Files
openclaw/scripts
Peter Steinberger 169dad6224 fix: watch-pr-ci exits with false FAILURE when draft-to-ready cancels superseded runs (#113230)
* fix(scripts): ignore superseded workflow runs in watch-pr-ci rollup classification

Draft->ready re-triggers leave cancelled superseded runs on the head SHA
forever, and GitHub's aggregate rollup state counts them, so the watcher
emitted terminal FAILURE while the replacement run was still in progress
and could never reach GREEN (observed on PR #113150, head bd1b9a0e).

- fetch run identity per check and resolve same-name checks to the newest
  run/check id (GitHub latest-name-wins); drop cancelled checks from
  replaced runs; keep older runs' unique jobs visible
- paginate statusCheckRollup contexts (bounded, 10 pages) so >100-context
  rollups are not truncation-blind; changed or lost snapshots throw into
  the bounded retry
- classify GREEN when aggregate FAILURE is explained solely by superseded
  contexts with full visibility; truncation still fails conservatively

* ci: scope GitHub App token permissions in stale, labeler, auto-response, and pr-ci-sweeper

Fixes red main: #112963 bumped zizmor v1.22.0 -> v1.28.0, whose github-app
audit flags create-github-app-token mints without permission-* inputs (14
high findings, Workflow Sanity red on main since 3b7b2a2a1f). Most
workflows already migrated to scoped tokens; these four were stragglers.

Scopes follow each consumer's actual API surface: stale needs issues/PR
write plus actions read for its state-cache check; labeler needs label
CRUD (issues write), PR write, members read for maintainer gates, and
contents read where actions/labeler reads its config; auto-response needs
issues/PR write plus members read; pr-ci-sweeper needs actions write to
re-fire runs, checks read, and PR write. Verified locally with the exact
CI invocation (zizmor 1.28.0, repo config, regular persona, medium
severity/confidence): no findings, ignore/suppress counts match CI.
2026-07-23 22:46:04 -07:00
..
2026-07-01 01:51:50 -07:00

summary, read_when, title
summary read_when title
Repository script entry points and compatibility notes
Looking for an existing script before adding a new one
Running repository checks, tests, docs, Docker, release, or GitHub helper scripts
Updating package scripts or CI workflow script references
Scripts Directory

Scripts Directory

The scripts/ directory contains repository tooling used by local development, CI, docs publishing, releases, Docker proof, and maintainer operations. Prefer the package-script entry points in package.json when one exists, then read the underlying script before running it directly.

Compatibility

Many scripts are stable paths referenced by package.json, GitHub Actions, docs, and maintainer runbooks. Do not move, rename, or regroup scripts only to improve taxonomy. A directory migration needs an explicit maintainer-approved compatibility plan for package scripts, workflows, docs snippets, and any raw script paths users may have copied.

This index is a discovery aid for the current flat layout. It does not define a new directory taxonomy.

Common Entry Points

Area Prefer Notes
Build pnpm build Runs scripts/build-all.mjs; use specific build scripts only when debugging a build stage.
Changed checks pnpm changed:lanes --json, pnpm check:changed Lane classification lives in scripts/changed-lanes.mjs; changed-file checks live in scripts/check-changed.mjs.
Docs pnpm docs:list, pnpm docs:check-mdx, pnpm docs:check-links Backed by scripts/docs-list.js, scripts/check-docs-mdx.mjs, and scripts/docs-link-audit.mjs.
Formatting docs pnpm format:docs:check Uses scripts/format-docs.mjs; use write mode only when intentionally formatting docs.
Lint pnpm lint, pnpm lint:core, pnpm lint:all Wrapper scripts keep oxlint behavior aligned with repo config.
Targeted tests pnpm test <path-or-filter> or node scripts/run-vitest.mjs <path-or-filter> Avoid bare vitest; it can start watch mode.
Changed tests pnpm test:changed Uses the repo's changed-test resolver instead of a broad Vitest run.
Docker proof pnpm test:docker:all, pnpm test:docker:rerun, pnpm test:docker:timings Use the planner/rerun helpers before launching broad Docker work.
Live proof pnpm test:live Live checks require the matching environment and credentials.
Release checks pnpm release:check, pnpm release:beta, pnpm release:candidate Release scripts are maintainer workflows; read release docs before use.
GitHub reads scripts/gh-read Uses a GitHub App read token when configured, leaving normal gh login for writes.
Commits scripts/committer "<message>" <files...> Preferred scoped commit helper for OpenClaw changes.
Remote proof node scripts/crabbox-wrapper.mjs ... Agent default for tests and heavy work; pre-warm by source trust, sync each run, reuse the lease.

Script Families

  • check-*.mjs / check-*.ts: guardrails for architecture, docs, package contents, boundaries, workflows, and generated artifacts.
  • run-*.mjs: wrappers around repo runtimes or tools, such as Node, Vitest, oxlint, tsgo, and environment setup.
  • test-*.mjs / test-*.sh / test-*.ts: test planners, Docker lanes, live checks, and focused validation helpers.
  • docs-* and check-docs-*: docs listing, link auditing, MDX checks, spellcheck, sync, and i18n glossary checks.
  • release-*, openclaw-npm-*, and plugin-*-release-*: release preparation, package verification, and publishing helpers.
  • docker-*, test-docker-*, and test-live-*-docker.sh: Docker E2E planning, rerun, timing, and live/package lane helpers.
  • gh-read*, label-*, sync-labels.ts, and PR helpers: GitHub read, labeling, and maintainer workflow support.
  • generate-*, write-*, copy-*, and sync-*: generated docs, metadata, package surfaces, and build artifact support.
  • lib/: shared helpers imported by script entry points.

Maintenance Rules

  • Read scripts/AGENTS.md before changing scripts.
  • Keep package scripts, generators, generated-artifact checks, docs references, and workflow references aligned when touching a script path.
  • Prefer existing wrappers instead of introducing a raw tool invocation.
  • Add or update focused tests under test/scripts/ when changing script behavior.

See also Scripts for public-facing script guidance.