mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-12 21:53:00 -06:00
fix(release): bound validation retries and soak
This commit is contained in:
Vincent Koc
@@ -57,10 +57,12 @@ Load `$release-openclaw-ci` and `$openclaw-testing`. This is validation only, ne
|
||||
2. Only when the cadence is due, confirm no full/all run is active, then snapshot exact current `origin/main` after checking mirror invariants. Run the provider-secret preflight without printing secrets and dispatch the trusted workflow once:
|
||||
|
||||
```bash
|
||||
MAIN_SHA="<exact-main-sha>"
|
||||
gh workflow run full-release-validation.yml \
|
||||
--repo openclaw/openclaw \
|
||||
--ref main \
|
||||
-f ref=<exact-main-sha> \
|
||||
-f ref="$MAIN_SHA" \
|
||||
-f expected_sha="$MAIN_SHA" \
|
||||
-f provider=openai \
|
||||
-f mode=both \
|
||||
-f release_profile=full \
|
||||
|
||||
@@ -9,6 +9,17 @@ Use this skill for Parallels guest workflows and smoke interpretation. Do not lo
|
||||
|
||||
## Global rules
|
||||
|
||||
- Parallels is postpublish-confidence coverage by default, not a prerequisite
|
||||
for the bounded beta-publish phase. Run it against one exact published
|
||||
package version and record the Validation SHA + Tooling SHA run tuple that
|
||||
authorized that package. Validation SHA maps to its Code SHA or Release SHA;
|
||||
it is not a third release identity.
|
||||
- A failed postpublish Parallels lane does not retroactively unpublish a beta.
|
||||
Classify it as product, harness/tooling/provenance, infrastructure/credential,
|
||||
or wrapper failure. Only a confirmed product defect enters the next beta.
|
||||
- Use one coordinator and one lane per independent guest family. Diagnose and
|
||||
retry one failed family once, then reassess; do not restart the aggregate
|
||||
matrix automatically.
|
||||
- Inventory existing VMs and snapshots before provisioning anything. When a preconfigured pristine
|
||||
snapshot matches the requested baseline, switch to it and reuse its user, tools, and base setup.
|
||||
Do not create a new VM, reinstall macOS, or rebuild the guest baseline for a "fresh" run.
|
||||
|
||||
@@ -288,21 +288,25 @@ rerun after a focused patch.
|
||||
### Full Release Validation
|
||||
|
||||
`Full Release Validation` (`.github/workflows/full-release-validation.yml`) is
|
||||
the manual product-validation umbrella. Run the full child matrix on the
|
||||
product-complete pre-changelog **Code SHA**. It resolves a target ref, then
|
||||
the manual product-validation umbrella. Bind each run to the immutable
|
||||
**Validation SHA + Tooling SHA** tuple. Validation SHA maps to the Code SHA for
|
||||
product validation or the Release SHA for changelog-only validation; it is not
|
||||
a third release identity. The workflow resolves it before child dispatch, then
|
||||
dispatches:
|
||||
|
||||
- manual `CI` for the full normal CI graph, with Android enabled via
|
||||
`include_android=true`
|
||||
- `Plugin Prerelease` for release-only plugin static checks, extension shards,
|
||||
the release-only `agentic-plugins` shard, and plugin product Docker lanes
|
||||
- `OpenClaw Release Checks` for install smoke, cross-OS release checks, live and
|
||||
E2E checks, Docker release-path suites, OpenWebUI, QA Lab, fast Matrix, and
|
||||
Telegram release lanes
|
||||
- `OpenClaw Release Checks` for install smoke, cross-OS release checks, package
|
||||
acceptance, and QA parity; broad live/E2E and QA-live lanes join `all` only
|
||||
when release soak is enabled
|
||||
- optional post-publish Telegram E2E when a package spec is supplied
|
||||
|
||||
Run the full matrix only when validating an actual Code SHA, after broad shared
|
||||
CI or release orchestration changes, or when explicitly asked:
|
||||
For beta-publish, use `release_profile=beta` with
|
||||
`run_release_soak=false`. Postpublish-confidence uses the exact published
|
||||
package with `run_release_soak=true` or explicit focused groups.
|
||||
Stable-publish uses `release_profile=stable`.
|
||||
|
||||
```bash
|
||||
node scripts/full-release-validation-at-sha.mjs \
|
||||
@@ -316,14 +320,12 @@ Validation directly from and against `extended-stable/YYYY.M.33` with
|
||||
replaced by a `release-ci/*` run. Use `$release-openclaw-ci` for its failure
|
||||
classification and run-identity rules.
