dependabot[bot]
7550d426dd
chore(deps): bump actions/github-script from 8 to 9 ( #65098 )
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 8 to 9.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](https://github.com/actions/github-script/compare/v8...v9 )
---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-21 21:19:26 -07:00
Peter Steinberger
261b07b1d6
ci: prepare Blacksmith testbox shell
2026-04-22 05:17:30 +01:00
Peter Steinberger
092f292ceb
ci: use smaller Blacksmith testbox runner
2026-04-22 05:14:55 +01:00
Peter Steinberger
4e22fc9498
ci: cancel stale push sanity runs
2026-04-22 05:11:57 +01:00
Peter Steinberger
ba0250e4f3
ci: add Blacksmith testbox workflow
2026-04-22 04:59:38 +01:00
Peter Steinberger
115accfc82
ci: narrow extension boundary cache inputs
2026-04-22 04:08:42 +01:00
Peter Steinberger
e836b5b6d7
ci: isolate mlx from macos swift checks
2026-04-22 02:12:07 +01:00
Peter Steinberger
710e4e9e51
ci: widen package boundary cache inputs
2026-04-22 01:53:22 +01:00
Peter Steinberger
d57fe63ee0
ci: cache package boundary artifacts
2026-04-22 01:42:44 +01:00
Peter Steinberger
73d9746e6a
ci: reuse swift build cache for unchanged inputs
2026-04-22 01:30:40 +01:00
Peter Steinberger
ce05418930
ci: preserve exact swift build cache
2026-04-22 01:26:05 +01:00
Peter Steinberger
37463af5e1
ci: increase package boundary compile concurrency
2026-04-22 00:26:03 +01:00
Peter Steinberger
85c63942a5
ci: skip swift package patch in macos node lane
2026-04-22 00:16:45 +01:00
Peter Steinberger
a426ef5b6a
ci: preserve swift build cache hits
2026-04-22 00:12:03 +01:00
Peter Steinberger
6bf56d8637
ci: cap android checkout and use build cache
2026-04-22 00:02:40 +01:00
Peter Steinberger
cc8ecde364
ci: avoid external gradle action in android checks
2026-04-21 23:56:52 +01:00
Peter Steinberger
6966f018f7
ci: quiet mlx swift manifest warnings
2026-04-21 23:52:04 +01:00
Peter Steinberger
e822e71410
ci: cap stuck checkout retries
2026-04-21 23:47:17 +01:00
Bek
dfe0e49c8a
fix(qmd): Dedup in-flight manager creation so only one full QMD manager arms per agent/config at a time, eliminating the concurrent exportSessions() collisions that triggered path changed during write errors ( #65226 )
...
Fixes concurrent manager creation races that caused SafeOpenErrors during session export.
Deduplicates in-flight manager creation so only one full QMD manager arms per agent/config at a time, eliminating the concurrent exportSessions() collisions that triggered path changed during write errors
Resolves and snapshots runtime inputs before cache reuse, replacing stale managers atomically when workspace/config changes, and aborting queued export work promptly on close()
2026-04-21 18:22:21 -04:00
Peter Steinberger
e5af4e3b5c
ci(deps): gate extension-owned root dependencies
2026-04-21 21:08:08 +01:00
Peter Steinberger
8d289306de
ci: support release branch mac validation
2026-04-21 21:01:05 +01:00
Peter Steinberger
b2b43085bc
ci: use larger Blacksmith macOS runners
2026-04-21 19:03:50 +01:00
Peter Steinberger
f14e91b39f
test: add bundled channel dependency Docker smoke
2026-04-21 08:26:23 +01:00
Peter Steinberger
b485ee7e36
docs: support release branch workflow
2026-04-21 05:33:21 +01:00
Peter Steinberger
5c85624eeb
Revert "ci: use Blacksmith checkout cache"
...
