ci: trim release metadata and ClawHub checkouts

.github/workflows/openclaw-release-checks.yml

@@ -204,6 +204,8 @@ jobs:
           path: source
           fetch-depth: 0
           filter: blob:none
+          sparse-checkout: package.json
+          sparse-checkout-cone-mode: false
 
       - name: Resolve checked-out fallback SHA
         if: steps.fast_ref.outputs.fallback == 'true'

.github/workflows/openclaw-release-publish.yml

@@ -402,6 +402,8 @@ jobs:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
           filter: blob:none
+          sparse-checkout: package.json
+          sparse-checkout-cone-mode: false
           persist-credentials: false
 
       - name: Resolve checked-out release ref

.github/workflows/plugin-clawhub-release.yml

@@ -316,23 +316,21 @@ jobs:
       matrix:
         plugin: ${{ fromJson(needs.preview_plugins_clawhub.outputs.matrix) }}
     steps:
+      - name: Validate target revision
+        env:
+          TARGET_SHA: ${{ needs.preview_plugins_clawhub.outputs.ref_revision }}
+        run: |
+          if [[ ! "${TARGET_SHA}" =~ ^[a-f0-9]{40}$ ]]; then
+            echo "ClawHub pack target must be a full lowercase commit SHA; got: ${TARGET_SHA}" >&2
+            exit 1
+          fi
+
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
-          ref: ${{ github.ref }}
-          fetch-depth: 0
-          filter: blob:none
-
-      - name: Checkout target revision
-        env:
-          TARGET_SHA: ${{ needs.preview_plugins_clawhub.outputs.ref_revision }}
-        run: |
-          set -euo pipefail
-          git fetch --no-tags origin \
-            +refs/heads/main:refs/remotes/origin/main \
-            '+refs/heads/release/*:refs/remotes/origin/release/*'
-          git checkout --detach "${TARGET_SHA}"
+          ref: ${{ needs.preview_plugins_clawhub.outputs.ref_revision }}
+          fetch-depth: 1
 
       - name: Setup Node environment
         uses: ./.github/actions/setup-node-env

test/scripts/package-acceptance-workflow.test.ts

@@ -4615,7 +4615,6 @@ wait_for_run plugin-clawhub-new.yml 123 "${expectedSha}" || status=$?
       [PACKAGE_ACCEPTANCE_WORKFLOW, "resolve_package", "Checkout package workflow ref"],
       [PLUGIN_NPM_RELEASE_WORKFLOW, "preview_plugins_npm", "Checkout"],
       [PLUGIN_CLAWHUB_RELEASE_WORKFLOW, "preview_plugins_clawhub", "Checkout"],
-      [PLUGIN_CLAWHUB_RELEASE_WORKFLOW, "pack_plugins_clawhub_artifacts", "Checkout"],
       [OPENCLAW_NPM_RELEASE_WORKFLOW, "preflight_openclaw_npm", "Checkout"],
       [OPENCLAW_NPM_RELEASE_WORKFLOW, "validate_publish_request", "Checkout"],
       [
@@ -4634,6 +4633,39 @@ wait_for_run plugin-clawhub-new.yml 123 "${expectedSha}" || status=$?
         filter: "blob:none",
       });
     }
+
+    const metadataOnlyCheckouts: Array<[string, string, string]> = [
+      [RELEASE_PUBLISH_WORKFLOW, "resolve_release_target", "Checkout release tag"],
+      [
+        RELEASE_CHECKS_WORKFLOW,
+        "resolve_target",
+        "Checkout selected ref for reachability fallback",
+      ],
+    ];
+    for (const [workflowPath, jobName, stepName] of metadataOnlyCheckouts) {
+      expect(workflowStep(workflowJob(workflowPath, jobName), stepName).with).toMatchObject({
+        "sparse-checkout": "package.json",
+        "sparse-checkout-cone-mode": false,
+      });
+    }
+
+    const clawHubPackJob = workflowJob(
+      PLUGIN_CLAWHUB_RELEASE_WORKFLOW,
+      "pack_plugins_clawhub_artifacts",
+    );
+    const clawHubPackTargetGuard = workflowStep(clawHubPackJob, "Validate target revision");
+    expect(clawHubPackTargetGuard.env?.TARGET_SHA).toBe(
+      "${{ needs.preview_plugins_clawhub.outputs.ref_revision }}",
+    );
+    expect(clawHubPackTargetGuard.run).toContain('[[ ! "${TARGET_SHA}" =~ ^[a-f0-9]{40}$ ]]');
+    expect(workflowStep(clawHubPackJob, "Checkout").with).toMatchObject({
+      ref: "${{ needs.preview_plugins_clawhub.outputs.ref_revision }}",
+      "fetch-depth": 1,
+      "persist-credentials": false,
+    });
+    expect(clawHubPackJob.steps?.map((step) => step.name)).not.toContain(
+      "Checkout target revision",
+    );
   });
 
   it("validates the macOS release handoff before the GitHub release page exists", () => {