release-openclaw-ci

Files (4)

• SKILL.md
• openai.yaml · agents/
• release-ci-notes.md · references/
• verify-provider-secrets.mjs · scripts/

SKILL.md (first lines)

# OpenClaw Release CI

Use this with `$release-openclaw-maintainer` and `$openclaw-testing` when a release candidate needs full validation, install/update proof, live provider checks, or CI recovery.

## Guardrails

- No version bump, tag, npm publish, GitHub release, or release promotion without explicit operator approval.
- After compaction, resume, or new steering, rewrite the effective goal and
  current phase from the latest explicit operator instruction. Do not merge old
  scope back into the active release.
- Hold the release scope once a release branch or Code SHA exists. Validate and
  ship that exact release; do not turn moving `main` into a second work queue.
- Record **C (candidate), Q (test qualification), P (admission/aggregate/verifier/publisher),
  rerun group, profile, effective soak, and context/transport refs**. New
  candidate test qualification defaults to Q=C, including the complete workflow,
  reusable workflow, local action, script, planner, contract, and coverage closure.
  Code SHA and Release SHA remain lifecycle roles, not extra workflow identities.
- The candidate helper accepts an absent release tag or an existing lightweight
  or annotated tag resolving to the exact candidate SHA. A conflicting tag or
  failed remote lookup stops validation; never move a tag to recover.
- Freeze C/Q and independently select trusted P on main or a protected
  publication tag. C/Q need not be an ancestor of P. Missing candidate contracts
  require a deliberate backport; never silently substitute newer main tooling.
- Apply a release firebreak after the Code SHA is frozen. Admit only confirmed
  product defects, wrong or unverifiable package bytes, security
  defects, or failures that make publication impossible. Queue other findings
  for postpublish confidence or the next beta. Dependency advisories are never
  firebreak admissions: record them as release evidence and queue the bump on
  `main` after publication; only known malware stops publication.
- Frozen CI children use Q's Node shard planner and measured
  costs, while discovering and executing tests from the candidate checkout.
  Hosted full-release plans split measured rows above 12 minutes; preserve file
  coverage, worker limits, and complete timing generations. An indivisible
  over-budget owner must be split rather than increasing the release budget.
  After the child completes, closeout runs `scripts/ci-shard-timings-refresh.mts`
  for that exact run and commits generated costs; do not hand-edit measurements.
- Candidate tests run their own frozen Q closure; admitted P owns FRV's aggregate
  decision and checked-in waiver policy. Main-only checks and
  future-main scenarios are not implicit release requirements. Fixing a frozen
  qualification harness means a new C/Q, with newly bound evidence. A P-only
  admission/aggregate/verifier/publisher repair can keep C/Q and their original evidence.
- Protected lightweight `release-publish/<12sha>-<provenance-run>` tags identify
  P, not Q. The suffix records tag-creation provenance, not the current parent.
  Publication helpers retain their `--workflow-sha <P>` argument; the FRV helper's
  `--workflow-sha` instead selects Q and must equal C on the candidate route.
- Touch `main` only for an operator-requested change or the smallest critical
  main-owned blocker that prevents this release and cannot be handled from the
  release branch. Main's CI health never gates a release. If a release-tooling
  landing is blocked by `main` failures it does not cause, prove on a clean
  `main` checkout that the failure already exists there, record it in the PR
  body, and merge; during an active release an admin merge is allowed for that
  exact case. A separate lane fixes red `main` in parallel, off the release's
  critical path.
- Land tooling-only fixes on `main` with the `release-fast-lane` label added
  before the push (see [Release tooling fast lane](#release-tooling-fast-lane)): `openclaw/ci-gate`
  then runs lint, types, guards, dependencies, docs, and the changed Node rows
  only. Land through the native `scripts/pr` path with its completed ClawSweeper
  review; findings are advisory for that label, so record any P1 the release
  owner declines to fix in the PR with its follow-up before landing.
- `OPENCLAW_RELEASE_RUNNER_GROUP` optionally routes validation parents and workers
  and the Release Publish parent plus its publish children to reserved capacity
