f3a2f9f8a7
perf(ci): gate prompt-snapshot regeneration on the generator's blast radius ( #109083 )
...
check-prompt-snapshots costs 200-310s per PR regenerating real prompt
stacks, but snapshots only change when the generator's import graph or
its fixtures do. The manifest now computes that reach (same pattern as
QA smoke gating: always-run surface regex incl. the codex extension
whose test API loads via a dynamic module id, plus import-graph walk
from the snapshot helper; deletions and null diffs fail safe to
running). Unaffected PR diffs skip the lane with an explicit log line;
pushes and dispatches always run.
2026-07-16 08:06:06 -07:00
16c2bbb540
fix(mantis): bound Crabbox source checkout ( #108940 )
2026-07-16 07:49:07 -07:00
99826ebf85
fix(ci): install xcodegen via pinned release script in periphery scans
...
The arm64 Homebrew xcodegen bottle is corrupt on current runner images
(pour fails with 'Cellar/xcodegen/<ver> is not a directory'), and
reinstalling re-pours the same broken tarball. Use the repo's pinned,
checksummed scripts/install-xcodegen.sh like ci.yml already does.
2026-07-16 13:04:08 +01:00
977e0b64a1
fix(ci): survive corrupted xcodegen Cellar on macOS runners
...
Periphery scans fail org-wide when the runner image ships a broken
Cellar entry (pour errors with 'Cellar/xcodegen/<ver> is not a
directory'). Pre-clean the path and retry the install once.
2026-07-16 12:55:38 +01:00
037ef6695a
fix(ci): bound actionlint downloads ( #108938 )
2026-07-16 04:24:26 -07:00
06e3a09bd8
fix(ci): preserve advisory release checks
2026-07-16 11:56:01 +01:00
e0ffbd90d9
fix(ci): isolate bounded metadata retries ( #108804 )
...
* fix(ci): bound Mantis runner IP retries
* fix(e2e): isolate Windows metadata retries
* fix(ci): validate complete runner IPv4
Co-authored-by: Alix-007 <li.long15@xydigit.com >
---------
Co-authored-by: Alix-007 <li.long15@xydigit.com >
2026-07-16 03:39:31 -07:00
b6b8e59b9e
refactor(ci): share Android toolchain setup ( #108855 )
...
* refactor(ci): share Android toolchain setup
* fix(ci): preserve frozen Android targets
2026-07-16 03:38:31 -07:00
2c7cf8d745
perf(ci): scale Vitest workers with runner class and share serial module cache ( #108788 )
...
* perf(ci): scale Vitest workers with runner class and share serial module cache
Compact node-test jobs pinned OPENCLAW_VITEST_MAX_WORKERS=2 regardless of
runner size, so import-bound suites (30-45s of module-graph import per
file) crawled: runner-cli spent 284s on 5s of tests, commands-1 296s on
10s. With serial plans the budget now scales with the class (6 on 8vcpu,
3 on 4vcpu); timing-sensitive groups (tooling, tui-pty, infra-process)
stay pinned to 2 via plan-level env. Serial bins share one Vitest
fs-module-cache path so later plans reuse the first plan's transforms.
The import-bound commands stripes and security suite move to the 8vcpu
class, and packing hints refresh from serial-run measurements (run
29481835688).
* perf(ci): stripe cli-runner suite and pin media-ui worker budget
The agents-core config runs files serially (fileParallelism false guards
shared module state), so raising the worker budget cannot help its
import-heavy cli-runner suite (~35s module import per file, 213s serial).
Stripe it three ways so bins parallelize the imports instead. media-ui
hosts browser locator tests that timed out at 6 workers on the first
validation run; pin it to the proven 2-worker budget. commands-1's hint
drops to its measured 6-worker runtime.
2026-07-16 03:36:37 -07:00
de10d98c81
fix(e2e): bound OpenShell installer fetch ( #108810 )
2026-07-16 03:27:03 -07:00
76a236da5f
fix(ci): harden release validation gates ( #108798 )
...
