1f591bba56
fix(release): bound validation retries and soak
2026-08-10 22:31:32 +08:00
c70aee247e
refactor(scripts): migrate JavaScript tools to TypeScript ( #121005 )
...
* refactor(scripts): migrate JavaScript tools to TypeScript
* fix(ci): keep changed-scope preflight zero-install
* fix(ci): preserve zero-install script owners
* fix(ci): complete script migration follow-through
* fix(release): keep stable closeout zero-install
* fix(scripts): preserve standalone execution boundaries
* fix(scripts): repair standalone loader boundaries
* fix(scripts): normalize gateway observation ids
* fix(scripts): keep Docker packager standalone
* test(scripts): preserve rebase cleanup helpers
* test(sessions): use tracked temp directory
2026-08-09 07:21:35 -07:00
54c06674d4
fix(release): accept stale historical record counts ( #120738 )
2026-08-09 09:54:58 +08:00
d73eb23b29
fix(release): report seeded changelog provenance truthfully ( #119897 )
...
* fix(release): report seeded changelog provenance truthfully
* fix(release): reject legacy provenance formatting
* fix(release): enforce complete provenance records
2026-08-06 19:22:16 +08:00
7c70571683
chore(lint): clear 172 lint:all baseline violations in five batches ( #118098 )
...
* chore(lint): clean Android-Linux app assets batch
* chore(lint): clean setup-launcher-plugin batch
* chore(lint): clean changelog-updater batch
* chore(lint): clean QA-runtime-helper batch
* chore(lint): clean script-tests batch
* fix(mxc): await sandbox spawn before bridge selection
* fix(test): make fake plutil metacharacter escaping survive the template hop
2026-08-02 14:08:09 -07:00
6baf4dd15f
fix(release): validate candidates before Docker publication ( #117252 )
...
* fix(release): validate candidates before Docker publication
* fix(release): complete Docker publication gates
* fix(release): serialize Docker publication
2026-08-01 16:08:49 +08:00
c16c0dbef4
fix(release): allow macOS snapshot selection in candidate smoke ( #114144 )
2026-07-26 14:08:31 -04:00
f1538c6d6c
fix(release): validate complete package sets in candidate smoke ( #113600 )
...
* fix(release): pass only root dependencies to candidate smoke
* fix(release): stage plugin candidates for Parallels
* fix(release): bind plugin preflight package identity
* fix(test): stream upstream npm tarballs
* fix(test): retry post-update gateway startup
* fix(test): install fresh candidates through registry
* fix(test): route fresh candidates through registry
* test(release): update Parallels source contracts
* fix(test): split host and guest registry URLs
2026-07-25 07:59:06 -07:00
79d4e4a3ad
fix(release): accept complete core tarball manifests ( #112813 )
...
* fix(release): consume complete core tarball manifest
* fix(release): declare core tarball selector
2026-07-22 21:02:47 -04:00
26e7575780
fix(release): pin trusted candidate tooling across main advances
2026-07-18 23:33:42 +01:00
dffb136784
fix(release): keep beta performance advisory
2026-07-17 03:06:39 +01:00
9bd51e97fa
fix(release): run trusted tooling through symlink roots
2026-07-17 03:00:52 +01:00
732fb5f9e6
fix(release): bind Telegram proof artifact identity
2026-07-15 08:02:17 +01:00
ed49673307
fix(release): prepare trusted harness dependencies
2026-07-15 07:11:59 +01:00
34b8a3fda0
fix(release): isolate trusted candidate dependencies
2026-07-15 07:08:00 +01:00
c8733ea674
fix(release): run candidate smoke from trusted tooling
2026-07-15 06:56:04 +01:00
6c0725e0d9
fix(release): tolerate exhausted GitHub read quota
2026-07-15 05:21:30 +01:00
2372c71697
fix(release): preserve candidate Node runtime
2026-07-15 05:03:43 +01:00
e297bc2ac5
fix(release): validate npm preflight workflow trust
2026-07-14 18:44:08 +01:00
6a0eecdb44
fix(release): separate code and release SHA validation ( #105948 )
2026-07-13 13:38:19 +08:00
e0f45bfbf0
feat(tooling): enforce indexed access checks in root tests ( #105223 )
...
* feat(tooling): enforce indexed access checks in root tests
* style(tooling): clarify scoped package guard
2026-07-12 10:42:07 +01:00
c47ceb0f3d
improve(release): reuse exact-SHA validation evidence ( #104162 )
...
* perf(release): share changelog verification snapshots
* perf(release): reuse exact-SHA validation evidence
* feat(release): checkpoint candidate workflow state
* feat(release): watch CI transitions compactly
* fix(testbox): rotate stale reusable leases
* refactor(release): move CI verifier into scripts
* fix(release): preserve verifier executable mode
* fix(testbox): force noninteractive remote hydration
* perf(testbox): skip sync for proven clean heads
* fix(testbox): keep changed gates synchronized
* fix(testbox): isolate git state probes
* fix(testbox): isolate wrapper git commands
* fix(testbox): preserve git command contracts
* fix(release): validate reused SHA evidence
* fix(release): resume serialized plugin selections
* fix(testbox): sync source on every lease reuse
* fix(release): verify from trusted workflow checkout
* fix(release): gate evidence reuse on trusted lineage
* fix(release): support legacy verifier checkouts
* fix(testbox): export CI across shell snippets
* fix(release): revalidate reused evidence before publish
* fix(release): reject untrusted reuse before lookup
* fix(release): reuse SHA-pinned root evidence
* fix(ci): allow unreleased notes in QA packages
* fix(release): satisfy script lint contracts
* fix(release): handle Unicode workflow refs safely
2026-07-11 12:48:27 +08:00
54cc90b1b1
fix(release): publish ClawHub bootstrap artifacts immutably ( #103809 )
...
