fix: let ClawHub dry runs skip publish approval by Patrick-Erichsen · Pull Request #91591 · openclaw/openclaw

Patrick-Erichsen · 2026-06-09T03:54:33Z

Summary

Skip the protected clawhub-plugin-release environment approval when plugin-clawhub-release.yml is dispatched with dry_run=true.
Keep real publishes gated on the approval job.
Keep the reusable ClawHub publish job dependent on successful artifact packing, and allow it to run for dry-runs without approval.

Verification

./node_modules/.bin/vitest run --config test/vitest/vitest.tooling.config.ts test/scripts/package-acceptance-workflow.test.ts
Dry-run proof: https://github.com/openclaw/openclaw/actions/runs/27182518869
- publish_plugins_clawhub succeeded with dry_run: true.
- approve_plugin_clawhub_release skipped.
- verify_published_clawhub_package skipped.
- Fake dry-run version @openclaw/brave-plugin@2026.6.99-beta.1 still returns 404 from ClawHub.

clawsweeper · 2026-06-09T03:56:38Z

Codex review: found issues before merge. Reviewed June 9, 2026, 12:02 AM ET / 04:02 UTC.

Summary
The PR changes the ClawHub plugin release workflow so dry-run dispatches skip the protected publish approval job while real publishes still require approval, and adds workflow-string assertions.

PR surface: Tests +4, Config 0. Total +4 across 2 files.

Reproducibility: yes. Current main shows the publish job depends on the approval job, and the linked dry-run proof shows the intended after-change scheduling with approval skipped and publish completed.

Review metrics: 1 noteworthy metric.

Protected release gate behavior: 1 dry-run approval bypass added. This is the central behavior change and it affects a workflow path that currently receives a publish credential.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🐚 platinum hermit ✨ media proof bonus
Patch quality: 🧂 unranked krab
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Prevent CLAWHUB_TOKEN from being passed to approval-less dry-run publish jobs.
Tighten the workflow assertion so it specifically verifies the approval-job dry-run condition and no-secret dry-run path.

Risk before merge

[P1] Dry-run dispatch would bypass the protected clawhub-plugin-release approval while still passing secrets.CLAWHUB_TOKEN into the pinned reusable publish workflow.
[P1] The added inputs.dry_run != true assertion is broad enough to pass because the workflow already had that string in the verify job, so it does not specifically protect the approval-gate condition.

Maintainer options:

Strip the token from dry runs (recommended)
Pass an empty clawhub_token or split a no-secret dry-run job so approval-less dry runs cannot materialize CLAWHUB_TOKEN.
Keep approval for token-backed dry runs
If maintainers want dry runs to exercise the token-backed publish path, keep the protected approval requirement for that mode and document the reason.

Next step before merge

[P2] The remaining blocker is a release secret/approval boundary decision plus a small workflow repair, so maintainer review should choose the intended token behavior before automation proceeds.

Security
Needs attention: The diff introduces a concrete secret-boundary concern by skipping protected approval while still forwarding the ClawHub publish token.

Review findings

[P1] Withhold the ClawHub token from approval-less dry runs — .github/workflows/plugin-clawhub-release.yml:443

Review details

Best possible solution:

Keep the dry-run approval skip, but make the approval-less dry-run path call ClawHub without a publish token while real publishes continue to require the protected environment.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main shows the publish job depends on the approval job, and the linked dry-run proof shows the intended after-change scheduling with approval skipped and publish completed.

Is this the best way to solve the issue?

No, not as submitted. The always() condition fixes the skipped-needs behavior, but the approval-less path should not receive CLAWHUB_TOKEN unless maintainers explicitly accept that security boundary change.

Full review comments:

[P1] Withhold the ClawHub token from approval-less dry runs — .github/workflows/plugin-clawhub-release.yml:443
This lets publish_plugins_clawhub run when inputs.dry_run == true without the protected approval job, but the job still passes secrets.CLAWHUB_TOKEN to the reusable ClawHub workflow. The pinned workflow writes a ClawHub config whenever that secret is present, even on dry runs, so this changes the approval boundary for the publish token. Split the dry-run path or pass an empty token for dry runs while keeping real publishes gated.
Confidence: 0.91

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9fdd56da2106.

