openclaw/.github/workflows/openclaw-release-checks.yml

name: OpenClaw Release Checks

on:
  workflow_dispatch:
    inputs:
      ref:
        description: Existing release tag or current full 40-character main commit SHA to validate (for example v2026.4.12 or 0123456789abcdef0123456789abcdef01234567)
        required: true
        type: string
      provider:
        description: Provider lane for cross-OS onboarding and the end-to-end agent turn
        required: false
        default: openai
        type: choice
        options:
          - openai
          - anthropic
          - minimax
      mode:
        description: Which cross-OS release lanes to run
        required: false
        default: both
        type: choice
        options:
          - fresh
          - upgrade
          - both

concurrency:
  group: openclaw-release-checks-${{ inputs.ref }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  resolve_target:
    runs-on: blacksmith-32vcpu-ubuntu-2404
    timeout-minutes: 30
    permissions:
      contents: read
    outputs:
      ref: ${{ steps.inputs.outputs.ref }}
      sha: ${{ steps.ref.outputs.sha }}
      provider: ${{ steps.inputs.outputs.provider }}
      mode: ${{ steps.inputs.outputs.mode }}
    steps:
      - name: Require main workflow ref for release checks
        env:
          WORKFLOW_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]]; then
            echo "Release checks must be dispatched from main so the workflow logic and secrets stay canonical." >&2
            exit 1
          fi

      - name: Validate ref input
        env:
          RELEASE_REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          if [[ ! "${RELEASE_REF}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*((-beta\.[1-9][0-9]*)|(-[1-9][0-9]*))?$ ]] && [[ ! "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
            echo "Expected an existing release tag or current full 40-character main commit SHA, got: ${RELEASE_REF}" >&2
            exit 1
          fi

      - name: Checkout selected ref
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0

      - name: Resolve checked-out SHA
        id: ref
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Validate selected ref is on main
        env:
          RELEASE_REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
          if [[ "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
            MAIN_SHA="$(git rev-parse origin/main)"
            if [[ "$(git rev-parse HEAD)" != "${MAIN_SHA}" ]]; then
              echo "Commit SHA mode only supports the current origin/main HEAD. Use a release tag for older commits." >&2
              exit 1
            fi
          else
            git merge-base --is-ancestor HEAD origin/main
          fi

      - name: Capture selected inputs
        id: inputs
        env:
          RELEASE_REF_INPUT: ${{ inputs.ref }}
          RELEASE_PROVIDER_INPUT: ${{ inputs.provider }}
          RELEASE_MODE_INPUT: ${{ inputs.mode }}
        run: |
          set -euo pipefail
          {
            printf 'ref=%s\n' "$RELEASE_REF_INPUT"
            printf 'provider=%s\n' "$RELEASE_PROVIDER_INPUT"
            printf 'mode=%s\n' "$RELEASE_MODE_INPUT"
          } >> "$GITHUB_OUTPUT"

      - name: Summarize validated ref
        env:
          RELEASE_REF: ${{ inputs.ref }}
          RELEASE_SHA: ${{ steps.ref.outputs.sha }}
          RELEASE_PROVIDER: ${{ inputs.provider }}
          RELEASE_MODE: ${{ inputs.mode }}
        run: |
          {
            echo "## Release checks"
            echo
            echo "- Requested ref: \`${RELEASE_REF}\`"
            echo "- Validated SHA: \`${RELEASE_SHA}\`"
            echo "- Cross-OS provider: \`${RELEASE_PROVIDER}\`"
            echo "- Cross-OS mode: \`${RELEASE_MODE}\`"
            echo "- This run will execute cross-OS release validation plus the non-Parallels Docker/live/openwebui coverage from the CI migration plan."
          } >> "$GITHUB_STEP_SUMMARY"