* fix(release): harden ClawHub bootstrap
* fix(release): centralize publication artifact verification
* fix(release): harden publication artifact verification
* fix(release): lock ClawHub bootstrap toolchain
* test(release): assert locked ClawHub binary
* fix(release): pack with trusted ClawHub harness
* fix(release): bound beta verifier artifact reads
* fix(release): bind target and tooling identities
* fix(release): stabilize signed package ordering
* fix(release): bind ClawHub pretag proof
* fix(release): bind ClawHub OIDC readback
* fix(release): bind ClawHub OIDC readback
2026-07-10 13:33:20 -07:00
fece8c9f54
fix(release): keep validation evidence immutable across reruns ( #103906 )
...
* fix(release): bind validation evidence to exact attempts
* test(release): cover exact validation attempts
2026-07-10 20:16:19 +01:00
336e43c314
fix(release): converge on the render-github-release-notes pipeline
...
Two competing release-notes pipelines existed: the release branch's
hardened render/verify/provenance pipeline (a486f3ab08dcee1da876#103222 ). Repo policy is one canonical path; the release-branch
pipeline wins and main's unique value is grafted in:
- scripts/render-github-release-notes.mjs becomes the canonical release
body renderer (full/compact 125k char+byte modes, tag-pinned record
link, verification tail, canonical shipped-baseline format), now also
preferring a correction tag's dedicated changelog section (from
prepare's heading matrix).
- verify-release-notes.mjs is a three-way merge: release's --shipped-ref
cumulative baselines, provenance checks, highlights gate, and the
excluded-record rewrite fix, plus main's compact contribution rows,
externalReferences threading, and both-heading parser compat.
- release-candidate-checklist.mjs gains validateCandidateCheckout and
changelog-provenance gates that run before any dispatch.
- openclaw-release-publish.yml keeps main's fail-before-mutation early
notes gate (retargeted to the renderer) and adopts release's
render/verify_release_tag_target/canonical_release_body_matches flow.
- scripts/prepare-github-release-notes.mjs and its test are deleted;
release-notes-ledger.test.ts stays and pins the merged verify exports.
- .gitignore tracks every repo skill for Git-aware syncs; SKILL.md
runbooks and RELEASING.md document the converged contract.
2026-07-10 02:06:52 -07:00
0535679083
fix(release): validate exact prepared npm package sets ( #102759 )
...
* fix(release): validate prepared npm package sets
Forward-port the beta3 package-set preflight, Telegram, and Parallels validation to main while preserving main's existing Bun install smoke. Recompute decoded proxy response lengths and require artifact tarballs to exactly match the verified manifest.
* fix(release): lock fixture registry proxy origin
2026-07-09 05:19:24 -07:00
c638f2beda
fix(release): reject duplicate candidate checklist options
2026-06-23 14:30:29 +02:00
023394000c
fix(release): reject malformed candidate API timeouts
2026-06-23 10:04:15 +02:00
7de3e0e0bb
fix(release): require exact candidate workflow runs
2026-06-20 10:24:59 +02:00
6c82a9fb18
fix(release): bound GitHub API body reads
2026-06-19 05:13:48 +02:00
abb6f04e0c
ci(release): harden release controls
...
One-time maintainer-authorized bootstrap merge for the release-gate verifier policy. Exact hosted CI and all supporting workflow gates passed on 66133de419
2026-06-18 03:11:20 +08:00
8ae1adfdcc
ci: gate stable releases on Windows companion assets ( #92555 )
...
* ci: gate stable releases on Windows companion assets
* fix(release): reject malformed Windows checksum manifests
* fix(release): make Windows recovery fail closed
* fix(release): tighten Windows asset identity checks
* fix(release): validate prepared candidate tarballs
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-06-13 19:33:33 -07:00
58c663920d
docs: document script tests
2026-06-04 20:49:50 -04:00
ed4c4afc0f
fix(release): bound candidate GitHub requests
2026-06-03 08:19:03 +02:00
cbd8049b9f
fix(scripts): parse forwarded package script options
2026-05-30 17:44:14 +02:00
53e8dc6a54
fix(scripts): stop parsing after option terminators
2026-05-30 17:10:36 +02:00
cb765f1664
ci(release): require all plugins for core publish
2026-05-29 12:07:03 +01:00
1ceebf8a01
ci: harden release publish evidence
2026-05-17 06:34:58 +01:00
c4d8e0be18
ci: harden release validation flow
2026-05-17 06:34:58 +01:00
d61051558b
ci(release): harden candidate workflow dispatch lookup
2026-05-15 15:10:34 +01:00
c91e20ac0c
ci(release): add candidate evidence checklist
2026-05-15 14:54:46 +01:00
Vincent Koc