ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-27 12:56:01 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): trust frozen plugin prerelease fixtures (#124446)

Browse Source 
* fix(ci): trust frozen plugin prerelease fixtures

* fix(ci): apply scoped plugin test omissions
This commit is contained in:
Peter Steinberger
2026-08-15 23:47:25 -07:00
committed by GitHub
parent 7d05f7c5b9
commit 255ca8d96b
4 changed files with 331 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/plugin-prerelease.yml
+108 -1
View File
@@ -20,6 +20,11 @@ on:
required: false
default: false
type: boolean
node_test_exclude_patterns_json:
description: Full Release Validation-only exact plugin test paths omitted for a frozen target
required: false
default: "[]"
type: string
dispatch_id:
description: Optional parent workflow dispatch identifier
required: false
@@ -53,11 +58,73 @@ jobs:
plugin_prerelease_static_matrix: ${{ steps.manifest.outputs.plugin_prerelease_static_matrix }}
run_plugin_prerelease_node: ${{ steps.manifest.outputs.run_plugin_prerelease_node }}
plugin_prerelease_node_matrix: ${{ steps.manifest.outputs.plugin_prerelease_node_matrix }}
node_test_exclude_patterns_json: ${{ steps.node_test_exclusions.outputs.patterns_json }}
run_plugin_prerelease_extensions: ${{ steps.manifest.outputs.run_plugin_prerelease_extensions }}
plugin_prerelease_extension_matrix: ${{ steps.manifest.outputs.plugin_prerelease_extension_matrix }}
run_plugin_prerelease_docker: ${{ steps.manifest.outputs.run_plugin_prerelease_docker }}
plugin_prerelease_docker_lanes: ${{ steps.manifest.outputs.plugin_prerelease_docker_lanes }}
steps:
- name: Validate frozen-target Node exclusions
id: node_test_exclusions
env:
FULL_RELEASE_VALIDATION: ${{ inputs.full_release_validation && 'true' || 'false' }}
NODE_TEST_EXCLUDE_PATTERNS_JSON: ${{ inputs.node_test_exclude_patterns_json }}
shell: bash
run: |
set -euo pipefail
node --input-type=module <<'EOF'
import { appendFileSync } from "node:fs";
const rawPatterns = process.env.NODE_TEST_EXCLUDE_PATTERNS_JSON ?? "";
let patterns;
try {
patterns = JSON.parse(rawPatterns);
} catch (error) {
console.error(`node_test_exclude_patterns_json must be valid JSON: ${error.message}`);
process.exit(1);
}
if (!Array.isArray(patterns)) {
console.error("node_test_exclude_patterns_json must be a JSON array");
process.exit(1);
}
const invalidPattern = patterns.find((pattern) => {
if (typeof pattern !== "string" || pattern.length === 0 || pattern !== pattern.trim()) {
return true;
}
const segments = pattern.split("/");
return (
!pattern.startsWith("src/plugins/") ||
!pattern.endsWith(".test.ts") ||
pattern.includes("\\") ||
pattern.includes("..") ||
segments.some((segment) => segment.length === 0 || segment === ".") ||
!/^[A-Za-z0-9._/-]+$/u.test(pattern)
);
});
if (invalidPattern !== undefined) {
console.error(
`Invalid frozen-target Node test omission: ${JSON.stringify(invalidPattern)}`,
);
process.exit(1);
}
if (new Set(patterns).size !== patterns.length) {
console.error("node_test_exclude_patterns_json must not contain duplicate paths");
process.exit(1);
}
const fullReleaseValidation = process.env.FULL_RELEASE_VALIDATION === "true";
if (!fullReleaseValidation && rawPatterns !== "[]") {
console.error(
"node_test_exclude_patterns_json may differ from [] only when full_release_validation=true",
);
process.exit(1);
}
appendFileSync(
process.env.GITHUB_OUTPUT,
`patterns_json=${JSON.stringify(patterns)}\n`,
"utf8",
);
EOF
- name: Checkout target
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
@@ -305,6 +372,32 @@ jobs:
persist-credentials: false
submodules: false
- name: Checkout trusted npm security inventory
if: inputs.full_release_validation
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
ref: ${{ github.sha }}
path: .plugin-prerelease-trusted
fetch-depth: 1
fetch-tags: false
persist-credentials: false
sparse-checkout: src/plugins/npm-install-security-scan.release.test.ts
sparse-checkout-cone-mode: false
submodules: false
- name: Install trusted npm security inventory
if: inputs.full_release_validation
shell: bash
run: |
set -euo pipefail
trusted_checkout=.plugin-prerelease-trusted
trap 'rm -rf -- "$trusted_checkout"' EXIT
install -m 0644 \
"$trusted_checkout/src/plugins/npm-install-security-scan.release.test.ts" \
src/plugins/npm-install-security-scan.release.test.ts
rm -rf -- "$trusted_checkout"
trap - EXIT
- name: Setup Node environment
uses: ./.github/actions/setup-node-env
with:
@@ -316,6 +409,7 @@ jobs:
- name: Run release-only plugin Node shard
env:
NODE_OPTIONS: --max-old-space-size=8192
NODE_TEST_EXCLUDE_PATTERNS_JSON: ${{ needs.preflight.outputs.node_test_exclude_patterns_json }}
OPENCLAW_NODE_TEST_CONFIGS_JSON: ${{ toJson(matrix.configs) }}
OPENCLAW_NODE_TEST_INCLUDE_PATTERNS_JSON: ${{ toJson(matrix.includePatterns) }}
OPENCLAW_VITEST_SHARD_NAME: ${{ matrix.shard_name }}
@@ -336,6 +430,16 @@ jobs:
const includePatterns = JSON.parse(
process.env.OPENCLAW_NODE_TEST_INCLUDE_PATTERNS_JSON ?? "null",
);
const excludePatterns = JSON.parse(
process.env.NODE_TEST_EXCLUDE_PATTERNS_JSON ?? "[]",
);
if (
!Array.isArray(excludePatterns) ||
excludePatterns.some((pattern) => typeof pattern !== "string")
) {
console.error("Invalid frozen-target Node exclusions");
process.exit(1);
}
const childEnv = { ...process.env };
if (Array.isArray(includePatterns) && includePatterns.length > 0) {
const includeFile = join(
@@ -346,7 +450,10 @@ jobs:
childEnv.OPENCLAW_VITEST_INCLUDE_FILE = includeFile;
}
const result = spawnSync("pnpm", ["test", "--", ...configs], {
const excludeArgs = excludePatterns.map(
(pattern) => `--exclude=${pattern.slice("src/plugins/".length)}`,
);
const result = spawnSync("pnpm", ["test", "--", ...configs, "--", ...excludeArgs], {
env: childEnv,
stdio: "inherit",
});