mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-06 07:50:43 +00:00
421 lines
17 KiB
YAML
421 lines
17 KiB
YAML
name: OpenClaw NPM Release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Release tag to publish, or a full 40-character workflow-branch commit SHA for validation-only preflight (for example v2026.3.22 or 0123456789abcdef0123456789abcdef01234567)
|
|
required: true
|
|
type: string
|
|
preflight_only:
|
|
description: Run validation/build only and skip the gated publish job
|
|
required: true
|
|
default: false
|
|
type: boolean
|
|
preflight_run_id:
|
|
description: Existing successful preflight workflow run id to promote without rebuilding
|
|
required: false
|
|
type: string
|
|
npm_dist_tag:
|
|
description: npm dist-tag to publish to for stable releases
|
|
required: true
|
|
default: beta
|
|
type: choice
|
|
options:
|
|
- beta
|
|
- latest
|
|
|
|
concurrency:
|
|
group: openclaw-npm-release-${{ github.event_name == 'workflow_dispatch' && format('{0}-{1}', inputs.tag, inputs.npm_dist_tag) || github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
|
|
NODE_VERSION: "24.x"
|
|
PNPM_VERSION: "10.32.1"
|
|
|
|
jobs:
|
|
# PLEASE DON'T ADD LONG-RUNNING OR FLAKY CHECKS TO THE npm RELEASE PATH.
|
|
# KEEP THIS WORKFLOW SHORT AND DETERMINISTIC OR IT CAN GET STUCK AND JEOPARDIZE THE RELEASE.
|
|
# RELEASE-TIME LIVE OR END-TO-END VALIDATION BELONGS IN openclaw-release-checks.yml.
|
|
# SECURITY NOTE: TOKEN-BASED npm dist-tag mutation moved to
|
|
# openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml
|
|
# so this public workflow can stay focused on OIDC publish only.
|
|
preflight_openclaw_npm:
|
|
if: ${{ inputs.preflight_only }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Validate release ref input format
|
|
env:
|
|
RELEASE_REF: ${{ inputs.tag }}
|
|
PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "${RELEASE_REF}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*((-beta\.[1-9][0-9]*)|(-[1-9][0-9]*))?$ ]] && [[ ! "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
|
|
echo "Invalid release ref format: ${RELEASE_REF}"
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]] && [[ "${PREFLIGHT_ONLY}" != "true" ]]; then
|
|
echo "Full commit SHA input is only supported for validation-only preflight runs."
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_REF}" == *"-beta."* && "${RELEASE_NPM_DIST_TAG}" != "beta" ]]; then
|
|
echo "Beta prerelease tags must publish to npm dist-tag beta."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Forbid preflight artifact promotion on validation-only runs
|
|
if: ${{ inputs.preflight_only && inputs.preflight_run_id != '' }}
|
|
run: |
|
|
echo "preflight_run_id is only valid for real publish runs."
|
|
exit 1
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ inputs.tag }}
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
pnpm-version: ${{ env.PNPM_VERSION }}
|
|
install-bun: "true"
|
|
|
|
- name: Ensure version is not already published
|
|
env:
|
|
PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
|
|
run: |
|
|
set -euo pipefail
|
|
PACKAGE_VERSION=$(node -p "require('./package.json').version")
|
|
|
|
if npm view "openclaw@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
|
|
if [[ "${PREFLIGHT_ONLY}" == "true" ]]; then
|
|
echo "openclaw@${PACKAGE_VERSION} is already published on npm; continuing because preflight_only=true."
|
|
exit 0
|
|
fi
|
|
echo "openclaw@${PACKAGE_VERSION} is already published on npm."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Publishing openclaw@${PACKAGE_VERSION}"
|
|
|
|
- name: Check
|
|
env:
|
|
OPENCLAW_LOCAL_CHECK: "0"
|
|
run: pnpm check
|
|
|
|
- name: Check test types
|
|
env:
|
|
OPENCLAW_LOCAL_CHECK: "0"
|
|
run: pnpm check:test-types
|
|
|
|
- name: Check architecture
|
|
env:
|
|
OPENCLAW_LOCAL_CHECK: "0"
|
|
run: pnpm check:architecture
|
|
|
|
- name: Build
|
|
run: pnpm build
|
|
|
|
- name: Build Control UI
|
|
run: pnpm ui:build
|
|
|
|
- name: Validate release metadata
|
|
if: ${{ inputs.preflight_run_id == '' }}
|
|
env:
|
|
OPENCLAW_NPM_RELEASE_SKIP_PACK_CHECK: "1"
|
|
RELEASE_REF: ${{ inputs.tag }}
|
|
PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
|
|
WORKFLOW_REF_NAME: ${{ github.ref_name }}
|
|
OPENCLAW_NPM_PUBLISH_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
RELEASE_SHA=$(git rev-parse HEAD)
|
|
RELEASE_BRANCH_REF="refs/remotes/origin/${WORKFLOW_REF_NAME}"