* fix(ci): harden release validation gates
* fix(apns): keep tombstones in strict SQLite schema
* fix(ci): isolate PR publication transport
2026-07-16 03:21:08 -07:00
57ae43a89c
fix(ci): harden full release validation
2026-07-16 10:26:29 +01:00
47dd90c5ea
fix(ci): bound Android SDK downloads ( #108723 )
2026-07-16 02:12:07 -07:00
5cd9243465
fix(ci): bound Windows Testbox phone-home requests ( #108755 )
2026-07-16 01:57:53 -07:00
8a21f640e3
fix(ci): bound release resume tarball downloads ( #108766 )
2026-07-16 01:54:50 -07:00
ea3ac194f4
fix(ci): bound Mantis runner IP discovery ( #108699 )
2026-07-16 01:50:22 -07:00
0b7f4ccb72
fix(ci): bound Telegram QA OIDC requests ( #108701 )
2026-07-16 01:49:15 -07:00
f460c2871a
feat(linux): add signed auto-updater to the Tauri companion app ( #108770 )
...
Sparkle-parity self-update for the apps/linux companion: tauri-plugin-updater +
process, checked silently on launch and from a "Check for Updates" tray item /
manual trigger. AppImage installs download, verify the signed update, and wait
for a user-confirmed restart; package-managed (deb) installs get a release-page
notice instead of replacing files the system package manager owns. The
linux-app release workflow signs the AppImage and publishes a signed latest.json
manifest that the app verifies with the committed minisign public key.
2026-07-16 01:48:08 -07:00
cc58940993
fix(ci): bound Windows WSL rootfs downloads ( #108743 )
2026-07-16 01:47:37 -07:00
00ff4e8b84
fix(ci): bound OCM asset transfers ( #108700 )
2026-07-16 01:44:53 -07:00
e0394c2ab4
fix(ci): bound native tool downloads ( #108685 )
...
* fix(ci): bound native tool downloads
* fix(ci): bound historical SwiftFormat downloads
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-16 01:44:30 -07:00
a7d5386896
improve: speed up ring-zero QA smoke ( #108694 )
...
* ci: speed up ring-zero QA smoke
* ci: scope QA sticky cache to Docker lane
* ci: keep QA dependency setup on actions cache
* test: restore modern Docker QA proof
2026-07-16 01:12:40 -07:00
3912cf38b9
fix(ci): bound workflow ShellCheck download ( #108672 )
2026-07-16 00:56:27 -07:00
0960d07d8e
ci: gate PR edit automation by changed field ( #95010 )
...
* ci: gate PR edit automation by changed field
* ci: include title edits in ClawSweeper dispatch gate
* ci: refine PR edit automation gates
Co-authored-by: Sash Zats <sash@zats.io >
* test(ci): require boolean workflow matcher
Co-authored-by: Sash Zats <sash@zats.io >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-16 00:42:14 -07:00
98fc55ca96
fix(ci): bound performance gateway health probes ( #108621 )
2026-07-15 22:59:18 -07:00
a6125b7868
perf(ci): split QA smoke into four profile parts and time tsdown invocations ( #108638 )
2026-07-15 22:41:02 -07:00
401e7b003c
fix(release): support frozen pre-AI package targets ( #108479 )
2026-07-15 15:49:27 -07:00
6252f9b1f7
improve(ci): speed warm Node shards with sticky bind mount ( #108386 )
...
* perf(ci): bind sticky dependency disk into test shards
* chore(ci): restore workflow guard coverage
* perf(ci): skip pnpm install on exact sticky hits
* fix(ci): require stock layout for sticky dependencies
* perf(ci): bypass pnpm for test shard launches
* fix(ci): declare direct shard runner command
* fix(ci): bypass pnpm in warm shard builds
* fix(ci): invalidate sticky deps on pnpm config
* ci: document sticky failure guard
2026-07-15 15:41:24 -07:00
ca45a784f3
docs: align QA transport and release workflow contracts ( #108463 )
...
* docs: align QA transport workflow contracts
* docs: clarify Mantis env credentials
2026-07-15 14:51:37 -07:00
af71400c8e
refactor(qa): route live channel selectors through suite host ( #108429 )
...
* refactor(qa): route live channel selectors through suite host
* fix(qa): repair live selector CI
* fix(qa): remove retired runner exports
* fix(qa): remove obsolete live evidence
2026-07-15 13:35:34 -07:00
28d30e9dae
ci: stabilize release validation tests ( #108420 )
...
* test(codex): remove turn-watch timing race
* ci: pin workflow sanity shellcheck
* ci: run workflow sanity on blacksmith
* ci: serialize workflow sanity lint
* ci: bound workflow lint stalls
* ci: cap actionlint process fanout
* ci: report stalled workflow shellcheck
* ci: stabilize release validation checks
* ci: restore release workflow shellcheck
* test: preserve codex turn watch reset proof
2026-07-15 13:22:31 -07:00
8c77936e50
fix(release): propagate frozen-target guard and retry live timeouts ( #108418 )
...