This reverts commit 43734b1dbd
2026-04-21 03:21:48 +01:00
Peter Steinberger
43734b1dbd
ci: use Blacksmith checkout cache
2026-04-21 03:09:13 +01:00
Peter Steinberger
5ab26a8774
ci: extend checkout fetch timeout
2026-04-21 02:05:26 +01:00
Peter Steinberger
bcd232467f
ci: remove channel contract heartbeat
2026-04-21 00:53:50 +01:00
Peter Steinberger
27c52f8062
ci: keep channel contract shards alive
2026-04-20 22:42:57 +01:00
Peter Steinberger
40db9734c4
ci: start windows checks earlier
2026-04-20 21:39:47 +01:00
Peter Steinberger
f5305afcfb
test: speed changed lanes and channel contracts
2026-04-20 20:53:38 +01:00
dependabot[bot]
fb74a7f0a4
build(deps): bump actions/checkout from 4 to 6 ( #61768 )
...
Bump actions/checkout from 4 to 6.\n\nThanks @dependabot.
2026-04-20 20:22:08 +01:00
Peter Steinberger
0c75b9ce00
ci: speed up fast security checks
2026-04-20 18:47:02 +01:00
Peter Steinberger
8b05743df2
ci(windows): normalize node path for bash
2026-04-20 18:22:19 +01:00
Peter Steinberger
b225d31179
ci: split remaining slow CI lanes
2026-04-20 17:29:11 +01:00
Peter Steinberger
eb4a9f2a2a
ci: reduce high-core runner fanout
2026-04-20 16:52:13 +01:00
Peter Steinberger
c597db3fb8
ci: target high-core Blacksmith lanes
2026-04-20 16:38:07 +01:00
Peter Steinberger
21fbe416d4
ci: fix Windows node path capture
2026-04-20 16:29:48 +01:00
Peter Steinberger
2b65a5f0ac
ci: use faster Blacksmith runners
2026-04-20 16:23:16 +01:00
Peter Steinberger
24644e3c27
ci: remove sticky disk cache plumbing
2026-04-20 16:03:55 +01:00
Peter Steinberger
3ecb713b00
perf: speed local checks and warm builds
2026-04-20 15:08:41 +01:00
Peter Steinberger
91d31197be
ci: run architecture check before release
2026-04-20 13:24:49 +01:00
Peter Steinberger
8bfa06e992
refactor: enforce plugin-owned channel boundaries
2026-04-18 22:48:27 +01:00
Vincent Koc
e85e6bc4fb
perf(ci): reuse macos swift build outputs
2026-04-18 07:18:21 -07:00
Vincent Koc
6d55fa19db
fix(ci): inline fast checkout bootstrap
2026-04-18 06:49:08 -07:00
Vincent Koc
552c0f22a6
refactor(ci): extract fast checkout action
2026-04-18 06:41:22 -07:00
Vincent Koc
dd618aa545
perf(ci): split protocol check from contracts lane
2026-04-18 06:36:44 -07:00
Vincent Koc
de4429ceb3
perf(ci): fan out additional checks
2026-04-18 06:28:50 -07:00
Vincent Koc
334f0a4de2
fix(ci): harden checkout on hot linux lanes
2026-04-18 06:27:27 -07:00
Viz
c778562379
ci(security): harden workflow steps against template-injection ( #68431 )
...
zizmor v1.24.1 reports 8 template-injection findings across three workflow files where GitHub Actions ${{ ... }} expressions are interpolated directly into shell run: blocks. Applies the canonical fix pattern: hoist every dynamic value into a step-level env: block and reference it as a shell variable ("${VAR}") from the script.
Files changed:
- control-ui-locale-refresh.yml: move matrix.locale into env as LOCALE (1 site)
- docker-release.yml: hoist steps.tags.outputs.{value,slim} plus the four needs.build-{amd64,arm64}.outputs.{digest,slim-digest} values into env for both manifest-creation steps (6 sites)
- openclaw-npm-release.yml: hoist steps.publish_tarball.outputs.path into env as PUBLISH_TARBALL_PATH in the Publish step (1 site)
Verified locally with zizmor --persona regular on the three files: 'No findings to report. Good job!'. pnpm format:check and pnpm lint pass.
Refs #68428 . Complements #66884 , which covers the remaining 12 sites in openclaw-cross-os-release-checks-reusable.yml.
2026-04-18 02:04:55 -04:00