|
|
export RELEASE_SHA RELEASE_BRANCH_REF
|
|
# Fetch the workflow branch so merge-base ancestry checks keep working
|
|
# for older tagged commits contained in a release branch.
|
|
git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}"
|
|
if [[ "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
|
|
BRANCH_SHA="$(git rev-parse "${RELEASE_BRANCH_REF}")"
|
|
if [[ "${RELEASE_SHA}" != "${BRANCH_SHA}" ]]; then
|
|
echo "Validation-only SHA mode only supports the current ${WORKFLOW_REF_NAME} HEAD." >&2
|
|
exit 1
|
|
fi
|
|
RELEASE_TAG="v$(node -p "require('./package.json').version")"
|
|
export RELEASE_TAG
|
|
echo "Validation-only SHA mode: using synthetic release tag ${RELEASE_TAG} for package metadata checks."
|
|
else
|
|
RELEASE_TAG="${RELEASE_REF}"
|
|
export RELEASE_TAG
|
|
fi
|
|
RELEASE_MAIN_REF="${RELEASE_BRANCH_REF}"
|
|
export RELEASE_MAIN_REF
|
|
pnpm release:openclaw:npm:check
|
|
|
|
# KEEP THIS LANE LIMITED TO FAST, REPEATABLE RELEASE READINESS CHECKS.
|
|
# IF A CHECK CAN TAKE A LONG TIME, NEEDS LIVE CREDENTIALS, OR IS KNOWN TO BE FLAKY,
|
|
# IT BELONGS IN openclaw-release-checks.yml INSTEAD OF BLOCKING npm PUBLISH.
|
|
- name: Verify release contents
|
|
run: pnpm release:check
|
|
|
|
- name: Pack prepared npm tarball
|
|
id: packed_tarball
|
|
env:
|
|
OPENCLAW_PREPACK_PREPARED: "1"
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
PACK_OUTPUT="$RUNNER_TEMP/npm-pack-output.txt"
|
|
npm pack --json 2>&1 | tee "$PACK_OUTPUT"
|
|
PACK_PATH="$(node - "$PACK_OUTPUT" <<'NODE'
|
|
const fs = require("node:fs");
|
|
const input = fs.readFileSync(process.argv[2], "utf8");
|
|
|
|
function arrayEndFrom(start) {
|
|
let depth = 0;
|
|
let inString = false;
|
|
let escape = false;
|
|
for (let i = start; i < input.length; i += 1) {
|
|
const char = input[i];
|
|
if (inString) {
|
|
if (escape) {
|
|
escape = false;
|
|
} else if (char === "\\") {
|
|
escape = true;
|
|
} else if (char === "\"") {
|
|
inString = false;
|
|
}
|
|
continue;
|
|
}
|
|
if (char === "\"") {
|
|
inString = true;
|
|
} else if (char === "[") {
|
|
depth += 1;
|
|
} else if (char === "]") {
|
|
depth -= 1;
|
|
if (depth === 0) {
|
|
return i + 1;
|
|
}
|
|
}
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
for (let start = input.indexOf("["); start !== -1; start = input.indexOf("[", start + 1)) {
|
|
const end = arrayEndFrom(start);
|
|
if (end === -1) {
|
|
continue;
|
|
}
|
|
try {
|
|
const parsed = JSON.parse(input.slice(start, end));
|
|
const first = Array.isArray(parsed) ? parsed[0] : null;
|
|
if (first && typeof first.filename === "string" && first.filename) {
|
|
process.stdout.write(first.filename);
|
|
process.exit(0);
|
|
}
|
|
} catch {
|
|
// Keep scanning; npm lifecycle output can legally precede the JSON.