* fix(release): preserve frozen package acceptance opt-in
* fix(release): retry transient live terminal timeouts
* fix(release): keep package dispatch input budget
* refactor(release): name frozen-target compatibility mode
* revert: keep frozen-target guard naming
2026-07-15 13:06:24 -07:00
77d07dc3e9
refactor(qa): migrate Telegram scenarios into QA Lab ( #108430 )
...
* refactor(qa): migrate Telegram scenarios into QA Lab
* refactor(qa): remove retired Telegram runner exports
2026-07-15 12:55:00 -07:00
e3296c0574
ci: restore workflow sanity and ClawHub shard ( #108437 )
...
* ci: stop actionlint from re-running shellcheck
* test: make ClawHub error-body checks retry-safe
2026-07-15 12:39:54 -07:00
d8b3e1c093
fix(release): compare evidence archive contents
2026-07-15 20:38:57 +01:00
23d2f664fb
fix(release): retain npm provenance evidence
2026-07-15 20:02:53 +01:00
f4f5bb15d4
fix(release): verify resumed npm publisher identity
2026-07-15 19:29:37 +01:00
ee51b35616
fix(release): support frozen Codex validation ( #108343 )
...
* fix(release): support frozen Codex validation
* fix(release): support frozen Codex validation
* fix(release): support frozen Codex validation
* fix(release): support frozen Codex validation
2026-07-15 10:05:02 -07:00
0f7fbfa003
fix(release): bind bootstrap publish workflow identity
2026-07-15 17:41:54 +01:00
4c667aac88
fix(release): harden frozen target validation ( #108296 )
...
* fix(release): harden frozen scenario planning
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(release): omit unsupported scenario-only lanes
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(release): fail closed on malformed target scenarios
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(release): report unsupported frozen lanes
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(release): defer frozen survivor inspection
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(release): report partial survivor omissions
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(ci): fetch shard fallback from workflow commit
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(release): gate frozen scenario omissions
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* test(release): auto-clean frozen target temp dirs
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
* fix(ci): satisfy frozen validation workflow lint
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
---------
Co-authored-by: Dallin Romney <dallinromney@gmail.com >
2026-07-15 06:31:07 -07:00
ed05dae2d8
fix(release): support frozen Matrix QA profiles ( #108279 )
2026-07-15 05:01:29 -07:00
043e4d1ec4
fix(release): validate frozen targets with current workflows ( #108189 )
...
* fix(release): support frozen validation targets
* fix(release): filter frozen-target upgrade scenarios
2026-07-15 04:28:17 -07:00
54f70c5d8c
fix(release): unblock plugin bootstrap recovery ( #108243 )
2026-07-15 03:34:08 -07:00
9c8a006d0c
perf(ci): gate QA smoke by smoke-visible changes and isolate the prompt snapshot lane ( #108202 )
...
* perf(ci): diff-gate QA smoke by CLI import graph and isolate prompt snapshots lane
* fix(ci): run prompt snapshot lane unconditionally
* fix(ci): treat QA lane orchestration files as QA-impacting
2026-07-15 02:51:19 -07:00
dfa246e6fd
fix(release): complete protected publish tooling
2026-07-15 10:43:00 +01:00
bb1a7e5069
fix(release): pin publish workflows to protected tags
2026-07-15 09:52:01 +01:00
9c0adbf93a
fix(ci): run spawn-timing tooling suites at plan concurrency 1 ( #108171 )
2026-07-15 01:51:52 -07:00
6c4e76ea8b
ci(qa): reuse Matrix live workflow for releases ( #103604 )
...
* ci(qa): reuse Matrix live workflow for releases
* docs(testing): restore Tailscale isolation flag
* fix(ci): make Matrix artifact names ref-safe
* test(ci): type Matrix workflow profiles
* style(testing): format Tailscale isolation guidance
2026-07-15 01:48:59 -07:00
57761ebe8c
perf(ci): balance node test shards and gate heavy CI lanes by changed scope ( #108091 )
2026-07-15 01:16:47 -07:00
732fb5f9e6
fix(release): bind Telegram proof artifact identity
2026-07-15 08:02:17 +01:00
Peter Steinberger