Skip to content

Commit 5f1d39b

Browse files
luoyanglangluoyanglang
committed
Merge origin/main into managed plugin pin policy PR
2 parents c3a909d + 1a3ce7c commit 5f1d39b

15,923 files changed

Lines changed: 102909 additions & 19731 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/openclaw-secret-scanning-maintainer/scripts/secret-scanning.mjs‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
#!/usr/bin/env node
2-
// Secret scanning alert handler for OpenClaw maintainers.
3-
// Usage: node secret-scanning.mjs <command> [options]
2+
/**
3+
* Secret scanning alert handler for OpenClaw maintainers.
4+
* Usage: node secret-scanning.mjs <command> [options]
5+
*/
46

57
import { spawnSync } from "node:child_process";
68
import crypto from "node:crypto";
@@ -57,6 +59,7 @@ function isBodyLocationType(locationType) {
5759
return locationType === "issue_body" || locationType === "pull_request_body";
5860
}
5961

62+
/** Decides whether redacting an issue/PR body requires notifying the reporter. */
6063
export function decideBodyRedaction(currentBody, redactedBody) {
6164
const bodyChanged = String(currentBody) !== String(redactedBody);
6265
return {
@@ -65,6 +68,7 @@ export function decideBodyRedaction(currentBody, redactedBody) {
6568
};
6669
}
6770

71+
/** Loads redaction-result metadata for issue/PR body secret locations. */
6872
export function loadBodyRedactionResult(locationType, resultFile) {
6973
if (!isBodyLocationType(locationType)) {
7074
return { notify_required: true };

‎.agents/skills/openclaw-test-heap-leaks/scripts/heapsnapshot-delta.mjs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
#!/usr/bin/env node
2+
/**
3+
* Heap snapshot diff utility for OpenClaw test memory leak investigations.
4+
*/
25

36
import fs from "node:fs";
47
import path from "node:path";

‎.agents/skills/release-openclaw-ci/scripts/release-ci-summary.mjs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
#!/usr/bin/env node
2+
/**
3+
* Release CI summary helper that prints parent and child workflow status for a
4+
* full release run.
5+
*/
26
import { execFileSync } from "node:child_process";
37
import process from "node:process";
48

‎.agents/skills/release-openclaw-ci/scripts/verify-provider-secrets.mjs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
#!/usr/bin/env node
2+
/**
3+
* Release preflight helper that verifies required provider API keys can reach
4+
* their model-list endpoints without printing secret values.
5+
*/
26
import process from "node:process";
37

48
const args = new Map();

‎.agents/skills/release-openclaw-maintainer/SKILL.md‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,9 +111,10 @@ Use this skill for release and publish-time workflow. Load `$release-private` if
111111
- For fallback correction tags like `vYYYY.M.D-N`, the repo version locations still stay at `YYYY.M.D`.
112112
- “Bump version everywhere” means all version locations above except `appcast.xml`.
113113
- Release signing and notary credentials live outside the repo in the private maintainer docs.
114-
- Every stable OpenClaw release ships the npm package and macOS app together.
115-
Beta releases normally ship npm/package artifacts first and skip mac app
116-
build/sign/notarize unless the operator requests mac beta validation.
114+
- Every stable OpenClaw release ships the npm package, macOS app, and signed
115+
Windows Hub installers together. Beta releases normally ship npm/package
116+
artifacts first and skip native app build/sign/notarize/promote unless the
117+
operator requests native beta validation.
117118
- Do not let the slower macOS signing/notary path block npm publication once
118119
the npm preflight has passed. Keep mac validation/publish running in
119120
parallel, publish npm from the successful npm preflight, then start published
@@ -143,6 +144,17 @@ Use this skill for release and publish-time workflow. Load `$release-private` if
143144
at `YYYY.M.D`, but the mac release must use a strictly higher numeric
144145
`APP_BUILD` / Sparkle build than the original release so existing installs
145146
see it as newer.
147+
- Stable Windows Hub release closeout requires the signed
148+
`OpenClawCompanion-Setup-x64.exe`, `OpenClawCompanion-Setup-arm64.exe`, and
149+
`OpenClawCompanion-SHA256SUMS.txt` assets on the canonical
150+
`openclaw/openclaw` GitHub Release. Use the public `Windows Node Release`
151+
workflow after the matching `openclaw/openclaw-windows-node` release exists;
152+
it verifies Authenticode signatures on Windows before uploading assets.
153+
- Website Windows Hub download links should target exact canonical
154+
`openclaw/openclaw/releases/download/vYYYY.M.D/...` assets for the current
155+
stable release, or `releases/latest/download/...` only after verifying the
156+
redirect resolves to that same tag, so the installable signed Windows artifact
157+
is visible from both the GitHub release page and openclaw.ai.
146158

