fix(clawsweeper): address review for automerge-openclaw-openclaw-81357 (2)

clawsweeper[bot] · clawsweeper[bot] · commit 1e6d0f53ec45 · 2026-05-14T14:53:07.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -244,7 +244,7 @@ Docs: https://docs.openclaw.ai
 - Codex app-server: keep the short post-tool completion watchdog armed across dynamic tool completion bookkeeping so embedded Codex runs fail fast and release their session lane when Codex goes quiet after a tool result. (#81697) Thanks @mbelinky.
 - Models: restore authenticated CLI runtime providers in the `/models` picker while keeping legacy runtime aliases hidden from setup/default model choices. Closes #81212. (#81239) Thanks @anagnorisis2peripeteia.
 - Agents/cron: honor a cron payload's explicit `timeoutSeconds` for the LLM idle watchdog even when it numerically equals `agents.defaults.timeoutSeconds`, preserving explicit per-run timeout intent and preventing stalled streaming replies from being cut to the implicit 120s cap. (#79426) Thanks @legolaz8451.
-- Changelog gates: reject bot/app handles as `Thanks` attribution and require explicit human credit for ClawSweeper-authored changelog entries. (#81357) Thanks @hxy91819.
+- Changelog gates: reject bot/app handles as `Thanks` attribution and require explicit human credit for bot/app-authored changelog entries. (#81357) Thanks @hxy91819.
 
 ### Changes
 
diff --git a/scripts/check-changelog-attributions.mjs b/scripts/check-changelog-attributions.mjs
@@ -14,13 +14,15 @@ export const FORBIDDEN_CHANGELOG_THANKS_HANDLES = [
   "openclaw-clawsweeper[bot]",
 ];
 export const FORBIDDEN_CHANGELOG_THANKS_HANDLE_PREFIXES = ["app/"];
+export const FORBIDDEN_CHANGELOG_THANKS_HANDLE_SUFFIXES = ["[bot]"];
 export const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES = [
   "clawsweeper",
   "openclaw-clawsweeper",
   "clawsweeper[bot]",
   "openclaw-clawsweeper[bot]",
 ];
 export const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_PREFIXES = ["app/"];
+export const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_SUFFIXES = ["[bot]"];
 
 const THANKS_PATTERN = /\bThanks\b/iu;
 const THANKED_HANDLE_PATTERN = /@([-_/A-Za-z0-9]+(?:\[bot\])?)/giu;
@@ -34,7 +36,8 @@ export function isForbiddenChangelogThanksHandle(handle, options = {}) {
   }
   if (
     FORBIDDEN_CHANGELOG_THANKS_HANDLES.includes(normalized) ||
-    FORBIDDEN_CHANGELOG_THANKS_HANDLE_PREFIXES.some((prefix) => normalized.startsWith(prefix))
+    FORBIDDEN_CHANGELOG_THANKS_HANDLE_PREFIXES.some((prefix) => normalized.startsWith(prefix)) ||
+    FORBIDDEN_CHANGELOG_THANKS_HANDLE_SUFFIXES.some((suffix) => normalized.endsWith(suffix))
   ) {
     return true;
   }
@@ -54,6 +57,9 @@ export function requiresExplicitHumanChangelogThanks(handle) {
     CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES.includes(normalized) ||
     CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_PREFIXES.some((prefix) =>
       normalized.startsWith(prefix),
+    ) ||
+    CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_SUFFIXES.some((suffix) =>
+      normalized.endsWith(suffix),
     )
   );
 }
diff --git a/test/scripts/check-changelog-attributions.test.ts b/test/scripts/check-changelog-attributions.test.ts
@@ -65,6 +65,7 @@ describe("check-changelog-attributions", () => {
       "- Maintainer-owned fix. Thanks @steipete.",
       "- Mixed credit. Thanks @contributor and @OpenClaw.",
       "- Bot repair. Thanks @clawsweeper[bot].",
+      "- Dependency bump. Thanks @dependabot[bot].",
       "- App repair. Thanks @app/clawsweeper.",
     ].join("\n");
 
@@ -74,7 +75,8 @@ describe("check-changelog-attributions", () => {
       { line: 3, handle: "steipete", text: "- Maintainer-owned fix. Thanks @steipete." },
       { line: 4, handle: "openclaw", text: "- Mixed credit. Thanks @contributor and @OpenClaw." },
       { line: 5, handle: "clawsweeper[bot]", text: "- Bot repair. Thanks @clawsweeper[bot]." },
-      { line: 6, handle: "app/clawsweeper", text: "- App repair. Thanks @app/clawsweeper." },
+      { line: 6, handle: "dependabot[bot]", text: "- Dependency bump. Thanks @dependabot[bot]." },
+      { line: 7, handle: "app/clawsweeper", text: "- App repair. Thanks @app/clawsweeper." },
     ]);
   });
 
@@ -110,6 +112,10 @@ describe("check-changelog-attributions", () => {
     expect(isForbiddenChangelogThanksHandle("clawsweeper[bot]")).toBe(true);
     expect(isForbiddenChangelogThanksHandle("openclaw-clawsweeper")).toBe(true);
     expect(isForbiddenChangelogThanksHandle("openclaw-clawsweeper[bot]")).toBe(true);
+    expect(isForbiddenChangelogThanksHandle("dependabot[bot]")).toBe(true);
+    expect(isForbiddenChangelogThanksHandle("dependabot[bot]", { strictBotHandle: true })).toBe(
+      true,
+    );
     expect(isForbiddenChangelogThanksHandle("alice")).toBe(false);
     expect(isForbiddenChangelogThanksHandle("human-clawsweeper-fan")).toBe(false);
     expect(
@@ -118,6 +124,7 @@ describe("check-changelog-attributions", () => {
 
     expect(requiresExplicitHumanChangelogThanks("clawsweeper")).toBe(true);
     expect(requiresExplicitHumanChangelogThanks("clawsweeper[bot]")).toBe(true);
+    expect(requiresExplicitHumanChangelogThanks("dependabot[bot]")).toBe(true);
     expect(requiresExplicitHumanChangelogThanks("app/clawsweeper")).toBe(true);
     expect(requiresExplicitHumanChangelogThanks("human-clawsweeper-fan")).toBe(false);
     expect(requiresExplicitHumanChangelogThanks("steipete")).toBe(false);
@@ -129,7 +136,7 @@ describe("check-changelog-attributions", () => {
     try {
       let output = "";
       try {
-        validateChangelogEntry(repo, "clawsweeper[bot]");
+        validateChangelogEntry(repo, "dependabot[bot]");
       } catch (error) {
         output = String((error as { stdout?: unknown }).stdout ?? error);
       }
@@ -142,7 +149,7 @@ describe("check-changelog-attributions", () => {
   it("accepts explicit human thanks for bot PR changelog entries", () => {
     const repo = createRepoWithPrChangelogDiff("- Bot repair (#123). Thanks @alice.");
     try {
-      expect(validateChangelogEntry(repo, "clawsweeper[bot]")).toContain("explicit thanks");
+      expect(validateChangelogEntry(repo, "dependabot[bot]")).toContain("explicit thanks");
     } finally {
       rmSync(repo, { recursive: true, force: true });
     }