|
||||
|
||||
The helper pins the trusted workflow revision on current `main` while targeting
|
||||
the historical release SHA and recording the canonical release branch as
|
||||
context. It infers `beta` for alpha/beta package versions and `stable` for
|
||||
The helper pins the Tooling SHA on trusted `main`, passes the resolved Code SHA
|
||||
as `expected_sha`, and records the canonical release branch as context. It
|
||||
infers `beta` for alpha/beta package versions and `stable` for
|
||||
stable/correction versions. Pass `-f release_profile=full` only for the broad
|
||||
advisory provider/media sweep. Do not make `full` faster by silently dropping
|
||||
suites; optimize setup, artifact reuse, and sharding instead. The parent
|
||||
verifier job appends a child overview plus slowest-job tables for child runs;
|
||||
rerun only that verifier after a child rerun turns green.
|
||||
suites; use the bounded phase that matches the release decision.
|
||||
|
||||
Standalone manual `CI` dispatches do not run the plugin prerelease suite, the
|
||||
extension batch sweep, or the release-only `agentic-plugins` Vitest shard. Those
|
||||
@@ -331,15 +333,16 @@ lanes are intentionally reserved for the separate `Plugin Prerelease` child so
|
||||
PRs, main pushes, and ad hoc broad CI checks do not spend Docker/package time or
|
||||
all-plugin runtime time on release-only product coverage.
|
||||
|
||||
If a full run is already active on a newer `origin/main`, prefer watching that
|
||||
run over dispatching a duplicate. Do not cancel release, release-check, or child
|
||||
workflow runs unless Peter explicitly asks for cancellation.
|
||||
Use one operator, one transition-only watcher, and at most one investigator for
|
||||
the current failed surface. Parent timeout or cancellation leaves adopted exact
|
||||
children running; cancel an exact child only by explicit operator action or the
|
||||
workflow's identity-mismatch/fail-fast path.
|
||||
|
||||
The child-dispatch jobs record the child run ids. The final
|
||||
`Verify full validation` job re-queries those child runs and is the canonical
|
||||
parent gate. If a child workflow failed but was later rerun successfully, rerun
|
||||
only the failed parent verifier job; do not dispatch a new full umbrella unless
|
||||
the release evidence is stale.
|
||||
The child-dispatch jobs record child run ids, and `Verify full validation`
|
||||
re-queries them during that parent attempt. A later narrow green run is useful
|
||||
recovery evidence but is not publish authorization by itself and there is no
|
||||
standalone finalizer. The release owner must reassess the recorded evidence and
|
||||
current publish gate.
|
||||
|
||||
Once the Code SHA is green, generate and commit only `CHANGELOG.md`. The new
|
||||
**Release SHA** is eligible for product-evidence reuse only when GitHub proves
|
||||
@@ -350,14 +353,16 @@ SHA children. Package, install/update, and release-note proof still runs on the
|
||||
Release SHA because its tarball bytes changed. Any non-changelog path
|
||||
invalidates reuse and requires a new Code SHA full matrix.
|
||||
|
||||
For bounded recovery after a focused fix, pass `-f rerun_group=<group>`.
|
||||
For bounded recovery, classify the failure as product,
|
||||
harness/tooling/provenance, infrastructure/credential, or wrapper before
|
||||
editing. Only a confirmed product failure changes the Code SHA. Use one
|
||||
diagnosis, one fix when needed, and one narrow retry with
|
||||
`-f rerun_group=<group>`, then reassess.
|
||||
Supported umbrella groups are `all`, `ci`, `plugin-prerelease`,
|
||||
`release-checks`, `install-smoke`, `cross-os`, `live-e2e`, `package`, `qa`,
|
||||
`qa-parity`, `qa-live`, and `npm-telegram`. Use the narrowest group that covers
|
||||
the failed box. After a targeted release-check fix, do not restart the full
|
||||
umbrella by habit: dispatch the matching `rerun_group` and rerun only the parent
|
||||
verifier/evidence step after the child is green unless the release evidence is
|
||||
stale. For a single failed live/E2E shard, use
|
||||
the failed box. Do not automatically dispatch `all` after a narrow retry. For a
|
||||
single failed live/E2E shard, use
|
||||
`-f rerun_group=live-e2e -f live_suite_filter=<suite_id>` so the Blacksmith
|
||||
workflow only spends setup and queue time on that suite.
|
||||
|
||||
|
||||
@@ -10,8 +10,19 @@ Use this with `$release-openclaw-maintainer` and `$openclaw-testing` when a rele
|
||||
## Guardrails
|
||||
|
||||
- No version bump, tag, npm publish, GitHub release, or release promotion without explicit operator approval.