Label changes

Label changes:

add P1: The PR touches release automation and currently changes a secret/approval boundary in the ClawHub publish path.
add merge-risk: 🚨 security-boundary: Merging as-is would allow a dry-run publish job to run without the protected environment while still receiving the ClawHub publish token.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body links a real GitHub Actions dry-run, and the public run page shows the approval job skipped and the publish matrix completed successfully.
add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🐚 platinum hermit and patch quality is 🧂 unranked krab.
add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (linked_artifact): The PR body links a real GitHub Actions dry-run, and the public run page shows the approval job skipped and the publish matrix completed successfully.

Label justifications:

P1: The PR touches release automation and currently changes a secret/approval boundary in the ClawHub publish path.
merge-risk: 🚨 security-boundary: Merging as-is would allow a dry-run publish job to run without the protected environment while still receiving the ClawHub publish token.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🐚 platinum hermit and patch quality is 🧂 unranked krab.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (linked_artifact): The PR body links a real GitHub Actions dry-run, and the public run page shows the approval job skipped and the publish matrix completed successfully.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body links a real GitHub Actions dry-run, and the public run page shows the approval job skipped and the publish matrix completed successfully.

Evidence reviewed

PR surface:

Tests +4, Config 0. Total +4 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	1	4	0	+4
Docs	0	0	0	0
Config	1	2	2	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	6	2	+4

Security concerns:

[high] Approval-less dry runs still receive CLAWHUB_TOKEN — .github/workflows/plugin-clawhub-release.yml:443
The caller continues to map secrets.CLAWHUB_TOKEN into the reusable publish workflow, whose pinned implementation writes a token config whenever the secret is present; dry runs should avoid receiving that secret if they bypass approval.
Confidence: 0.9

What I checked:

Repository policy: Full root AGENTS.md and scoped test/AGENTS.md were read; the root policy treats release workflows, secrets, and approval gates as security-sensitive review surfaces. (AGENTS.md:1, 9fdd56da2106)
Current main behavior: On current main, publish_plugins_clawhub depends on approve_plugin_clawhub_release, and the approval job has the protected clawhub-plugin-release environment. (.github/workflows/plugin-clawhub-release.yml:431, 9fdd56da2106)
PR diff: The PR skips approve_plugin_clawhub_release when inputs.dry_run != true is false and uses always() so publish_plugins_clawhub can still run when dry-run approval is skipped. (.github/workflows/plugin-clawhub-release.yml:443, 5be0e953bf6d)
Reusable ClawHub workflow contract: The pinned ClawHub reusable workflow accepts optional clawhub_token, skips token validation for dry runs, but still writes a ClawHub config whenever the token is supplied. (openclaw/clawhub:.github/workflows/package-publish.yml:194, c9bb13023598)
Real dry-run proof: The public Actions HTML for run 27182518869 shows approve_plugin_clawhub_release skipped and the publish_plugins_clawhub matrix completed successfully. (5be0e953bf6d)
History provenance: The current ClawHub reusable publish path was introduced in feat: dogfood reusable ClawHub package publish; the release orchestration around child approval was carried by earlier release workflow work. (.github/workflows/plugin-clawhub-release.yml:431, e8cf6df3a358)

Likely related people:

Patrick-Erichsen: Current main blame shows Patrick Erichsen introduced the reusable ClawHub package publish workflow section that this PR modifies. (role: recent area contributor; confidence: high; commits: e8cf6df3a358; files: .github/workflows/plugin-clawhub-release.yml, test/scripts/package-acceptance-workflow.test.ts)
Vincent Koc: Blame shows Vincent Koc authored the surrounding release-publish orchestration and much of the workflow guard test this change extends. (role: adjacent release workflow contributor; confidence: medium; commits: ff5fac143973, 5f6ee9f913c7; files: .github/workflows/openclaw-release-publish.yml, test/scripts/package-acceptance-workflow.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix: let clawhub dry runs skip publish approval

5be0e95

openclaw-barnacle Bot added size: XS maintainer Maintainer-authored PR labels Jun 9, 2026

Patrick-Erichsen merged commit f05e987 into main Jun 9, 2026
202 of 209 checks passed

Patrick-Erichsen deleted the pe/clawhub-dry-run-skip-approval branch June 9, 2026 04:04

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 9, 2026

fix: let clawhub dry runs skip publish approval (openclaw#91591)

8fee205

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 07:39 UTC curtismercier/openclaw-mods#1043

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: let ClawHub dry runs skip publish approval#91591

fix: let ClawHub dry runs skip publish approval#91591
Patrick-Erichsen merged 1 commit into
mainfrom
pe/clawhub-dry-run-skip-approval

Patrick-Erichsen commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Patrick-Erichsen commented Jun 9, 2026

Summary

Verification

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading