mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-12 21:53:00 -06:00
Peter Steinberger
fada067277
* feat(browser): add zero-click extension bootstrap Pre-register deterministic path-derived extension IDs and install a strict native messaging host. Keep the popup and options UI minimal while removing the obsolete copilot and page-share flows. * fix(browser): satisfy native bootstrap CI guards * test(browser): isolate native bootstrap Chrome roots * test(browser): flush native bootstrap profile before status * test(browser): seed Linux native bootstrap identity * fix(browser): preserve native bootstrap upgrade safety Allow immutable root-owned package inputs while keeping mutable state, manifests, and launchers user-owned. Preserve all retired copilot keys whenever active or unrecognized recovery custody remains. * fix(browser): preserve pending copilot custody Retired cleanup now removes copilot state only when the durable registry is exactly empty. Any session, archive, malformed value, future shape, or read failure preserves every retired key. * fix(browser): guard native bootstrap upgrades Fail closed while retired copilot custody remains and make discard durable across partial failures. Require exact launcher-embedded origins and repair full launcher drift without accepting mismatched registrations. * fix(browser): remove stale layout export * chore(release): leave changelog to release flow
3832 lines
187 KiB
YAML
3832 lines
187 KiB
YAML
name: CI
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
target_ref:
|
|
description: Optional branch, tag, or full commit SHA to validate instead of the workflow ref
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
include_android:
|
|
description: Run Android lanes for this manual CI dispatch.
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
release_gate:
|
|
description: Run an exact-SHA maintainer release-gate fallback when PR CI is capacity-stalled.
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
pull_request_number:
|
|
description: Pull request number required by the exact-SHA release gate.
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
dispatch_id:
|
|
description: Optional parent workflow dispatch identifier
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
historical_target_tag:
|
|
description: Semver release tag authorizing compatibility fallbacks for its exact commit
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
release_candidate_ref:
|
|
description: Canonical release branch authorizing compatibility fallbacks for its exact head
|
|
required: false
|
|
default: ""
|
|
type: string
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- "**/*.md"
|
|
- "docs/**"
|
|
pull_request:
|
|
types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
run-name: ${{ github.event_name == 'workflow_dispatch' && inputs.dispatch_id != '' && format('CI {0}', inputs.dispatch_id) || (github.event_name == 'workflow_dispatch' && inputs.release_gate && format('CI release gate {0}', inputs.target_ref) || 'CI') }}
|
|
|
|
concurrency:
|
|
group: ${{ github.event_name == 'workflow_dispatch' && format('{0}-manual-v1-{1}', github.workflow, github.run_id) || (github.event_name == 'pull_request' && format('{0}-v7-{1}', github.workflow, github.event.pull_request.number) || (github.repository == 'openclaw/openclaw' && format('{0}-v7-{1}', github.workflow, github.ref) || format('{0}-v7-{1}-{2}', github.workflow, github.ref, github.sha))) }}
|
|
# PRs want newest-head feedback. Canonical main instead runs one complete
|
|
# integration cycle while GitHub's single pending slot coalesces later pushes.
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
|
|
NODE_VERSION: "24.x"
|
|
|
|
jobs:
|
|
# Preflight: establish routing truth and job matrices once, then let real
|
|
# work fan out from a single source of truth.
|
|
preflight:
|
|
permissions:
|
|
contents: read
|
|
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
outputs:
|
|
checkout_revision: ${{ steps.checkout_ref.outputs.sha }}
|
|
diff_base_revision: ${{ steps.diff_base.outputs.sha }}
|
|
docs_only: ${{ steps.manifest.outputs.docs_only }}
|
|
docs_changed: ${{ steps.manifest.outputs.docs_changed }}
|
|
run_node: ${{ steps.manifest.outputs.run_node }}
|
|
run_macos: ${{ steps.manifest.outputs.run_macos }}
|
|
run_android: ${{ steps.manifest.outputs.run_android }}
|
|
run_skills_python: ${{ steps.manifest.outputs.run_skills_python }}
|
|
run_skills_python_job: ${{ steps.manifest.outputs.run_skills_python_job }}
|
|
run_windows: ${{ steps.manifest.outputs.run_windows }}
|
|
run_build_artifacts: ${{ steps.manifest.outputs.run_build_artifacts }}
|
|
run_checks_fast_core: ${{ steps.manifest.outputs.run_checks_fast_core }}
|
|
run_checks_fast: ${{ steps.manifest.outputs.run_checks_fast }}
|
|
historical_target: ${{ steps.manifest.outputs.historical_target }}
|
|
frozen_target: ${{ steps.manifest.outputs.frozen_target }}
|
|
run_qa_smoke_ci: ${{ steps.manifest.outputs.run_qa_smoke_ci }}
|
|
run_prompt_snapshots: ${{ steps.manifest.outputs.run_prompt_snapshots }}
|
|
checks_fast_core_matrix: ${{ steps.manifest.outputs.checks_fast_core_matrix }}
|
|
run_plugin_contracts_shards: ${{ steps.manifest.outputs.run_plugin_contracts_shards }}
|
|
plugin_contracts_matrix: ${{ steps.manifest.outputs.plugin_contracts_matrix }}
|
|
run_channel_contracts_shards: ${{ steps.manifest.outputs.run_channel_contracts_shards }}
|
|
channel_contracts_matrix: ${{ steps.manifest.outputs.channel_contracts_matrix }}
|
|
run_checks: ${{ steps.manifest.outputs.run_checks }}
|
|
run_checks_node_core_nondist: ${{ steps.manifest.outputs.run_checks_node_core_nondist }}
|
|
checks_node_core_nondist_matrix: ${{ steps.manifest.outputs.checks_node_core_nondist_matrix }}
|
|
run_checks_node_core_dist: ${{ steps.manifest.outputs.run_checks_node_core_dist }}
|
|
run_check: ${{ steps.manifest.outputs.run_check }}
|
|
run_check_additional: ${{ steps.manifest.outputs.run_check_additional }}
|
|
run_check_docs: ${{ steps.manifest.outputs.run_check_docs }}
|
|
run_format_check: ${{ steps.manifest.outputs.run_format_check }}
|
|
compatibility_target: ${{ steps.manifest.outputs.compatibility_target }}
|
|
run_control_ui_i18n: ${{ steps.manifest.outputs.run_control_ui_i18n }}
|
|
strict_control_ui_i18n: ${{ steps.changed_scope.outputs.strict_control_ui_i18n }}
|
|
run_ui_tests: ${{ steps.manifest.outputs.run_ui_tests }}
|
|
run_native_i18n: ${{ steps.manifest.outputs.run_native_i18n }}
|
|
strict_native_i18n: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.strict_native_i18n }}
|
|
run_checks_windows: ${{ steps.manifest.outputs.run_checks_windows }}
|
|
checks_windows_matrix: ${{ steps.manifest.outputs.checks_windows_matrix }}
|
|
run_macos_node: ${{ steps.manifest.outputs.run_macos_node }}
|
|
macos_node_matrix: ${{ steps.manifest.outputs.macos_node_matrix }}
|
|
run_macos_swift: ${{ steps.manifest.outputs.run_macos_swift }}
|
|
run_openclawkit_tests: ${{ steps.manifest.outputs.run_openclawkit_tests }}
|
|
run_ios_build: ${{ steps.manifest.outputs.run_ios_build }}
|
|
run_android_job: ${{ steps.manifest.outputs.run_android_job }}
|
|
use_compatible_android_ci: ${{ steps.manifest.outputs.use_compatible_android_ci }}
|
|
run_protocol_event_coverage: ${{ steps.manifest.outputs.run_protocol_event_coverage }}
|
|
android_matrix: ${{ steps.manifest.outputs.android_matrix }}
|
|
steps:
|
|
- name: Validate release-gate dispatch
|
|
if: github.event_name == 'workflow_dispatch' && inputs.release_gate
|
|
env:
|
|
HISTORICAL_TARGET_TAG: ${{ inputs.historical_target_tag }}
|
|
PULL_REQUEST_NUMBER: ${{ inputs.pull_request_number }}
|
|
TARGET_REF: ${{ inputs.target_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [[ ! "$TARGET_REF" =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo "release_gate requires target_ref to be a full commit SHA" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! "$PULL_REQUEST_NUMBER" =~ ^[1-9][0-9]*$ ]]; then
|
|
echo "release_gate requires pull_request_number" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$GITHUB_SHA" != "$TARGET_REF" ]]; then
|
|
echo "release_gate must run from the branch at target_ref" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -n "$HISTORICAL_TARGET_TAG" ]]; then
|
|
echo "release_gate cannot be combined with historical_target_tag" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout
|
|
env:
|
|
CHECKOUT_REPO: ${{ github.repository }}
|
|
CHECKOUT_REF: ${{ inputs.target_ref || github.sha }}
|
|
CHECKOUT_EVENT_REF: ${{ github.ref }}
|
|
CHECKOUT_FALLBACK_REF: ${{ github.sha }}
|
|
GITHUB_EVENT_NAME: ${{ github.event_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
git init "$GITHUB_WORKSPACE"
|
|
git -C "$GITHUB_WORKSPACE" config gc.auto 0
|
|
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
|
|
fetch_checkout_ref() {
|
|
local ref="$1"
|
|
local fetch_status
|
|
for attempt in 1 2 3; do
|
|
timeout --signal=TERM --kill-after=10s 120s git -C "$GITHUB_WORKSPACE" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
|
|
"+${ref}:refs/remotes/origin/checkout" && return 0
|
|
fetch_status="$?"
|
|
if [ "$fetch_status" != "124" ] && [ "$fetch_status" != "137" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
if [ "$attempt" = "3" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
echo "::warning::checkout fetch for '$ref' timed out on attempt $attempt; retrying"
|
|
sleep 5
|
|
done
|
|
}
|
|
|
|
# Diff-base resolution needs the head's parent commits and trees
|
|
# (merge-head-diff-base.mjs and the name-only diffs), but not the
|
|
# parents' blobs. Fetching them blob-less keeps preflight several
|
|
# times faster than a full --depth=2 snapshot fetch.
|
|
fetch_parent_metadata() {
|
|
local sha="$1"
|
|
for attempt in 1 2 3; do
|
|
timeout --signal=TERM --kill-after=10s 120s git -C "$GITHUB_WORKSPACE" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=2 \
|
|
--filter=blob:none origin "$sha" && return 0
|
|
if [ "$attempt" = "3" ]; then
|
|
return 1
|
|
fi
|
|
echo "::warning::parent metadata fetch for '$sha' failed on attempt $attempt; retrying"
|
|
sleep 5
|
|
done
|
|
}
|
|
|
|
# Manual release-gate runs commonly validate the workflow ref's exact SHA.
|
|
# Fetch the branch/tag ref first, then refetch the SHA if that ref moves
|
|
# while the manual run waits for a runner.
|
|
checkout_ref="$CHECKOUT_REF"
|
|
requested_sha=""
|
|
if [[ "$CHECKOUT_REF" =~ ^[0-9a-f]{40}$ ]]; then
|
|
requested_sha="$CHECKOUT_REF"
|
|
if [[
|
|
"$GITHUB_EVENT_NAME" == "workflow_dispatch" &&
|
|
"$CHECKOUT_REF" == "$CHECKOUT_FALLBACK_REF" &&
|
|
-n "$CHECKOUT_EVENT_REF"
|
|
]]; then
|
|
checkout_ref="$CHECKOUT_EVENT_REF"
|
|
fi
|
|
fi
|
|
|
|
if fetch_checkout_ref "$checkout_ref"; then
|
|
:
|
|
else
|
|
fetch_status="$?"
|
|
if [ "$fetch_status" = "124" ] || [ "$fetch_status" = "137" ]; then
|
|
echo "::error::checkout fetch for '$checkout_ref' timed out"
|
|
exit "$fetch_status"
|
|
fi
|
|
if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then
|
|
exit "$fetch_status"
|
|
fi
|
|
echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"
|
|
fetch_checkout_ref "$CHECKOUT_FALLBACK_REF"
|
|
fi
|
|
|
|
if [ -n "$requested_sha" ]; then
|
|
resolved_sha="$(git -C "$GITHUB_WORKSPACE" rev-parse refs/remotes/origin/checkout)"
|
|
if [ "$resolved_sha" != "$requested_sha" ] && [ "$checkout_ref" != "$requested_sha" ]; then
|
|
echo "::notice::checkout ref '$checkout_ref' moved to '$resolved_sha'; fetching requested SHA '$requested_sha'"
|
|
checkout_ref="$requested_sha"
|
|
fetch_checkout_ref "$checkout_ref"
|
|
resolved_sha="$(git -C "$GITHUB_WORKSPACE" rev-parse refs/remotes/origin/checkout)"
|
|
fi
|
|
if [ "$resolved_sha" != "$requested_sha" ]; then
|
|
echo "::error::checkout ref '$checkout_ref' resolved to '$resolved_sha'," \
|
|
"expected '$requested_sha'" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
fetch_parent_metadata "$(git -C "$GITHUB_WORKSPACE" rev-parse refs/remotes/origin/checkout)"
|
|
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
|
|
|
|
- name: Resolve checkout SHA
|
|
id: checkout_ref
|
|
run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Resolve exact diff base
|
|
id: diff_base
|
|
env:
|
|
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
|
|
EVENT_BASE_SHA: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha || '' }}
|
|
GH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && !inputs.release_gate && github.token || '' }}
|
|
PULL_REQUEST_NUMBER: ${{ inputs.pull_request_number }}
|
|
RELEASE_GATE: ${{ inputs.release_gate }}
|
|
run: |
|
|
set -euo pipefail
|
|
base_sha="$EVENT_BASE_SHA"
|
|
head_sha="$(git rev-parse HEAD)"
|
|
if [ "$GITHUB_EVENT_NAME" = "push" ] && [[ "$base_sha" =~ ^0+$ ]]; then
|
|
echo "::error title=ambiguous main push::github.event.before is zero; refusing to infer a diff base for a created or recreated main branch." >&2