|
||||
- After compaction, resume, or new steering, rewrite the effective goal and
|
||||
current phase from the latest explicit operator instruction. Do not merge old
|
||||
scope back into the active release.
|
||||
- Hold the release scope once a release branch or Code SHA exists. Validate and
|
||||
ship that exact release; do not turn moving `main` into a second work queue.
|
||||
- Record every active validation run as the immutable tuple **Validation SHA +
|
||||
Tooling SHA**. Validation SHA maps to the Code SHA for product validation or
|
||||
the Release SHA for changelog-only validation; it is not a third release
|
||||
identity. A branch or temporary ref is context and transport.
|
||||
- Apply a release firebreak after the Code SHA is frozen. Admit only confirmed
|
||||
product defects, package/provenance defects in the bytes to publish, security
|
||||
defects, or failures that make publication impossible. Queue other findings
|
||||
for postpublish confidence or the next beta.
|
||||
- Use trusted `main` workflow revisions as immutable dispatch sources. Do not
|
||||
adopt newer main code, repair unrelated main CI, wait for broad main health,
|
||||
or expand a release fix because the workflow source lives on `main`.
|
||||
@@ -33,6 +44,9 @@ Use this with `$release-openclaw-maintainer` and `$openclaw-testing` when a rele
|
||||
- Full Release Validation collects independent child failures to terminal
|
||||
completion by default. Pass `fail_fast=true` only when the shorter
|
||||
first-failure cancellation path is preferable.
|
||||
- Use one release operator, one transition-only watcher, and at most one
|
||||
investigator for the current failed surface. Do not build audit-review-plan
|
||||
trees around a single workflow transition.
|
||||
- For regular beta/stable releases, treat the product-complete pre-changelog
|
||||
commit as the Code SHA. Full product validation and performance evidence bind
|
||||
to that SHA. The later Release SHA may reuse those results only when it is a
|
||||
@@ -65,27 +79,29 @@ Use this with `$release-openclaw-maintainer` and `$openclaw-testing` when a rele
|
||||
|
||||
## Run identity and retry budget
|
||||
|
||||
Record the target SHA, target ref, parent run id, attempt, and effective
|
||||
workflow SHA before watching or recovering Full Release Validation.
|
||||
Record Validation SHA, Tooling SHA, target context ref, parent run id, attempt,
|
||||
and phase before watching or recovering Full Release Validation. Keep Code SHA
|
||||
and Release SHA separately in the lifecycle ledger.
|
||||
|
||||
- One target SHA has one active canonical `rerun_group=all` parent run by
|
||||
default.
|
||||
- Use GitHub's failed-job rerun on the same parent when its original inputs
|
||||
still select the correct work.
|
||||
- A new parent for the same target SHA is allowed only when no usable parent
|
||||
exists, the existing run cannot consume a required trusted-workflow fix, its
|
||||
evidence identity is invalid, or the operator explicitly requests a fresh
|
||||
run. The replacement must also use `rerun_group=all`; record which terminal
|
||||
parent it supersedes and why.
|
||||
- A narrow `rerun_group` dispatch is supplemental diagnostic proof only. It
|
||||
never supersedes the canonical parent and cannot satisfy publish evidence.
|
||||
Run it only after the canonical parent is terminal, then obtain green
|
||||
`rerun_group=all` evidence before publish.
|
||||
- Never keep two parents active for the same SHA. Cancel only the superseded
|
||||
task-owned run after the replacement is identified.
|
||||
- After two unchanged retries of the same failure, stop repeating it. Recheck
|
||||
classification and report one precise blocker or the missing evidence needed
|
||||
for a different action.
|
||||
- Conceptual phases map to current inputs as follows:
|
||||
- `beta-publish`: `release_profile=beta`, `run_release_soak=false`
|
||||
- `postpublish-confidence`: published package inputs with
|
||||
`run_release_soak=true` or explicit focused groups
|
||||
- `stable-publish`: `release_profile=stable`
|
||||
- Keep at most one active parent for the same Validation SHA + Tooling SHA + rerun
|
||||
group. Concurrency does not cancel an older exact child automatically.
|
||||
- Parent cancellation or timeout leaves an adopted identity-checked child
|
||||
running. The operator must cancel that exact child explicitly when it is no
|
||||
longer useful.
|
||||
- Recover one failed surface with one diagnosis, one fix when needed, and one
|
||||
narrow retry. Then reassess the release decision. Do not automatically
|
||||
dispatch `rerun_group=all`.
|
||||
- A new all-group parent is justified only when shared orchestration changed,
|
||||
earlier evidence is invalid for the selected tuple, or the operator explicitly
|
||||
requests it. Record the invalidating event.
