Files
openclaw/scripts/release-tooling-identity.d.mts
Vincent Koc fa86caf94f fix(release): keep protected tooling trusted after main moves (#126881)
* fix(release): keep protected tooling trusted after main moves

* fix(release): cover protected tooling recovery paths

* fix(release): honor live tooling contracts

* fix(release): revalidate tooling at npm publish

* fix(release): bind npm publishers to live tooling

* fix(release): preserve trusted dispatch identity

* fix(release): revalidate parent authorization

* fix(release): bind ClawHub to release parent

* docs(release): define frozen tooling identity

* test(release): align ClawHub protected dispatch ref

* fix(release): trust protected plugin npm preflight tooling

* docs(release): scope protected writer guarantees

* fix(release): keep protected tooling foundation npm-only

* test(release): cover trusted npm preflight tooling
2026-08-21 07:24:31 +00:00

48 lines
1.4 KiB
TypeScript

export type ReleaseToolingIdentity = {
fullRef: string;
ref: string;
route: "main" | "prevalidated-branch" | "protected-tag";
sha: string;
};
export type ReleaseToolingIdentityInput = {
allowPrevalidatedRef?: boolean;
workflowFullRef: string;
workflowRef: string;
workflowSha: string;
};
export function resolveReleaseToolingIdentity(
input: {
requestedIdentityJson?: string;
workflowContract: string;
} & Pick<ReleaseToolingIdentityInput, "workflowFullRef" | "workflowRef" | "workflowSha">,
): Pick<ReleaseToolingIdentity, "fullRef" | "ref" | "sha">;
export function validateReleaseToolingIdentity(
input: ReleaseToolingIdentityInput & {
mainComparisonStatus?: unknown;
branchRef?: unknown;
tagRef?: unknown;
},
): ReleaseToolingIdentity;
export function verifyReleaseToolingIdentity(
input: ReleaseToolingIdentityInput & {
repository: string;
releasePublishParentStatePolicy?: "active" | "active-or-success" | "manual-recovery";
releasePublishRunAttempt?: string;
releasePublishRunId?: string;
runGh?: (args: string[]) => string;
},
): ReleaseToolingIdentity;
export function validateReleasePublishParentRun(input: {
identity: Pick<ReleaseToolingIdentity, "fullRef" | "ref" | "sha">;
releasePublishParentStatePolicy: "active" | "active-or-success" | "manual-recovery";
releasePublishRunAttempt: string;
releasePublishRunId: string;
repository: string;
run: unknown;
}): void;