|
|
exit 1
|
|
fi
|
|
if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
|
|
# A long-lived PR event can retain an old base SHA. The tested merge
|
|
# commit's first parent is the exact target tree for this run.
|
|
base_sha="$(node scripts/lib/merge-head-diff-base.mjs \
|
|
--base "$base_sha" --head HEAD --prefer-first-parent)"
|
|
fi
|
|
if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] && [ "$RELEASE_GATE" != "true" ]; then
|
|
default_sha="$(git ls-remote origin "refs/heads/${DEFAULT_BRANCH}" | awk 'NR == 1 { print $1}')"
|
|
if [[ ! "$default_sha" =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo "Could not resolve the default branch head for the manual target." >&2
|
|
exit 1
|
|
fi
|
|
base_sha="$(
|
|
gh api --method GET \
|
|
"repos/${GITHUB_REPOSITORY}/compare/${default_sha}...${head_sha}" \
|
|
--jq '.merge_base_commit.sha'
|
|
)"
|
|
fi
|
|
if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] && [ "$RELEASE_GATE" = "true" ]; then
|
|
merge_ref="refs/remotes/origin/release-gate-merge"
|
|
timeout --signal=TERM --kill-after=10s 120s git fetch \
|
|
--no-tags --no-recurse-submodules --depth=2 origin \
|
|
"+refs/pull/${PULL_REQUEST_NUMBER}/merge:${merge_ref}"
|
|
release_gate_head="$(git rev-parse "${merge_ref}^2")"
|
|
target_head="$(git rev-parse HEAD)"
|
|
if [ "$release_gate_head" != "$target_head" ]; then
|
|
echo "release_gate pull request head ${release_gate_head} does not match target ${target_head}" >&2
|
|
exit 1
|
|
fi
|
|
base_sha="$(git rev-parse "${merge_ref}^1")"
|
|
head_sha="$(git rev-parse "$merge_ref")"
|
|
fi
|
|
if [[ ! "$base_sha" =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo "Could not resolve an exact diff base for ${GITHUB_EVENT_NAME}." >&2
|
|
exit 1
|
|
fi
|
|
echo "sha=$base_sha" >> "$GITHUB_OUTPUT"
|
|
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Validate historical release target
|
|
id: historical_target
|
|
if: inputs.historical_target_tag != ''
|
|
env:
|
|
EXPECTED_SHA: ${{ steps.checkout_ref.outputs.sha }}
|
|
HISTORICAL_TARGET_TAG: ${{ inputs.historical_target_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "$HISTORICAL_TARGET_TAG" =~ ^v[0-9]{4}\.[0-9]+\.[0-9]+(-(alpha|beta)\.[0-9]+)?$ ]]; then
|
|
echo "historical_target_tag must be a canonical OpenClaw release tag." >&2
|
|
exit 1
|
|
fi
|
|
tag_ref="refs/tags/${HISTORICAL_TARGET_TAG}"
|
|
remote="$(git remote get-url origin)"
|
|
tag_sha="$(git ls-remote --tags "$remote" "${tag_ref}^{}" | awk 'NR == 1 { print $1 }')"
|
|
if [[ -z "$tag_sha" ]]; then
|
|
tag_sha="$(git ls-remote --tags "$remote" "$tag_ref" | awk 'NR == 1 { print $1 }')"
|
|
fi
|
|
if [[ "$tag_sha" != "$EXPECTED_SHA" ]]; then
|
|
echo "Historical release tag ${HISTORICAL_TARGET_TAG} does not resolve to ${EXPECTED_SHA}." >&2
|
|
exit 1
|
|
fi
|
|
echo "eligible=true" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Validate release candidate target
|
|
id: release_candidate_target
|
|
if: inputs.release_candidate_ref != ''
|
|
env:
|
|
EXPECTED_SHA: ${{ steps.checkout_ref.outputs.sha }}
|
|
RELEASE_CANDIDATE_REF: ${{ inputs.release_candidate_ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! "$RELEASE_CANDIDATE_REF" =~ ^(release/[0-9]{4}\.[0-9]+\.[0-9]+|extended-stable/[0-9]{4}\.[0-9]+\.33)$ ]]; then
|
|
echo "release_candidate_ref must be a canonical OpenClaw release branch." >&2
|
|
exit 1
|
|
fi
|
|
remote="$(git remote get-url origin)"
|
|
branch_sha="$(git ls-remote --heads "$remote" "refs/heads/${RELEASE_CANDIDATE_REF}" | awk 'NR == 1 { print $1 }')"
|
|
if [[ "$branch_sha" != "$EXPECTED_SHA" ]]; then
|
|
echo "Release candidate branch ${RELEASE_CANDIDATE_REF} does not resolve to ${EXPECTED_SHA}." >&2
|
|
exit 1
|
|
fi
|
|
echo "eligible=true" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Ensure preflight base commit
|
|
if: github.event_name != 'workflow_dispatch'
|
|
uses: ./.github/actions/ensure-base-commit
|
|
with:
|
|
base-sha: ${{ steps.diff_base.outputs.sha }}
|
|
fetch-ref: ${{ github.event_name == 'push' && github.ref_name || github.event.pull_request.base.ref }}
|
|
|
|
- name: Detect docs-only changes
|
|
id: docs_scope
|
|
if: github.event_name != 'workflow_dispatch'