  cross_os_release_checks:
    needs: [resolve_target]
    permissions: read-all
    uses: ./.github/workflows/openclaw-cross-os-release-checks-reusable.yml
    with:
      ref: ${{ needs.resolve_target.outputs.ref }}
      provider: ${{ needs.resolve_target.outputs.provider }}
      mode: ${{ needs.resolve_target.outputs.mode }}
    secrets:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
      OPENCLAW_DISCORD_SMOKE_BOT_TOKEN: ${{ secrets.OPENCLAW_DISCORD_SMOKE_BOT_TOKEN }}
      OPENCLAW_DISCORD_SMOKE_GUILD_ID: ${{ secrets.OPENCLAW_DISCORD_SMOKE_GUILD_ID }}
      OPENCLAW_DISCORD_SMOKE_CHANNEL_ID: ${{ secrets.OPENCLAW_DISCORD_SMOKE_CHANNEL_ID }}

  live_and_e2e_release_checks:
    needs: [resolve_target]
    permissions:
      contents: read
      pull-requests: read
    uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
    with:
      ref: ${{ needs.resolve_target.outputs.ref }}
      include_repo_e2e: true
      include_release_path_suites: true
      include_openwebui: true
      include_live_suites: true
    secrets:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      ANTHROPIC_API_KEY_OLD: ${{ secrets.ANTHROPIC_API_KEY_OLD }}
      ANTHROPIC_API_TOKEN: ${{ secrets.ANTHROPIC_API_TOKEN }}
      BYTEPLUS_API_KEY: ${{ secrets.BYTEPLUS_API_KEY }}
      CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
      DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }}
      GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
      KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
      MODELSTUDIO_API_KEY: ${{ secrets.MODELSTUDIO_API_KEY }}
      MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
      MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
      MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
      OPENCODE_ZEN_API_KEY: ${{ secrets.OPENCODE_ZEN_API_KEY }}
      OPENCLAW_LIVE_BROWSER_CDP_URL: ${{ secrets.OPENCLAW_LIVE_BROWSER_CDP_URL }}
      OPENCLAW_LIVE_SETUP_TOKEN: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN }}
      OPENCLAW_LIVE_SETUP_TOKEN_MODEL: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_MODEL }}
      OPENCLAW_LIVE_SETUP_TOKEN_PROFILE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_PROFILE }}
      OPENCLAW_LIVE_SETUP_TOKEN_VALUE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_VALUE }}
      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
      QWEN_API_KEY: ${{ secrets.QWEN_API_KEY }}
      FAL_KEY: ${{ secrets.FAL_KEY }}
      RUNWAY_API_KEY: ${{ secrets.RUNWAY_API_KEY }}
      DEEPGRAM_API_KEY: ${{ secrets.DEEPGRAM_API_KEY }}
      TOGETHER_API_KEY: ${{ secrets.TOGETHER_API_KEY }}
      VYDRA_API_KEY: ${{ secrets.VYDRA_API_KEY }}
      XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
      ZAI_API_KEY: ${{ secrets.ZAI_API_KEY }}
      Z_AI_API_KEY: ${{ secrets.Z_AI_API_KEY }}
      BYTEPLUS_ACCESS_KEY_ID: ${{ secrets.BYTEPLUS_ACCESS_KEY_ID }}
      BYTEPLUS_SECRET_ACCESS_KEY: ${{ secrets.BYTEPLUS_SECRET_ACCESS_KEY }}
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      OPENCLAW_CODEX_AUTH_JSON: ${{ secrets.OPENCLAW_CODEX_AUTH_JSON }}
      OPENCLAW_CODEX_CONFIG_TOML: ${{ secrets.OPENCLAW_CODEX_CONFIG_TOML }}
      OPENCLAW_CLAUDE_JSON: ${{ secrets.OPENCLAW_CLAUDE_JSON }}
      OPENCLAW_CLAUDE_CREDENTIALS_JSON: ${{ secrets.OPENCLAW_CLAUDE_CREDENTIALS_JSON }}
      OPENCLAW_CLAUDE_SETTINGS_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_JSON }}
      OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON }}
      OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }}