ff10db092b
ci(mantis): extract shared request-resolution, ref-trust, and reaction workflows ( #121339 )
...
* ci(mantis): extract shared request, trust, and reaction workflows
* ci(mantis): drop caller-less params from shared resolve workflow
* test(mantis): read candidate-override parsing from shared resolve workflow
2026-08-09 22:04:27 -07:00
3224005c82
fix(ci): bound Telegram Mantis proof cleanup ( #115253 )
...
* test(mantis): bound Telegram proof cleanup
* test(mantis): enforce cleanup deadline in wrapper
* test(mantis): supervise cleanup through bash
2026-07-28 11:44:28 -04:00
1695854877
fix(qa): isolate Mantis candidate execution ( #114465 )
...
* fix(qa): allow restricted Mantis worktree traversal
* fix(qa): pin Mantis harness checkout revision
* fix(qa): isolate Mantis candidate execution
* fix(qa): harden Mantis teardown
2026-07-27 12:11:34 -04:00
45bad50e26
fix(qa): harden Mantis Telegram proof harness ( #114429 )
...
* fix(qa): harden Mantis Telegram proof harness
* fix(qa): require explicit Mantis dispatch
2026-07-27 04:33:06 -04:00
1564c0719f
ci: pin exact action version comments ( #113386 )
2026-07-24 12:05:51 -07:00
71c5005d2c
fix(ci): run mantis codex proof on node 24 ( #100237 )
2026-07-16 18:33:51 -07:00
16c2bbb540
fix(mantis): bound Crabbox source checkout ( #108940 )
2026-07-16 07:49:07 -07:00
381cec0051
fix(ci): require live proof evidence artifacts
...
Require live Mantis and Telegram proof artifact uploads to fail when evidence is missing and guard the workflow invariant.
2026-06-23 12:43:09 +08:00
abb6f04e0c
ci(release): harden release controls
...
One-time maintainer-authorized bootstrap merge for the release-gate verifier policy. Exact hosted CI and all supporting workflow gates passed on 66133de419
2026-06-18 03:11:20 +08:00
f9f7475dbf
build(deps): bump actions/github-script from 8 to 9 ( #91368 )
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 8 to 9.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](https://github.com/actions/github-script/compare/v8...v9 )
---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-08 14:54:48 -07:00
662d366f01
chore(deps): bump the actions group across 1 directory with 4 updates ( #90601 )
...
Bumps the actions group with 4 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action ), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ), [docker/build-push-action](https://github.com/docker/build-push-action ) and [openai/codex-action](https://github.com/openai/codex-action ).
Updates `github/codeql-action` from 4 to 4.36.1
- [Release notes](https://github.com/github/codeql-action/releases )
- [Commits](https://github.com/github/codeql-action/compare/v4...v4.36.1 )
Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 )
Updates `docker/build-push-action` from 7.1.0 to 7.2.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/bcafcacb16a39f128d818304e6c9c0c18556b85f...f9f3042f7e2789586610d6e8b85c8f03e5195baf )
Updates `openai/codex-action` from 1.7 to 1.8
- [Changelog](https://github.com/openai/codex-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/openai/codex-action/compare/5c3f4ccdb2b8790f73d6b21751ac00e602aa0c02...e0fdf01220eb9a88167c4898839d273e3f2609d1 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.36.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: docker/setup-buildx-action
dependency-version: 4.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: docker/build-push-action
dependency-version: 7.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
- dependency-name: openai/codex-action
dependency-version: '1.8'
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-05 13:37:40 -07:00
4bd711e1c4
fix(security): avoid fetching untrusted proof refs
2026-05-28 12:39:12 +02:00
3844e035bb
fix(security): avoid CodeQL legacy auth patterns
2026-05-28 12:32:49 +02:00
b008989bef
fix(security): address OpenClaw CodeQL alerts
2026-05-28 11:34:32 +02:00
51d7f3c143
ci(mantis): route telegram proof runs to us-east-1
2026-05-28 10:10:32 +05:30
4fdf61753a
ci(mantis): pass crabbox capacity regions
2026-05-26 09:02:11 +05:30
cf275676f3
fix(mantis): release telegram user leases on startup failure
2026-05-25 23:34:35 +05:30
a0702e195d
build(pnpm): use packageManager as pnpm source
...