|
|
}
|
|
}
|
|
|
|
console.error("Could not find npm pack --json output with a filename.");
|
|
process.exit(1);
|
|
NODE
|
|
)"
|
|
if [[ -z "$PACK_PATH" || ! -f "$PACK_PATH" ]]; then
|
|
echo "npm pack did not produce a tarball file." >&2
|
|
exit 1
|
|
fi
|
|
RELEASE_SHA="$(git rev-parse HEAD)"
|
|
ARTIFACT_DIR="$RUNNER_TEMP/openclaw-npm-preflight"
|
|
rm -rf "$ARTIFACT_DIR"
|
|
mkdir -p "$ARTIFACT_DIR"
|
|
cp "$PACK_PATH" "$ARTIFACT_DIR/"
|
|
printf '%s\n' "$RELEASE_TAG" > "$ARTIFACT_DIR/release-tag.txt"
|
|
printf '%s\n' "$RELEASE_SHA" > "$ARTIFACT_DIR/release-sha.txt"
|
|
printf '%s\n' "$RELEASE_NPM_DIST_TAG" > "$ARTIFACT_DIR/release-npm-dist-tag.txt"
|
|
echo "dir=$ARTIFACT_DIR" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Upload prepared npm publish bundle
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: openclaw-npm-preflight-${{ inputs.tag }}
|
|
path: ${{ steps.packed_tarball.outputs.dir }}
|
|
if-no-files-found: error
|
|
|
|
validate_publish_request:
|
|
if: ${{ !inputs.preflight_only }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Require main or release workflow ref for publish
|
|
env:
|
|
WORKFLOW_REF: ${{ github.ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then
|
|
echo "Real publish runs must be dispatched from main or release/YYYY.M.D. Use preflight_only=true for other branch validation."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Require preflight artifact promotion on real publish
|
|
env:
|
|
PREFLIGHT_RUN_ID: ${{ inputs.preflight_run_id }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -z "${PREFLIGHT_RUN_ID}" ]]; then
|
|
echo "Real publish requires preflight_run_id from a successful npm preflight run." >&2
|
|
exit 1
|
|
fi
|
|
|
|
publish_openclaw_npm:
|
|
# KEEP THE REAL RELEASE/PUBLISH PATH ON A GITHUB-HOSTED RUNNER.
|
|
# npm trusted publishing + provenance requires this to stay on ubuntu-latest.
|
|
needs: [validate_publish_request]
|
|
if: ${{ !inputs.preflight_only }}
|
|
runs-on: ubuntu-latest
|
|
environment: npm-release
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
id-token: write
|
|
steps:
|
|
- name: Validate tag input format
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*((-beta\.[1-9][0-9]*)|(-[1-9][0-9]*))?$ ]]; then
|
|
echo "Invalid release tag format: ${RELEASE_TAG}"
|
|
exit 1
|
|
fi
|
|
if [[ "${RELEASE_TAG}" == *"-beta."* && "${RELEASE_NPM_DIST_TAG}" != "beta" ]]; then
|
|
echo "Beta prerelease tags must publish to npm dist-tag beta."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: refs/tags/${{ inputs.tag }}
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
pnpm-version: ${{ env.PNPM_VERSION }}
|
|
install-bun: "false"
|
|
|
|
- name: Ensure version is not already published
|
|
run: |
|
|
set -euo pipefail
|
|
PACKAGE_VERSION=$(node -p "require('./package.json').version")
|
|
|
|
if npm view "openclaw@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
|
|
echo "openclaw@${PACKAGE_VERSION} is already published on npm."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Publishing openclaw@${PACKAGE_VERSION}"
|
|
|
|
- name: Verify preflight run metadata
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PREFLIGHT_RUN_ID: ${{ inputs.preflight_run_id }}
|
|
EXPECTED_PREFLIGHT_BRANCH: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
RUN_JSON="$(gh run view "$PREFLIGHT_RUN_ID" --repo "$GITHUB_REPOSITORY" --json workflowName,headBranch,event,conclusion,url)"
|
|
printf '%s' "$RUN_JSON" | node -e 'const fs = require("node:fs"); const run = JSON.parse(fs.readFileSync(0, "utf8")); const checks = [["workflowName", "OpenClaw NPM Release"], ["headBranch", process.env.EXPECTED_PREFLIGHT_BRANCH], ["event", "workflow_dispatch"], ["conclusion", "success"]]; for (const [key, expected] of checks) { if (run[key] !== expected) { console.error(`Referenced npm preflight run ${process.env.PREFLIGHT_RUN_ID} must have ${key}=${expected}, got ${run[key] ?? "<missing>"}.`); process.exit(1); } } console.log(`Using npm preflight run ${process.env.PREFLIGHT_RUN_ID}: ${run.url}`);'
|
|
|
|
- name: Download prepared npm tarball
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: openclaw-npm-preflight-${{ inputs.tag }}
|
|
path: preflight-tarball
|
|
repository: ${{ github.repository }}
|
|
run-id: ${{ inputs.preflight_run_id }}
|
|
github-token: ${{ github.token }}
|
|
|
|
- name: Validate release tag and package metadata
|
|
if: ${{ inputs.preflight_run_id == '' }}
|
|
env:
|
|
OPENCLAW_NPM_RELEASE_SKIP_PACK_CHECK: "1"
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
WORKFLOW_REF_NAME: ${{ github.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
RELEASE_SHA=$(git rev-parse HEAD)
|
|
RELEASE_MAIN_REF="refs/remotes/origin/${WORKFLOW_REF_NAME}"