|
||||
- Narrow child or group evidence does not by itself become publish
|
||||
authorization. Keep it in the evidence ledger for the release owner to judge
|
||||
against the current publish gate.
|
||||
|
||||
## Preflight
|
||||
|
||||
@@ -163,10 +179,11 @@ dispatching child lanes. Npm preflight and package/install acceptance still run
|
||||
against the exact Release SHA and its new tarball bytes.
|
||||
|
||||
The SHA-pinned helper infers `beta` for alpha/beta package versions and `stable`
|
||||
for stable/correction versions. Pass `release_profile=full` only when the
|
||||
operator explicitly asks for the broad advisory provider/media matrix. Stable
|
||||
and full profiles force the release soak; the beta profile may opt in with
|
||||
`run_release_soak=true`. Use narrow `rerun_group` after focused fixes.
|
||||
for stable/correction versions and passes the Validation SHA + Tooling SHA run
|
||||
identity. `beta` without soak is the bounded beta-publish gate. Run broad live
|
||||
QA and E2E as postpublish confidence with `run_release_soak=true` or explicit
|
||||
groups. Stable and full profiles force the release soak. Use a narrow
|
||||
`rerun_group` after focused fixes; never widen automatically.
|
||||
Publish with `openclaw-release-publish.yml` using `release_profile=from-validation`
|
||||
unless a maintainer intentionally wants to cross-check a specific profile; the
|
||||
publish workflow reads the effective profile from the full-validation manifest.
|
||||
@@ -177,9 +194,11 @@ For `.33+`, dispatch from and target the canonical branch; the regular
|
||||
SHA-pinned helper would produce a rejected `release-ci/*` identity:
|
||||
|
||||
```bash
|
||||
RELEASE_SHA="$(git rev-parse HEAD)"
|
||||
gh workflow run full-release-validation.yml \
|
||||
--ref extended-stable/YYYY.M.33 \
|
||||
-f ref=extended-stable/YYYY.M.33 \
|
||||
-f expected_sha="$RELEASE_SHA" \
|
||||
-f release_profile=stable
|
||||
```
|
||||
|
||||
@@ -225,18 +244,21 @@ Stop watchers before ending the turn or switching strategy.
|
||||
Anthropic API-key lane.
|
||||
5. For live-cache failures, inspect whether it is missing/invalid key, empty text, provider refusal, timeout, or baseline miss. Do not weaken release gates without clear provider evidence.
|
||||
6. Classify before editing:
|
||||
- product/code failure: fix the release branch, freeze a new Code SHA, run
|
||||
focused proof, then obtain green full validation for that new SHA
|
||||
- workflow/harness/infrastructure/credential failure: fix the smallest
|
||||
owning surface and rerun failed jobs on the current parent when its inputs
|
||||
still select the correct work; otherwise supersede the terminal parent once
|
||||
with a new `rerun_group=all` parent on the required trusted-workflow
|
||||
revision. Keep the same Code SHA; touching `main` still requires the active
|
||||
release scope lock
|
||||
- confirmed product/code failure: fix the release branch, freeze a new Code
|
||||
SHA, and invalidate product evidence
|
||||
- harness/tooling/provenance failure: keep the Code SHA, fix the smallest
|
||||
owning surface, and retry only the failed surface with the required Tooling
|
||||
SHA
|
||||
- infrastructure/credential failure: keep both SHAs, repair the external
|
||||
prerequisite, and retry only the failed surface
|
||||
- wrapper/monitor failure: keep the child and candidate identities; record
|
||||
the wrapper result separately from the child result
|
||||
- changelog/release-note failure: change only `CHANGELOG.md`, keep Code SHA
|
||||
evidence, and repeat Release SHA proof
|
||||
- publish child/registry selector failure: keep Release SHA and resume the
|
||||
failed child; never rebuild an immutable version that already published
|
||||
Only the first class changes the Code SHA. After one diagnosis/fix/narrow
|
||||
retry, reassess instead of starting another all-group cycle.
|
||||
7. If a required PR CI run is capacity-stalled with queued jobs and no active
|
||||
jobs, do not cancel unrelated work or accept a generic manual dispatch.
|
||||
First verify the PR head carries the current fallback schema:
|
||||
@@ -261,8 +283,8 @@ include_android=true -f release_gate=true`.
|
||||
|
||||
Record:
|
||||
|
||||
- release identity: Code/Release SHAs for regular releases; canonical branch,
|
||||
exact SHA, and immutable tag for extended-stable
|
||||
- release lifecycle ledger: Code SHA, Release SHA, and Tooling SHA for regular
|
||||
releases; canonical branch, exact SHA, and immutable tag for extended-stable
|
||||
- evidence-reuse policy and complete changed-path set
|
||||
- active full parent run URL, attempt, workflow SHA, and any superseded parent
|
||||
with the exact replacement reason
|
||||
|
||||
@@ -18,14 +18,16 @@
|
||||
- Fetch failed-job logs only after a job reaches a terminal failing state.