|
|
uses: ./.github/actions/detect-docs-changes
|
|
with:
|
|
base-sha: ${{ steps.diff_base.outputs.sha }}
|
|
|
|
- name: Detect changed scopes
|
|
id: changed_scope
|
|
if: (github.event_name != 'workflow_dispatch' && steps.docs_scope.outputs.docs_only != 'true') || (github.event_name == 'workflow_dispatch' && inputs.release_gate)
|
|
shell: bash
|
|
env:
|
|
OPENCLAW_ALLOW_RELEASE_GENERATED_MIX: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [ "${{ github.event_name }}" = "push" ]; then
|
|
BASE="${{ steps.diff_base.outputs.sha }}"
|
|
node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD
|
|
elif [ "${{ github.event_name }}" = "pull_request" ]; then
|
|
BASE="${{ steps.diff_base.outputs.sha }}"
|
|
node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD --merge-head-first-parent
|
|
else
|
|
BASE="${{ steps.diff_base.outputs.sha }}"
|
|
HEAD_SHA="${{ steps.diff_base.outputs.head_sha }}"
|
|
node scripts/ci-changed-scope.mjs --base "$BASE" --head "$HEAD_SHA"
|
|
fi
|
|
|
|
- name: Setup manifest TypeScript runtime
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
|
|
- name: Setup manifest pnpm
|
|
uses: ./.github/actions/setup-pnpm-store-cache
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
|
|
- name: Install manifest dependencies
|
|
run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts
|
|
|
|
- name: Build CI manifest
|
|
id: manifest
|
|
env:
|
|
OPENCLAW_CI_DOCS_ONLY: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.docs_scope.outputs.docs_only }}
|
|
OPENCLAW_CI_DOCS_CHANGED: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.docs_scope.outputs.docs_changed }}
|
|
OPENCLAW_CI_RUN_NODE: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_node || 'false' }}
|
|
OPENCLAW_CI_RUN_MACOS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_macos || 'false' }}
|
|
OPENCLAW_CI_RUN_IOS_BUILD: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_ios_build || 'false' }}
|
|
OPENCLAW_CI_RUN_ANDROID: ${{ github.event_name == 'workflow_dispatch' && (inputs.release_gate || inputs.include_android) && 'true' || steps.changed_scope.outputs.run_android || 'false' }}
|
|
OPENCLAW_CI_RUN_WINDOWS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_windows || 'false' }}
|
|
OPENCLAW_CI_RUN_NODE_FAST_ONLY: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_only || 'false' }}
|
|
OPENCLAW_CI_RUN_NODE_FAST_PLUGIN_CONTRACTS: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_plugin_contracts || 'false' }}
|
|
OPENCLAW_CI_RUN_NODE_FAST_CI_ROUTING: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_ci_routing || 'false' }}
|
|
OPENCLAW_CI_RUN_SKILLS_PYTHON: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_skills_python || 'false' }}
|
|
OPENCLAW_CI_RUN_CONTROL_UI_I18N: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_control_ui_i18n || 'false' }}
|
|
OPENCLAW_CI_RUN_UI_TESTS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_ui_tests || 'false' }}
|
|
OPENCLAW_CI_RUN_NATIVE_I18N: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_native_i18n || 'false' }}
|
|
OPENCLAW_CI_CHANGED_PATHS_JSON: ${{ steps.changed_scope.outputs.changed_paths_json || 'null' }}
|
|
OPENCLAW_CI_CHECKOUT_REVISION: ${{ steps.checkout_ref.outputs.sha }}
|
|
OPENCLAW_CI_HISTORICAL_TARGET: ${{ steps.historical_target.outputs.eligible || 'false' }}
|
|
OPENCLAW_CI_RELEASE_CANDIDATE_TARGET: ${{ steps.release_candidate_target.outputs.eligible || 'false' }}
|
|
OPENCLAW_CI_WORKFLOW_REVISION: ${{ github.sha }}
|
|
OPENCLAW_CI_REPOSITORY: ${{ github.repository }}
|
|
OPENCLAW_CI_EVENT_NAME: ${{ github.event_name }}
|
|
run: |
|
|
node --import tsx --input-type=module <<'EOF'
|
|
import { appendFileSync, existsSync, readFileSync } from "node:fs";
|
|
|
|
const eventName = process.env.OPENCLAW_CI_EVENT_NAME ?? "";
|
|
const checkoutRevision = process.env.OPENCLAW_CI_CHECKOUT_REVISION ?? "";
|
|
const workflowRevision = process.env.OPENCLAW_CI_WORKFLOW_REVISION ?? "";
|
|
const historicalTargetApproved = process.env.OPENCLAW_CI_HISTORICAL_TARGET === "true";
|
|
const historicalTarget =
|
|
eventName === "workflow_dispatch" &&
|
|
historicalTargetApproved &&
|
|
checkoutRevision !== workflowRevision;
|
|
const releaseCandidateTarget =
|
|
eventName === "workflow_dispatch" &&
|
|
process.env.OPENCLAW_CI_RELEASE_CANDIDATE_TARGET === "true" &&
|
|
checkoutRevision !== workflowRevision;
|
|
const compatibilityTarget = historicalTarget || releaseCandidateTarget;
|
|
const frozenTarget =
|
|
eventName === "workflow_dispatch" && checkoutRevision !== workflowRevision;
|
|
|
|
const nodeTestPlanPath = existsSync("./scripts/lib/ci-node-test-plan.mts")
|
|
? "./scripts/lib/ci-node-test-plan.mts"
|
|
: "./scripts/lib/ci-node-test-plan.mjs";
|
|
const nodeTestPlan = await import(nodeTestPlanPath);
|
|
const createNodeTestPlan =
|
|
typeof nodeTestPlan.createNodeTestShardBundles === "function"
|
|
? nodeTestPlan.createNodeTestShardBundles
|
|
: compatibilityTarget
|
|
? nodeTestPlan.createNodeTestShards
|
|
: undefined;
|
|
if (typeof createNodeTestPlan !== "function") {
|
|
throw new Error("CI target does not export a supported Node test shard planner");
|
|
}
|
|
|
|
let changedNodeTestPlan = {};
|
|
const changedNodeTestPlanPath = existsSync(
|
|
"./scripts/lib/ci-changed-node-test-plan.mts",
|
|
)
|
|
? "./scripts/lib/ci-changed-node-test-plan.mts"
|
|
: "./scripts/lib/ci-changed-node-test-plan.mjs";
|
|
if (existsSync(changedNodeTestPlanPath)) {
|
|
try {
|
|
changedNodeTestPlan = await import(changedNodeTestPlanPath);
|
|
} catch (error) {
|
|
console.warn(`Changed Node test planner import failed; using compact full suite: ${error}`);
|
|
}
|
|
}
|
|
|
|
const importTargetPlan = async (path) => {
|
|
if (existsSync(path)) {
|
|
return import(path);
|
|
}
|
|
if (!compatibilityTarget) {
|
|
throw new Error(`Current CI target does not provide ${path}`);
|
|
}
|
|
return {};
|
|
};
|
|
const channelContractPlan = await importTargetPlan(
|
|
existsSync("./scripts/lib/channel-contract-test-plan.mts")
|
|
? "./scripts/lib/channel-contract-test-plan.mts"
|
|
: "./scripts/lib/channel-contract-test-plan.mjs",
|
|
);
|
|
const createChannelContractTestShards =
|
|
typeof channelContractPlan.createChannelContractTestShards === "function"
|
|
? channelContractPlan.createChannelContractTestShards
|
|
: () => [];
|
|
|
|
const parseBoolean = (value, fallback = false) => {
|
|
if (value === undefined) return fallback;
|
|
const normalized = value.trim().toLowerCase();
|
|
if (normalized === "true" || normalized === "1") return true;
|
|
if (normalized === "false" || normalized === "0" || normalized === "") return false;
|
|
return fallback;
|
|
};
|
|
|
|
const pluginContractPlan = await importTargetPlan(
|
|
existsSync("./scripts/lib/plugin-contract-test-plan.mts")
|
|
? "./scripts/lib/plugin-contract-test-plan.mts"
|
|
: "./scripts/lib/plugin-contract-test-plan.mjs",
|
|
);
|
|
const createPluginContractTestShards =
|
|
typeof pluginContractPlan.createPluginContractTestShards === "function"
|
|
? pluginContractPlan.createPluginContractTestShards
|
|
: () => [
|
|
{
|
|
checkName: "checks-fast-contracts-plugins-legacy",
|
|
includePatterns: ["src/plugins/contracts/**/*.test.ts"],
|
|
runtime: "node",
|
|
task: "contracts-plugins",
|
|
},
|
|
];
|
|
const createMatrix = (include) => ({ include });
|
|
const outputPath = process.env.GITHUB_OUTPUT;
|
|
const packageScripts = JSON.parse(readFileSync("package.json", "utf8")).scripts ?? {};
|
|
const hasPackageScript = (name) => typeof packageScripts[name] === "string";
|
|
const isCanonicalRepository = process.env.OPENCLAW_CI_REPOSITORY === "openclaw/openclaw";
|
|
const changedPaths = (() => {
|
|
try {
|
|
const value = JSON.parse(process.env.OPENCLAW_CI_CHANGED_PATHS_JSON ?? "null");
|
|
return Array.isArray(value) && value.every((path) => typeof path === "string")
|
|
? value
|
|
: null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
})();
|
|
const docsOnly = parseBoolean(process.env.OPENCLAW_CI_DOCS_ONLY);
|
|
const docsChanged = parseBoolean(process.env.OPENCLAW_CI_DOCS_CHANGED);
|
|
const runNode = parseBoolean(process.env.OPENCLAW_CI_RUN_NODE) && !docsOnly;
|
|
const runNodeFastOnly =
|
|
runNode && parseBoolean(process.env.OPENCLAW_CI_RUN_NODE_FAST_ONLY);
|
|
const runNodeFull = runNode && !runNodeFastOnly;
|
|
const runNodeFastPluginContracts =
|
|
runNode && parseBoolean(process.env.OPENCLAW_CI_RUN_NODE_FAST_PLUGIN_CONTRACTS);
|
|
const runNodeFastCiRouting =
|
|
runNode && parseBoolean(process.env.OPENCLAW_CI_RUN_NODE_FAST_CI_ROUTING);
|
|
const runPluginContractShards = runNodeFull || runNodeFastPluginContracts;
|
|
const runMacos =
|
|
parseBoolean(process.env.OPENCLAW_CI_RUN_MACOS) && !docsOnly && isCanonicalRepository;
|
|
const supportsCurrentMacosSwiftCi =
|
|
existsSync("scripts/install-swift-tools.sh") &&
|
|
existsSync("scripts/lint-swift.sh") &&
|
|
existsSync("scripts/format-swift.sh");
|
|
const supportsIosBuild = hasPackageScript("ios:build");
|
|
const supportsCurrentIosCi = supportsIosBuild && supportsCurrentMacosSwiftCi;
|
|
const runIosBuild =
|
|
parseBoolean(process.env.OPENCLAW_CI_RUN_IOS_BUILD) &&
|
|
!docsOnly &&
|
|
isCanonicalRepository &&
|
|
(!frozenTarget ||
|
|
supportsCurrentIosCi ||
|
|
(releaseCandidateTarget && supportsIosBuild));
|
|
const runAndroid =
|
|
parseBoolean(process.env.OPENCLAW_CI_RUN_ANDROID) && !docsOnly && isCanonicalRepository;
|
|
const runWindows =
|
|
parseBoolean(process.env.OPENCLAW_CI_RUN_WINDOWS) &&
|
|
!docsOnly &&
|
|
!runNodeFastOnly &&
|
|
isCanonicalRepository;
|
|
const runSkillsPython = parseBoolean(process.env.OPENCLAW_CI_RUN_SKILLS_PYTHON) && !docsOnly;
|
|
const runControlUiI18n =
|
|
parseBoolean(process.env.OPENCLAW_CI_RUN_CONTROL_UI_I18N) && !docsOnly;
|
|
const runUiTests = parseBoolean(process.env.OPENCLAW_CI_RUN_UI_TESTS) && !docsOnly;
|
|
const supportsNativeI18n =
|
|
hasPackageScript("native:i18n:check") &&
|
|
hasPackageScript("android:i18n:check") &&
|
|
hasPackageScript("apple:i18n:check");
|
|
const runNativeI18n =
|
|
parseBoolean(process.env.OPENCLAW_CI_RUN_NATIVE_I18N) &&
|
|
!docsOnly &&
|
|
(!frozenTarget || supportsNativeI18n);
|
|
const targetWorkflow = existsSync(".github/workflows/ci.yml")
|
|
? readFileSync(".github/workflows/ci.yml", "utf8")
|
|
: "";
|
|
const supportsOpenClawKitTests = targetWorkflow.includes("openclawkit-tests-contract-v1");
|
|
const supportsCurrentAndroidCi = targetWorkflow.includes("android-ci-contract-v2");
|
|
const useCompatibleAndroidCi = compatibilityTarget && !supportsCurrentAndroidCi;
|
|
const supportsFormatCheck =
|
|
targetWorkflow.split("pnpm format:check").length - 1 >= 2;
|
|
const runFormatCheck = !frozenTarget || supportsFormatCheck;
|
|
const checksFastCoreTasks =
|
|
runNode && !frozenTarget
|
|
? [
|
|
{
|
|
check_name: "checks-fast-max-lines-ratchet",
|
|
runtime: "node",
|
|
task: "max-lines-ratchet",
|
|
},
|
|
]
|
|
: [];
|
|
if (runNodeFull) {
|
|
checksFastCoreTasks.push(
|
|
{ check_name: "checks-fast-bundled-protocol", runtime: "node", task: "bundled-protocol" },
|
|
{ check_name: "checks-fast-bun-launcher", runtime: "bun", task: "bun-launcher" },
|
|
);
|
|
} else {
|
|
if (runNodeFastCiRouting) {
|
|
checksFastCoreTasks.push({
|
|
check_name: "checks-fast-ci-routing",
|
|
runtime: "node",
|
|
task: "ci-routing",
|
|
});
|
|
}
|
|
}
|
|
|
|
const compactPullRequest = isCanonicalRepository && eventName === "pull_request";
|
|
// Canonical pushes also use compact bins: 80+ single-group jobs
|
|
// drain the runner pool for minutes, and per-shard check names on
|
|
// main have no branch-protection consumers. Dispatch (release
|
|
// validation) keeps the full named matrix.
|
|
const compactPlan =
|
|
isCanonicalRepository && (eventName === "pull_request" || eventName === "push");
|
|
let changedNodeTestShards = null;
|
|
if (
|
|
compactPullRequest &&
|
|
changedPaths &&
|
|
typeof changedNodeTestPlan.createChangedNodeTestShards === "function"
|
|
) {
|
|
try {
|
|
changedNodeTestShards = changedNodeTestPlan.createChangedNodeTestShards(changedPaths);
|
|
} catch (error) {
|
|
console.warn(`Changed Node test planning failed; using compact full suite: ${error}`);
|
|
}
|
|
}
|
|
// Heavy packaging lanes run only when the diff touches surfaces they
|
|
// exist to prove: test-only diffs cannot change dist bytes, and QA
|
|
// smoke only sees changes on its scenario surface or inside the
|
|
// packaged CLI's import graph. QA gating is diff-based, so it also
|
|
// applies when test targeting fell back to the full compact suite.