147159
## Build changelog-backed release notes
148160

@@ -178,6 +190,13 @@ Use this skill for release and publish-time workflow. Load `$release-private` if
178190
`CHANGELOG.md` version section, not highlights or an excerpt. When creating
179191
or editing a release, extract from `## YYYY.M.D` through the line before the
180192
next level-2 heading and use that complete block as the release notes.
193+
- To update an existing GitHub Release body, resolve the numeric release id and
194+
patch that resource with the notes file as the `body` field:
195+
`gh api repos/openclaw/openclaw/releases/tags/vYYYY.M.D --jq .id`, then
196+
`gh api -X PATCH repos/openclaw/openclaw/releases/<id> -F body=@/tmp/notes.md`.
197+
Do not trust `gh release edit --notes-file` or `--input` JSON if verification
198+
disagrees; verify with `gh api repos/openclaw/openclaw/releases/<id>` because
199+
the tag lookup and `gh release view` can lag or show stale body text.
181200
- When preparing release notes, scan `src/plugins/compat/registry.ts` and
182201
`src/commands/doctor/shared/deprecation-compat.ts` for compatibility records
183202
with `warningStarts` or `removeAfter` within 7 days after the release date.

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ jobs:
9292
for attempt in 1 2 3; do
9393
timeout --signal=TERM --kill-after=10s 30s git -C "$GITHUB_WORKSPACE" \
9494
-c protocol.version=2 \
95-
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
95+
fetch --no-tags --prune --no-recurse-submodules --depth=2 origin \
9696
"+${ref}:refs/remotes/origin/checkout" && return 0
9797
fetch_status="$?"
9898
if [ "$fetch_status" != "124" ] && [ "$fetch_status" != "137" ]; then
@@ -146,12 +146,12 @@ jobs:
146146
147147
if [ "${{ github.event_name }}" = "push" ]; then
148148
BASE="${{ github.event.before }}"
149+
node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD
149150
else
150151
BASE="${{ github.event.pull_request.base.sha }}"
152+
node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD --merge-head-first-parent
151153
fi
152154
153-
node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD
154-
155155
- name: Build CI manifest
156156
id: manifest
157157
env:

‎.github/workflows/crabbox-hydrate.yml‎

Lines changed: 23 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,11 @@ permissions:
3232
env:
3333
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
3434
PNPM_CONFIG_CHILD_CONCURRENCY: "1"
35-
PNPM_CONFIG_MODULES_DIR: "/var/tmp/openclaw-pnpm-node-modules"
35+
PNPM_CONFIG_MODULES_DIR: "/var/tmp/openclaw-pnpm/node_modules"
3636
PNPM_CONFIG_NETWORK_CONCURRENCY: "1"
37-
PNPM_CONFIG_STORE_DIR: "/var/tmp/openclaw-pnpm-store"
37+
PNPM_CONFIG_STORE_DIR: "/var/cache/crabbox/pnpm/store"
3838
PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: "false"
39-
PNPM_CONFIG_VIRTUAL_STORE_DIR: "/var/tmp/openclaw-pnpm-virtual-store"
39+
PNPM_CONFIG_VIRTUAL_STORE_DIR: "/var/tmp/openclaw-pnpm/virtual-store"
4040

4141
jobs:
4242
hydrate:
@@ -120,18 +120,24 @@ jobs:
120120
append_pnpm_option_arg PNPM_CONFIG_MODULES_DIR modules-dir
121121
append_pnpm_option_arg PNPM_CONFIG_NETWORK_CONCURRENCY network-concurrency
122122
append_pnpm_option_arg PNPM_CONFIG_VIRTUAL_STORE_DIR virtual-store-dir
123-
reset_crabbox_pnpm_path() {
124-
local path="$1"
125-
if [ -z "$path" ]; then
126-
return
123+
require_safe_writable_dir() {
124+
local dir="$1"
125+
if [ -L "$dir" ] || [ ! -d "$dir" ] || [ ! -w "$dir" ]; then
126+
echo "::error::Refusing unsafe pnpm directory: $dir"
127+
exit 1
127128
fi
128-
case "$path" in
129-
/var/tmp/openclaw-pnpm-*) rm -rf "$path" ;;
130-
esac
131129
}
132-
reset_crabbox_pnpm_path "${PNPM_CONFIG_MODULES_DIR:-}"
133-
reset_crabbox_pnpm_path "${PNPM_CONFIG_STORE_DIR:-}"
134-
reset_crabbox_pnpm_path "${PNPM_CONFIG_VIRTUAL_STORE_DIR:-}"
130+
prepare_crabbox_pnpm_dirs() {
131+
local volatile_root="/var/tmp/openclaw-pnpm"
132+
case "${PNPM_CONFIG_MODULES_DIR:?}" in "$volatile_root"/*) ;; *) echo "::error::PNPM_CONFIG_MODULES_DIR must stay under $volatile_root"; exit 1 ;; esac
133+
case "${PNPM_CONFIG_VIRTUAL_STORE_DIR:?}" in "$volatile_root"/*) ;; *) echo "::error::PNPM_CONFIG_VIRTUAL_STORE_DIR must stay under $volatile_root"; exit 1 ;; esac
134+
rm -rf -- "$volatile_root"
135+
mkdir -p "$volatile_root" "$PNPM_CONFIG_STORE_DIR"
136+
require_safe_writable_dir "$volatile_root"
137+
require_safe_writable_dir "$PNPM_CONFIG_STORE_DIR"
138+
mkdir -p "$PNPM_CONFIG_MODULES_DIR" "$PNPM_CONFIG_VIRTUAL_STORE_DIR"
139+
}
140+
prepare_crabbox_pnpm_dirs
135141
if [ -L node_modules ] && [ "$(readlink node_modules)" = "${PNPM_CONFIG_MODULES_DIR:-}" ]; then
136142
rm -f node_modules
137143
fi
@@ -372,9 +378,10 @@ jobs:
372378
$env:XDG_CACHE_HOME = Join-Path $cacheRoot "cache"
373379
$env:COREPACK_HOME = Join-Path $env:XDG_CACHE_HOME "corepack"
374380
$env:PNPM_HOME = Join-Path $cacheRoot "pnpm-home"
375-
$env:PNPM_CONFIG_STORE_DIR = Join-Path $cacheRoot "openclaw-pnpm-store"
376-
$env:PNPM_CONFIG_MODULES_DIR = Join-Path $cacheRoot "openclaw-pnpm-node-modules"
377-
$env:PNPM_CONFIG_VIRTUAL_STORE_DIR = Join-Path $env:PNPM_CONFIG_MODULES_DIR ".pnpm"
381+
$pnpmCacheRoot = Join-Path $cacheRoot "openclaw-pnpm"
382+
$env:PNPM_CONFIG_STORE_DIR = Join-Path $pnpmCacheRoot "store"
383+
$env:PNPM_CONFIG_MODULES_DIR = Join-Path $pnpmCacheRoot "node_modules"
384+
$env:PNPM_CONFIG_VIRTUAL_STORE_DIR = Join-Path $pnpmCacheRoot "virtual-store"
378385
$env:PNPM_CONFIG_CHILD_CONCURRENCY = "4"
379386
$env:PNPM_CONFIG_NETWORK_CONCURRENCY = "8"
380387
$env:PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN = "false"