|
||||
- Prefer same-parent failed-job reruns when the original inputs still select the
|
||||
right work.
|
||||
- Keep one active parent per target SHA. Create a replacement only when the
|
||||
existing parent cannot consume a required workflow fix or its evidence
|
||||
identity is invalid; record the superseded run and reason. The replacement
|
||||
remains `rerun_group=all`.
|
||||
- Treat narrow `rerun_group` dispatches as supplemental diagnostics only; they
|
||||
do not satisfy publish evidence.
|
||||
- Stop after two unchanged retries and report the exact blocker instead of
|
||||
creating another verification loop.
|
||||
- Keep one active parent per exact Validation SHA + Tooling SHA + rerun group. Create
|
||||
a replacement only when the current evidence is invalid or cannot consume a
|
||||
required workflow fix; record the invalidating event and do not widen
|
||||
automatically to `rerun_group=all`.
|
||||
- Classify one failed surface, make one fix when needed, and retry the narrowest
|
||||
failed group once. Then reassess whether to ship, explicitly waive, or block
|
||||
instead of creating another verification loop.
|
||||
- Preserve successful exact-tuple evidence when the documented finalization
|
||||
rules allow reuse. Narrow evidence does not become publish authorization by
|
||||
itself, and there is no standalone rerunnable finalizer today.
|
||||
- Leave bad secrets unset. A 401 candidate from 1Password should not overwrite GitHub.
|
||||
- Make the final release evidence note durable: parent URL, child run URLs, SHA, command proof, and gaps.
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ Before validation or publication, write one compact state record and keep it
|
||||
current:
|
||||
|
||||
- goal and terminal success criteria
|
||||
- release version, tag, branch, cut SHA, Code SHA, and Release SHA
|
||||
- release version, tag, branch, cut SHA, Code SHA, Tooling SHA, and Release SHA
|
||||
- active Full Release Validation parent run id and attempt
|
||||
- npm preflight and publish parent run ids
|
||||
- completed phases and immutable child artifacts
|
||||
@@ -26,6 +26,9 @@ current:
|
||||
|
||||
Use `references/release-handoff-template.md` when starting a release session,
|
||||
recovering after compaction, or handing the release to another operator.
|
||||
After compaction, resume, or new steering, the latest explicit operator
|
||||
instruction replaces the effective goal and phase; do not merge superseded
|
||||
scope back into the release.
|
||||
Completed phases stay complete. Reopen one only when a named event invalidates
|
||||
its evidence, such as a Code SHA change, a non-changelog Release SHA change, or
|
||||
a workflow fix that the existing parent run cannot consume.
|
||||
@@ -94,6 +97,14 @@ a workflow fix that the existing parent run cannot consume.
|
||||
infrastructure, repair the smallest owning surface and rerun against the same
|
||||
Code SHA. Touch `main` only under the active release scope lock above. Never
|
||||
mutate the release candidate to satisfy newer tooling or heal unrelated main.
|
||||
- Apply a release firebreak after the Code SHA is frozen. Admit only confirmed
|
||||
product defects, package/provenance defects in the bytes to publish, security
|
||||
defects, or failures that make publication impossible. Queue adjacent
|
||||
improvements and broad confidence findings for the next beta or postpublish
|
||||
work.
|
||||
- Operate with one release owner, one transition-only watcher, and at most one
|
||||
investigator for the current failed surface. One diagnosis, one fix when
|
||||
needed, and one narrow retry consume the failure budget; then reassess.
|
||||
- Generate `CHANGELOG.md` only after the Code SHA is green. The resulting
|
||||
**Release SHA** must be a descendant whose complete diff from the Code SHA is
|
||||
exactly `CHANGELOG.md`. Release-note checks, npm preflight/package bytes,
|
||||
@@ -743,10 +754,10 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
- Parallels validation and any local live model QA for this train must use both
|
||||
`OPENAI_API_KEY` and `ANTHROPIC_API_KEY`. If either cannot be injected, stop
|
||||
before starting those local long lanes and report the missing key.