|
|
export RELEASE_SHA RELEASE_TAG RELEASE_MAIN_REF
|
|
# Fetch the workflow branch so merge-base ancestry checks keep working
|
|
# for older tagged commits contained in a release branch.
|
|
git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}"
|
|
pnpm release:openclaw:npm:check
|
|
|
|
- name: Verify prepared tarball provenance
|
|
env:
|
|
RELEASE_TAG: ${{ inputs.tag }}
|
|
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
EXPECTED_RELEASE_SHA="$(git rev-parse HEAD)"
|
|
TAG_FILE="preflight-tarball/release-tag.txt"
|
|
SHA_FILE="preflight-tarball/release-sha.txt"
|
|
NPM_DIST_TAG_FILE="preflight-tarball/release-npm-dist-tag.txt"
|
|
if [[ ! -f "$TAG_FILE" || ! -f "$SHA_FILE" || ! -f "$NPM_DIST_TAG_FILE" ]]; then
|
|
echo "Prepared preflight metadata is missing." >&2
|
|
ls -la preflight-tarball >&2 || true
|
|
exit 1
|
|
fi
|
|
ARTIFACT_RELEASE_TAG="$(tr -d '\r\n' < "$TAG_FILE")"
|
|
ARTIFACT_RELEASE_SHA="$(tr -d '\r\n' < "$SHA_FILE")"
|
|
ARTIFACT_RELEASE_NPM_DIST_TAG="$(tr -d '\r\n' < "$NPM_DIST_TAG_FILE")"
|
|
if [[ "$ARTIFACT_RELEASE_TAG" != "$RELEASE_TAG" ]]; then
|
|
echo "Prepared preflight tag mismatch: expected $RELEASE_TAG, got $ARTIFACT_RELEASE_TAG" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$ARTIFACT_RELEASE_SHA" != "$EXPECTED_RELEASE_SHA" ]]; then
|
|
echo "Prepared preflight SHA mismatch: expected $EXPECTED_RELEASE_SHA, got $ARTIFACT_RELEASE_SHA" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$ARTIFACT_RELEASE_NPM_DIST_TAG" != "$RELEASE_NPM_DIST_TAG" ]]; then
|
|
echo "Prepared preflight npm dist-tag mismatch: expected $RELEASE_NPM_DIST_TAG, got $ARTIFACT_RELEASE_NPM_DIST_TAG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Resolve publish tarball
|
|
id: publish_tarball
|
|
run: |
|
|
set -euo pipefail
|
|
TARBALL_PATH="$(find preflight-tarball -type f -name '*.tgz' -print | sort | tail -n 1)"
|
|
if [[ -z "$TARBALL_PATH" ]]; then
|
|
echo "Prepared preflight tarball not found." >&2
|
|
ls -la preflight-tarball >&2 || true
|
|
exit 1
|
|
fi
|
|
echo "path=$TARBALL_PATH" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Publish
|
|
env:
|
|
OPENCLAW_PREPACK_PREPARED: "1"
|
|
OPENCLAW_NPM_PUBLISH_TAG: ${{ inputs.npm_dist_tag }}
|
|
PUBLISH_TARBALL_PATH: ${{ steps.publish_tarball.outputs.path }}
|
|
run: |
|
|
set -euo pipefail
|
|
publish_target="${PUBLISH_TARBALL_PATH}"
|
|
if [[ -n "${publish_target}" ]]; then
|
|
publish_target="./${publish_target}"
|
|
fi
|
|
bash scripts/openclaw-npm-publish.sh --publish "${publish_target}"
|