‎.github/workflows/docker-release.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
push:
55
tags:
66
- "v*"
7+
- "!v*-alpha.*"
78
paths-ignore:
89
- "docs/**"
910
- "**/*.md"
@@ -38,7 +39,11 @@ jobs:
3839
RELEASE_TAG: ${{ inputs.tag }}
3940
run: |
4041
set -euo pipefail
41-
if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-(alpha|beta)\.[1-9][0-9]*)?$ ]]; then
42+
if [[ "${RELEASE_TAG}" == *"-alpha."* ]]; then
43+
echo "Docker alpha image publishing is disabled."
44+
exit 1
45+
fi
46+
if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(-beta\.[1-9][0-9]*)?$ ]]; then
4247
echo "Invalid release tag: ${RELEASE_TAG}"
4348
exit 1
4449
fi

‎.github/workflows/openclaw-live-and-e2e-checks-reusable.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -563,7 +563,7 @@ jobs:
563563
needs: validate_selected_ref
564564
if: inputs.include_repo_e2e && inputs.live_suite_filter == ''
565565
continue-on-error: ${{ inputs.advisory }}
566-
runs-on: ${{ inputs.use_github_hosted_runners && 'ubuntu-24.04' || 'blacksmith-8vcpu-ubuntu-2404' }}
566+
runs-on: ${{ inputs.use_github_hosted_runners && 'ubuntu-24.04' || 'blacksmith-32vcpu-ubuntu-2404' }}
567567
timeout-minutes: ${{ inputs.release_test_profile == 'full' && 90 || 60 }}
568568
env:
569569
OPENCLAW_VITEST_MAX_WORKERS: "2"
@@ -595,7 +595,7 @@ jobs:
595595
needs: validate_selected_ref
596596
if: inputs.include_repo_e2e && (inputs.live_suite_filter == '' || inputs.live_suite_filter == 'openshell-e2e')
597597
continue-on-error: ${{ inputs.advisory }}
598-
runs-on: ${{ inputs.use_github_hosted_runners && 'ubuntu-24.04' || 'blacksmith-8vcpu-ubuntu-2404' }}
598+
runs-on: ${{ inputs.use_github_hosted_runners && 'ubuntu-24.04' || 'blacksmith-32vcpu-ubuntu-2404' }}
599599
timeout-minutes: ${{ matrix.timeout_minutes }}
600600
strategy:
601601
fail-fast: false

‎.github/workflows/opengrep-precise.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
uses: actions/checkout@v6
4545
with:
4646
ref: ${{ github.sha }}
47-
fetch-depth: 1
47+
fetch-depth: 2
4848
fetch-tags: false
4949
persist-credentials: false
5050
submodules: false
@@ -74,6 +74,7 @@ jobs:
7474
- name: Run opengrep on PR diff
7575
env:
7676
OPENCLAW_OPENGREP_BASE_REF: ${{ github.event.pull_request.base.sha }}...HEAD
77+
OPENCLAW_OPENGREP_MERGE_HEAD_FIRST_PARENT: "1"
7778
# Findings from precise rules block this workflow. Pull requests scan
7879
# changed first-party source paths only so findings stay attributable to
7980
# the PR diff. Test/fixture/QA path exclusions live in `.semgrepignore`

0 commit comments

Comments
 (0)