|
||||
- Live credentialed channel QA is the GitHub Actions workflow
|
||||
- Postpublish credentialed channel QA is the GitHub Actions workflow
|
||||
`QA-Lab - All Lanes` (`.github/workflows/qa-live-transports-convex.yml`), not a
|
||||
local substitute. Dispatch it from Actions against the release tag and wait
|
||||
for it to pass before npm preflight/publish readiness. Use a SHA only when it
|
||||
local substitute. Dispatch it from Actions against the published release tag
|
||||
during postpublish confidence. Use a SHA only when it
|
||||
satisfies the workflow's secret-bearing trust gate: main ancestor or open PR
|
||||
head. It runs the QA Lab mock parity gate plus live Matrix and live Telegram
|
||||
lanes using the `qa-live-shared` environment; Telegram uses Convex CI
|
||||
@@ -759,21 +770,15 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
- `pnpm ui:build`
|
||||
- `pnpm release:check`
|
||||
- `OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT=1 pnpm test:install:smoke`
|
||||
- Full pre-npm beta test roster:
|
||||
- default release checks above
|
||||
- all Docker tests: `pnpm test:docker:all`, plus standalone Docker live lanes
|
||||
not covered by the aggregate when operator says "all docker tests":
|
||||
`pnpm test:docker:live-acp-bind`, `pnpm test:docker:live-cli-backend`, and
|
||||
`pnpm test:docker:live-codex-harness`
|
||||
- all Parallels install/update tests:
|
||||
`pnpm test:parallels:npm-update -- --json` plus any needed individual
|
||||
rerun lanes from `openclaw-parallels-smoke`
|
||||
- all QA release validation: dispatch GitHub Actions > `QA-Lab - All Lanes`
|
||||
against the release tag and require success. This is the release gate for
|
||||
live credentialed Matrix/Telegram channel coverage. Use a SHA only when it
|
||||
satisfies the workflow trust gate. Run local OpenAI/Anthropic suites or
|
||||
repo-backed character evals only when the operator asks for extra model
|
||||
coverage or a failure needs local debugging.
|
||||
- Release validation phases:
|
||||
- `beta-publish`: `release_profile=beta`, `run_release_soak=false`. This is
|
||||
the bounded prepublish gate; it excludes broad live/E2E, QA-live, and
|
||||
Parallels confidence work.
|
||||
- `postpublish-confidence`: run against the exact published beta package with
|
||||
`run_release_soak=true` or explicit focused groups. This is the default home
|
||||
for QA-live, broad Docker/live E2E, mobile, and Parallels.
|
||||
- `stable-publish`: `release_profile=stable`; require the stable publish
|
||||
roster and accepted confidence evidence.
|
||||
- Post-published beta verification roster:
|
||||
- `node --import tsx scripts/openclaw-npm-postpublish-verify.ts <beta-version>`
|
||||
- install/update smoke against the published beta channel
|
||||
@@ -794,8 +799,8 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
operator explicitly scopes a harness-only isolation check; a lane that
|
||||
disables bundled plugin installs is not valid plugin/dependency release
|
||||
evidence.
|
||||
- targeted QA reruns only for areas touched by fixes after the full pre-npm
|
||||
roster, unless the operator requests the full QA roster again. If the fix
|
||||
- targeted QA reruns only for areas touched by fixes after the beta-publish
|
||||
gate, unless the operator requests the full QA roster again. If the fix
|
||||
touches live channel QA, credential plumbing, Matrix, Telegram, or the QA
|
||||
harness, rerun Actions > `QA-Lab - All Lanes`.
|
||||
- Check all release-related build surfaces touched by the release, not only the npm package.
|
||||
@@ -837,7 +842,10 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
Docker/Parallels matrix unless the beta evidence is stale, the stable build
|
||||
differs materially from beta, or the operator explicitly asks for full
|
||||
retesting.
|
||||
- If any required build, packaging step, or release workflow is red, do not say the release is ready.
|
||||
- A red required surface blocks readiness only after classification shows that
|
||||
it invalidates the current phase or publish gate. Report harness, provenance,
|
||||
infrastructure, credential, and wrapper failures separately from confirmed
|
||||
product failures.
|
||||
|
||||
## Use the right auth flow
|
||||
|
||||
@@ -1018,9 +1026,12 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
8. Run the deterministic source preflight, then Full Release Validation against
|
||||
the exact Code SHA with
|
||||
`node scripts/full-release-validation-at-sha.mjs --sha <code-sha> --target-ref release/YYYY.M.PATCH`.
|
||||
Use one transition watcher. Product failures return to step 6 with a new
|
||||
Code SHA; tooling/harness failures are fixed separately and rerun against the
|
||||
same Code SHA.
|
||||
For beta-publish, keep `release_profile=beta` and
|
||||
`run_release_soak=false`. Record the Validation SHA + Tooling SHA tuple
|
||||
(Validation SHA is the Code SHA in this phase) and use one transition
|
||||
watcher. Product failures return to step 6 with a new Code SHA;
|
||||
tooling/harness/provenance, infrastructure/credential, and wrapper failures
|
||||
keep the Code SHA and rerun only the failed surface.