Recreated from #85108 because the original branch could not be updated by maintainers.
Preserves current-main pnpm install hardening while switching workflow pnpm setup to packageManager, and adds exact version-scoped release-age exclusions for already-locked packages that pnpm 11.2.2 audits during install.
Co-authored-by: Altay <altay@hey.com >
2026-05-22 19:17:43 +01:00
edcf862da5
fix(mantis): finish interrupted telegram proof sessions
2026-05-19 22:59:50 +05:30
f0a86450b1
fix(mantis): release interrupted telegram proof leases
2026-05-19 09:58:34 +05:30
1f794d2816
fix(mantis): skip zombie telegram queue runs
2026-05-19 08:45:31 +05:30
d75e16a1b9
fix(mantis): ignore stale telegram queue blockers
2026-05-19 08:32:26 +05:30
131577a4dc
fix(mantis): preserve telegram account queue
2026-05-19 08:15:52 +05:30
018a6db132
ci: use node24 artifact action tags
2026-05-18 10:45:59 +01:00
0f4eccefd4
ci: use node24 artifact actions
2026-05-18 10:39:31 +01:00
0dc04fb926
ci(mantis): allow ClawSweeper telegram proof agent ( #83243 )
2026-05-17 14:26:15 -05:00
0f1f9525f3
fix(ci): clear Mantis command reactions ( #83194 )
...
* fix(ci): clear mantis command reactions
* fix(ci): clear Mantis command reactions
---------
Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com>
2026-05-17 12:22:01 -05:00
59efd95669
ci(mantis): add telegram proof label trigger
2026-05-17 21:16:00 +05:30
df3f983d96
fix(ci): keep unauthorized Mantis commands neutral
2026-05-17 03:11:45 +08:00
b2d04646c1
ci(mantis): run telegram proof agent faster
2026-05-15 16:54:58 +05:30
f1b92c8885
fix(mantis): publish evidence to r2 ( #81845 )
...
* fix(mantis): publish evidence to r2
* ci(mantis): pass r2 artifact credentials
* ci(mantis): pin artifact bucket config
* fix(mantis): link raw evidence index
2026-05-15 16:23:53 +05:30
16cfc83643
ci(mantis): fix telegram run wait before checkout
2026-05-12 10:39:27 +05:30
9c16388177
ci(mantis): serialize telegram account proofs
2026-05-11 20:42:00 +05:30
663206aac4
ci(mantis): derive telegram proof refs from pr
2026-05-11 17:50:23 +05:30
d4c7519989
ci(mantis): allow fork telegram proof
2026-05-11 17:33:29 +05:30
becb6e8bbb
fix(mantis): route telegram proof through trusted harness
2026-05-11 15:02:36 +05:30
7d35f28b6c
chore(pnpm): align follow-up pnpm 11 surfaces
2026-05-11 10:13:49 +01:00
96d4dd68da
fix(mantis): validate telegram driver before lease
2026-05-11 14:19:36 +05:30
799bd8a23b
ci(mantis): fetch ffmpeg proof tools directly
2026-05-11 13:18:34 +05:30
1caf3ae674
ci(mantis): install static proof media tools
2026-05-11 13:11:16 +05:30
64cfb2be70
ci(mantis): avoid host apt in telegram proof
2026-05-11 13:02:04 +05:30
6729044966
ci(mantis): prepare telegram proof tooling
2026-05-11 12:47:46 +05:30
273e6503bb
ci(mantis): expose crabbox to proof agent
2026-05-11 11:39:44 +05:30
4a6349c68b
ci(mantis): preserve proof env for codex user
2026-05-11 11:26:49 +05:30
d246b3e2de
ci(mantis): preserve codex action home through sudo
2026-05-11 11:20:38 +05:30
ae90e36e7e
ci(mantis): grant codex workspace traversal
2026-05-11 11:14:17 +05:30
3dba0c683a
ci(mantis): use shared codex action home
2026-05-11 11:06:38 +05:30
c929376c4e
ci(mantis): let codex action create home
2026-05-11 11:03:16 +05:30
eb73486a94
ci(mantis): share codex action home
2026-05-11 10:57:29 +05:30
042e09612e
ci(mantis): run codex as unprivileged user
2026-05-11 10:50:56 +05:30
Peter Steinberger