ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-23 19:08:22 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): use trusted plugin identity verifier

Browse Source
This commit is contained in:
Dallin Romney
2026-08-13 15:03:46 +08:00
parent 5c54640322
commit fa4f393cae
2 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/openclaw-npm-release.yml
+1 -1
View File
@@ -1086,7 +1086,7 @@ jobs:
EXPECTED_RELEASE_SHA="$(git rev-parse HEAD)"
export EXPECTED_RELEASE_SHA
RUN_JSON="$(gh run view "$PLUGIN_NPM_RUN_ID" --repo "$GITHUB_REPOSITORY" --json workflowName,displayTitle,headBranch,headSha,event,status,conclusion,url)"
printf '%s' "$RUN_JSON" | node scripts/openclaw-npm-extended-stable-release.mjs verify-run
printf '%s' "$RUN_JSON" | node trusted-workflow/scripts/openclaw-npm-extended-stable-release.mjs verify-run
- name: Download prepared npm tarball
env:
test/scripts/openclaw-npm-extended-stable-workflow.test.ts
+42 -3
View File
@@ -1,8 +1,12 @@
import { readFileSync } from "node:fs";
import { describe, expect, it } from "vitest";
import { spawnSync } from "node:child_process";
import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
import path from "node:path";
import { afterEach, describe, expect, it } from "vitest";
import { parse } from "yaml";
import { useAutoCleanupTempDirTracker } from "../helpers/temp-dir.js";
const workflowPath = ".github/workflows/openclaw-npm-release.yml";
const tempRoots = useAutoCleanupTempDirTracker(afterEach);
type Step = {
env?: Record<string, string>;
@@ -397,7 +401,42 @@ describe("minimal npm extended-stable workflow", () => {
expect(verify.run).toContain(
"--json workflowName,displayTitle,headBranch,headSha,event,status,conclusion,url",
);
expect(verify.run).toContain("openclaw-npm-extended-stable-release.mjs verify-run");
expect(verify.run).toContain(
"trusted-workflow/scripts/openclaw-npm-extended-stable-release.mjs verify-run",
);
});
it("runs the orchestrated plugin verifier from trusted tooling, not the immutable target", () => {
const verify = step(
workflow().jobs?.publish_openclaw_npm,
"Verify plugin npm release run metadata",
);
const verifierPath = verify.run?.match(
/node ([^\s]+openclaw-npm-extended-stable-release\.mjs) verify-run/u,
)?.[1];
expect(verifierPath).toBeDefined();
const root = tempRoots.make("openclaw-old-tag-plugin-verifier-");
const targetVerifier = path.join(root, "scripts/openclaw-npm-extended-stable-release.mjs");
const trustedVerifier = path.join(
root,
"trusted-workflow/scripts/openclaw-npm-extended-stable-release.mjs",
);
mkdirSync(path.dirname(targetVerifier), { recursive: true });
mkdirSync(path.dirname(trustedVerifier), { recursive: true });
writeFileSync(
targetVerifier,
'process.stderr.write("immutable target verifier does not support orchestrated identity\\n"); process.exit(41);\n',
);
writeFileSync(trustedVerifier, 'process.stdout.write("trusted verifier accepted\\n");\n');
const result = spawnSync(process.execPath, [verifierPath!, "verify-run"], {
cwd: root,
encoding: "utf8",
input: "{}",
});
expect(result.status, result.stderr).toBe(0);
expect(result.stdout).toBe("trusted verifier accepted\n");
});
it("captures selector fail closed, publishes extended-stable, retries, and summarizes", () => {