|
||||
9. After the Code SHA is green, run `/changelog` once for the stable-base target
|
||||
version using current `origin/main` for canonical PR provenance. Keep the
|
||||
heading as `## YYYY.M.PATCH`, not `## YYYY.M.PATCH-beta.N`.
|
||||
@@ -1046,7 +1057,10 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
<release-sha-validation-run-id> --npm-preflight-run <preflight-run-id>
|
||||
--skip-dispatch` to consume the existing reused full evidence and exact
|
||||
Release SHA preflight instead of dispatching either again. It completes
|
||||
package/install proof and prints the publish command.
|
||||
package/install proof and prints the publish command. Beta and alpha
|
||||
candidates defer Parallels to postpublish `pnpm release:beta-smoke` by
|
||||
default; stable/full candidates run it prepublish. Use `--run-parallels` or
|
||||
`--skip-parallels` only for an explicit operator override.
|
||||
18. Start publication only after the candidate bundle is green. Reuse successful
|
||||
immutable child runs/artifacts on retry; do not rebuild or republish versions
|
||||
that already succeeded.
|
||||
@@ -1063,12 +1077,15 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
`openclaw/releases/.github/workflows/openclaw-macos-publish.yml` with
|
||||
`preflight_only=true` and wait for it to pass. Save that run id because the
|
||||
real publish requires it to reuse the notarized mac artifacts.
|
||||
23. Classify every failure before changing git state. Product defects return to
|
||||
23. Classify every failure before changing git state. Confirmed product defects return to
|
||||
step 6 and invalidate downstream Code/Release SHA evidence. Changelog or
|
||||
release-note defects change only the Release SHA and reuse the green Code
|
||||
SHA evidence after the exact delta is reverified. Tooling, credential,
|
||||
approval, registry selector, or publication-child failures keep the
|
||||
candidate unchanged and resume the smallest failed surface.
|
||||
SHA evidence after the exact delta is reverified. Tooling, provenance,
|
||||
credential, infrastructure, wrapper, approval, registry selector, or
|
||||
publication-child failures keep the candidate unchanged and resume the
|
||||
smallest failed surface. Only confirmed product failure changes the Code
|
||||
SHA. After one diagnosis/fix/narrow retry, reassess; do not automatically
|
||||
rerun `all`.
|
||||
24. Start `.github/workflows/openclaw-release-publish.yml` from the exact pinned
|
||||
trusted workflow source
|
||||
with the same tag for the real beta or stable publish, choose `npm_dist_tag` (`beta` default,
|
||||
@@ -1099,17 +1116,23 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
||||
27. Run the post-published beta verification roster. Do not scan current `main`
|
||||
for extra fixes unless the operator explicitly requests a backport audit.
|
||||
Apply only operator-selected backports, and increment to the next beta if a
|
||||
selected fix must change the already-published package. If any
|
||||
lane fails after the beta package is published, fix, commit/push/pull,
|
||||
increment to the next beta tag, and rerun the affected beta evidence. Once
|
||||
selected fix must change the already-published package. A failed confidence
|
||||
lane does not retroactively unpublish the beta. Classify it first; only a
|
||||
confirmed product defect admitted by the release owner creates a fix,
|
||||
increments the next beta tag, and reruns affected evidence. Once
|
||||
the beta is live, start remote/manual rosters where they
|
||||
can overlap safely, but keep local Docker and Parallels load controlled.
|
||||
Ensure the full expensive roster has passed at least once before
|
||||
stable/latest promotion. The roster includes the manual Actions >
|
||||
`NPM Telegram Beta E2E` workflow against the exact published beta package.
|
||||
If a pre-npm lane fails before any tag/package leaves the machine, fix and
|
||||
rerun the same intended beta attempt. Repeat up to the operator's
|
||||
authorized beta-attempt limit, normally 4.
|
||||
If a pre-npm lane fails before any tag/package leaves the machine, classify
|
||||
it first and use one diagnosis, one fix when needed, and one narrow retry.
|
||||
Only an operator-admitted confirmed product defect may create a new intended
|
||||
beta attempt. Harness/tooling/provenance, infrastructure/credential, and
|
||||
wrapper failures keep the candidate identity and do not authorize another
|
||||
all-group cycle. The operator's separate beta-attempt cap, normally 4,
|
||||
remains a ceiling for admitted product attempts, not an automatic retry
|
||||
budget.