  with unchanged labels; credentialed publish and approval jobs stay on default
  GitHub-hosted labels. Configure eligible runners and repo
  access first; unset preserves ordinary routing. Shared workers inherit the
  caller group; PR/main CI and unrelated scheduled work remain outside it.
- Check the nightly parent for the Code SHA before dispatching a fresh main validation; it seals per-child receipts that exact-target dispatches adopt when inputs match. The nightly runs this explicit trusted-main helper route (`--sha <main-sha> --workflow-sha <main-sha> --trusted-workflow-ref main`), so its parent runs on a `release-ci/<sha12>-<id>` branch, not `main`.
- FRV must conclude success under pinned P's
  [checked-in waiver policy](../../../docs/reference/full-release-validation/evidence.md#release-tooling-waivers);
  all other required lanes must pass. See
  [Publication requirements](#publication-requirements). Stable tags require stable/full
  evidence, soak, and blocking performance. Beta-profile evidence cannot qualify
  stable. Soak and performance cannot be waived. All-group
  qualification requires all nine Linux/Windows/macOS Gateway install/upgrade
  combinations. Preserve first failures, identity, and complete evidence.
- Native macOS, Windows, Linux, and Android publication is independent of
  npm/ClawHub, GitHub finalization, and main closeout. Each platform retains
  its own signing, qualification, artifact, and updater requirements; report
  pending platforms accurately and repair native-only failures in parallel.
- Do not set GitHub secrets from unvalidated 1Password candidates. If a candidate returns 401/403, leave the existing secret alone and report the exact missing provider.
- Use `$one-password` for secret reads/writes: one persistent tmux session, targeted items only, no secret output.
- Watch one parent run with `pnpm frv watch --run <parent>` (see [Watch](#watch)).
  Avoid broad `gh run view` polling loops; REST quota is easy to burn.
- Fetch logs only for failed or currently-blocking jobs. If quota is low, stop polling and wait for reset.
- Treat live-provider flakes separately from code failures: prove key validity, provider HTTP status, retry evidence, and exact failing lane before editing code.
- When diagnosing a live-provider failure, a model-list response proves
  authentication, not billing or inference entitlement. Confirm the credential
  with a real completion probe before treating it as valid. Fix the credential
  first; do not add an alternate auth path merely to bypass a failed release
  credential.
- Full Release Validation separates exact-child dispatch, Release Decision,
  and Diagnostic Drain. With `fail_fast=false`, it makes zero child
  cancellation calls; Diagnostic Drain follows every selected child to
  terminal unless the collector itself is cancelled or loses GitHub API
  access. With
  `fail_fast=true`, Release Decision may cancel only the exact still-active
  child that owns a blocking failure.
- Same-parent continuation requires the original root to have been dispatched
  with `fail_fast=false`. The controller verifies that exact logged input
  before any rerun mutation.
- A parent that produced its own sealed candidate artifacts cannot be continued:
  GitHub reruns make those prior-attempt artifacts unavailable. Keep the
  candidate and qualification SHAs frozen, supersede that parent, and start a fresh
  all-group Full Release Validation.
- After dispatch, one immutable execution-plan artifact records the original
  parent attempt, exact child tuples and titles, selected coverage, gates, and
  reuse identity. The same bytes are saved under an exact run-ID cache key.
  Decision, Drain, manifest writing, evidence validation, and final verification
  consume the artifact for their current attempt. A collector retry restores
  the cached plan, validates it, re-uploads its artifact, and adopts the same
  children; missing plan state is an orchestration failure, not permission to
  reconstruct the plan or redispatch.
- Reused evidence is not trusted merely because plan sealing found it. Release
  Decision repeats the sealed target SHA, evidence SHA, policy, changed paths,
  selected run, root run, source manifest, trusted tooling identity, and
  exact-child checks before returning `passed`.
- Parent retries select the newest Decision and Drain artifacts independently;
  both must bind the same immutable plan even when their source attempts differ.
- Child retries are part of the same immutable plan only when the child run ID,
  workflow path, ref, Q SHA, dispatch title, event, target, candidate, and

From openclaw/openclaw, MIT.

More from openclaw/openclaw