:48 +02:00
Vincent Koc
abb6f04e0c
ci(release): harden release controls
...
One-time maintainer-authorized bootstrap merge for the release-gate verifier policy. Exact hosted CI and all supporting workflow gates passed on 66133de419
2026-06-18 03:11:20 +08:00
Jason (Json)
8ae1adfdcc
ci: gate stable releases on Windows companion assets ( #92555 )
...
* ci: gate stable releases on Windows companion assets
* fix(release): reject malformed Windows checksum manifests
* fix(release): make Windows recovery fail closed
* fix(release): tighten Windows asset identity checks
* fix(release): validate prepared candidate tarballs
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-06-13 19:33:33 -07:00
Vincent Koc
f5a7f613ee
fix(release): use monthly patch versions
...
Switch release train handling to YYYY.M.PATCH monthly patch numbering, preserve pre-transition compatibility, and pin the June 2026 stable/beta floor at 2026.6.5 after the published beta.
Verification:
- node scripts/run-vitest.mjs run test/appcast.test.ts test/release-check.test.ts test/scripts/package-mac-app.test.ts test/scripts/package-mac-dist.test.ts test/openclaw-npm-release-check.test.ts test/npm-publish-plan.test.ts src/infra/npm-registry-spec.test.ts src/infra/clawhub.test.ts src/plugins/clawhub.test.ts test/plugin-npm-release.test.ts test/scripts/ios-version.test.ts test/scripts/ios-pin-version.test.ts
- node --import tsx scripts/plugin-npm-release-check.ts --base-ref origin/main --head-ref HEAD
- node --import tsx scripts/plugin-clawhub-release-check.ts --base-ref origin/main --head-ref HEAD
- git diff --check origin/main...HEAD
- .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --no-web-search
2026-06-06 12:26:32 -07:00
Peter Steinberger
72547a1ac6
docs: document release audit scripts
2026-06-04 23:49:34 -04:00
Vincent Koc
ed4c4afc0f
fix(release): bound candidate GitHub requests
2026-06-03 08:19:03 +02:00
Peter Steinberger
4e45010203
ci(release): fail fast on red release children
...
(cherry picked from commit 8d7038775f0a0a1bb5354ba6b6b708c6b2c3167b)
2026-06-01 22:42:53 +01:00
Peter Steinberger
27dde7a4d6
chore(lint): enable stricter error rules
2026-06-01 01:12:21 +01:00
Peter Steinberger
22cb7fb6b7
chore(lint): enable no-promise-executor-return
2026-05-31 23:06:13 +01:00
Peter Steinberger
304e2c83c0
chore(lint): enable stricter oxlint rules
2026-05-31 18:59:02 +01:00
Vincent Koc
cbd8049b9f
fix(scripts): parse forwarded package script options
2026-05-30 17:44:14 +02:00
Vincent Koc
53e8dc6a54
fix(scripts): stop parsing after option terminators
2026-05-30 17:10:36 +02:00
Peter Steinberger
fadd275e7b
fix(release): harden candidate run status polling
2026-05-30 00:11:24 +01:00
Peter Steinberger
35a3c064a7
fix(release): avoid gh api for candidate reads
2026-05-30 00:10:05 +01:00
Peter Steinberger
cb765f1664
ci(release): require all plugins for core publish
2026-05-29 12:07:03 +01:00
Peter Steinberger
1ceebf8a01
ci: harden release publish evidence
2026-05-17 06:34:58 +01:00
Peter Steinberger
c4d8e0be18
ci: harden release validation flow
2026-05-17 06:34:58 +01:00
Peter Steinberger
abbfd276ee
ci(release): stringify candidate workflow fields
2026-05-15 15:43:43 +01:00
Peter Steinberger
492f59e586
ci(release): preserve candidate JSON parse cause
2026-05-15 15:32:17 +01:00
Peter Steinberger
d61051558b
ci(release): harden candidate workflow dispatch lookup
2026-05-15 15:10:34 +01:00
Peter Steinberger
c91e20ac0c
ci(release): add candidate evidence checklist
2026-05-15 14:54:46 +01:00