|
||||
28. Announce the beta/stable release on Discord best-effort using the configured secret workflow.
|
||||
29. If the operator requested beta only, stop after beta verification and the
|
||||
announcement.
|
||||
|
||||
@@ -7,6 +7,8 @@ captured by a durable run or artifact URL.
|
||||
## Goal
|
||||
|
||||
Ship `<version>` on `<channel>` and stop when `<terminal success criteria>`.
|
||||
After compaction or resume, replace this section with the latest explicit
|
||||
operator steering. Do not preserve superseded scope.
|
||||
|
||||
## Immutable state
|
||||
|
||||
@@ -14,12 +16,14 @@ Ship `<version>` on `<channel>` and stop when `<terminal success criteria>`.
|
||||
- branch: `<release/YYYY.M.PATCH | extended-stable/YYYY.M.33>`
|
||||
- cut SHA: `<full sha>`
|
||||
- Code SHA: `<regular release full sha | not applicable>`
|
||||
- Tooling SHA: `<trusted workflow full sha>`
|
||||
- Release SHA: `<regular release full sha | exact extended-stable branch tip>`
|
||||
- tag: `v<version>`
|
||||
- workflow ref: `<release-ci ref | canonical branch>`
|
||||
- publication inventory: `<exact surfaces>`
|
||||
- approved backports: `<none or exact PRs/commits>`
|
||||
- approved main changes: `<none or exact blocker>`
|
||||
- admitted release blockers: `<confirmed product/package/provenance/security blockers only>`
|
||||
- frozen-target compatibility repairs: `<none or exact PRs/invariants>`
|
||||
|
||||
## Active evidence
|
||||
@@ -34,27 +38,39 @@ Ship `<version>` on `<channel>` and stop when `<terminal success criteria>`.
|
||||
|
||||
## Phase
|
||||
|
||||
- conceptual phase: `<beta-publish | postpublish-confidence | stable-publish>`
|
||||
- current input mapping: `<beta + no soak | published package + soak/focused groups | stable>`
|
||||
- completed: `<phases that stay complete>`
|
||||
- current: `<one phase>`
|
||||
- next action: `<one concrete action>`
|
||||
- roles: `<one operator | one transition watcher | zero or one current-failure investigator>`
|
||||
- retry budget: `<one diagnosis/fix/narrow retry, then reassess>`
|
||||
|
||||
## Failure policy
|
||||
|
||||
- regular product/code failure: fix the release branch, freeze a new Code SHA,
|
||||
and invalidate downstream product evidence
|
||||
- confirmed product/code failure: fix the release branch, freeze a new Code
|
||||
SHA, and invalidate downstream product evidence
|
||||
- regular changelog-only failure: change only `CHANGELOG.md`, freeze a new
|
||||
Release SHA, and reuse green Code SHA evidence after delta proof
|
||||
- extended-stable branch change: land the approved product/changelog change or
|
||||
smallest frozen-target repair by PR, record its source/invariant, and replace
|
||||
all exact-head evidence
|
||||
- workflow/tooling/credential failure: keep the candidate frozen and recover
|
||||
the smallest owning surface
|
||||
- harness/tooling/provenance failure: keep the Code SHA, change the Tooling SHA
|
||||
only when needed, and recover the smallest owning surface
|
||||
- infrastructure/credential failure: keep both SHAs and repair the external
|
||||
prerequisite
|
||||
- wrapper/monitor failure: record parent and child conclusions separately;
|
||||
parent cancellation leaves adopted children running until the operator
|
||||
cancels them explicitly
|
||||
- postpublish-confidence failure: do not retroactively unpublish the beta;
|
||||
admit a confirmed product fix to the next beta
|
||||
- external approval or permission blocker: stop with the exact job, URL,
|
||||
missing permission, and required operator action
|
||||
|
||||
Do not scan moving `main`, add optional backports, dispatch a replacement
|
||||
validation parent, or repeat completed phases unless a named invalidating event
|
||||
requires it.
|
||||
validation parent, automatically rerun `all`, or repeat completed phases unless
|
||||
a named invalidating event requires it. Narrow evidence informs the release
|
||||
decision but is not publish authorization by itself.
|
||||
|
||||
## Stop conditions
|
||||
|
||||
|
||||
@@ -226,6 +226,7 @@ BRANCH="$(git branch --show-current)"
|
||||
|
||||
"$GH" workflow run full-release-validation.yml --repo openclaw/openclaw --ref "$BRANCH" \
|
||||
-f ref="$BRANCH" \
|
||||
-f expected_sha="$SHA" \
|
||||
-f release_profile=beta \
|
||||
-f rerun_group=all
|
||||
|
||||
|
||||
Reference in New Issue
Block a user