|
|
const changedScopeHasBuildImpact =
|
|
changedNodeTestShards === null ||
|
|
typeof changedNodeTestPlan.hasBuildArtifactAffectingChange !== "function" ||
|
|
changedNodeTestPlan.hasBuildArtifactAffectingChange(changedPaths);
|
|
const changedScopeHasQaImpact =
|
|
changedPaths === null ||
|
|
eventName !== "pull_request" ||
|
|
typeof changedNodeTestPlan.hasQaSmokeAffectingChange !== "function" ||
|
|
changedNodeTestPlan.hasQaSmokeAffectingChange(changedPaths);
|
|
// Prompt snapshots only change when the generator's import graph or
|
|
// its fixtures do; unaffected PR diffs skip the regeneration lane.
|
|
const changedScopeHasPromptSnapshotImpact =
|
|
changedPaths === null ||
|
|
eventName !== "pull_request" ||
|
|
typeof changedNodeTestPlan.hasPromptSnapshotAffectingChange !== "function" ||
|
|
changedNodeTestPlan.hasPromptSnapshotAffectingChange(changedPaths);
|
|
const runBuildArtifacts = runNodeFull && changedScopeHasBuildImpact;
|
|
const runQaSmokeCi =
|
|
runNodeFull &&
|
|
changedScopeHasQaImpact &&
|
|
(!frozenTarget || existsSync("extensions/qa-lab/src/ci-smoke-plan.ts"));
|
|
const rawNodeTestShards = runNodeFull
|
|
? changedNodeTestShards
|
|
? changedNodeTestShards
|
|
: createNodeTestPlan({
|
|
includeReleaseOnlyPluginShards: false,
|
|
compact: compactPlan,
|
|
})
|
|
: [];
|
|
const assignVitestFsCacheWriter =
|
|
typeof nodeTestPlan.assignVitestFsCacheWriter === "function"
|
|
? nodeTestPlan.assignVitestFsCacheWriter
|
|
: (shards) =>
|
|
shards.map((shard, index) => ({
|
|
...shard,
|
|
saveVitestFsCache: index === 0,
|
|
}));
|
|
const nodeTestShards = assignVitestFsCacheWriter(rawNodeTestShards).map((shard) => ({
|
|
check_name: shard.checkName,
|
|
runtime: "node",
|
|
task: "test-shard",
|
|
shard_name: shard.shardName,
|
|
groups: shard.groups,
|
|
configs: shard.configs,
|
|
env: shard.env,
|
|
includePatterns: shard.includePatterns,
|
|
requires_dist: shard.requiresDist,
|
|
runner: shard.runner,
|
|
timeout_minutes: shard.timeoutMinutes,
|
|
plan_concurrency: shard.planConcurrency,
|
|
save_vitest_fs_cache: shard.saveVitestFsCache,
|
|
targets: shard.targets,
|
|
requires_go:
|
|
shard.shardName.startsWith("core-tooling") ||
|
|
shard.groups?.some((group) => group.shard_name.startsWith("core-tooling")),
|
|
}));
|
|
const nodeTestNonDistShards = nodeTestShards.filter((shard) => !shard.requires_dist);
|
|
const nodeTestDistShards = nodeTestShards.filter((shard) => shard.requires_dist);
|
|
// Targeted jobs cannot discover repository-scanning boundary tests
|
|
// through imports. Keep the full boundary gate inside build-artifacts
|
|
// when that lane runs; test-only targeted plans carry their own
|
|
// nondist changed-boundary shard instead.
|
|
const runNodeCoreDist =
|
|
(changedNodeTestShards !== null && runBuildArtifacts) ||
|
|
nodeTestDistShards.length > 0;
|
|
const channelContractShards = runNodeFull ? createChannelContractTestShards() : [];
|
|
const protocolCoverageRequested = runNode || runIosBuild || runAndroid;
|
|
const runProtocolEventCoverage =
|
|
protocolCoverageRequested &&
|
|
(!frozenTarget || existsSync("scripts/check-protocol-event-coverage.mjs"));
|
|
|
|
const manifest = {
|
|
docs_only: docsOnly,
|
|
docs_changed: docsChanged,
|
|
run_node: runNode,
|
|
run_macos: runMacos,
|
|
run_android: runAndroid,
|
|
run_skills_python: runSkillsPython,
|
|
run_windows: runWindows,
|
|
run_build_artifacts: runBuildArtifacts,
|
|
run_checks_fast_core: checksFastCoreTasks.length > 0,
|
|
run_checks_fast: runNodeFull,
|
|
historical_target: historicalTarget,
|
|
frozen_target: frozenTarget,
|
|
compatibility_target: compatibilityTarget,
|
|
run_qa_smoke_ci: runQaSmokeCi,
|
|
run_prompt_snapshots: runNodeFull && changedScopeHasPromptSnapshotImpact,
|
|
checks_fast_core_matrix: createMatrix(checksFastCoreTasks),
|
|
run_plugin_contracts_shards: runPluginContractShards,
|
|
plugin_contracts_matrix: createMatrix(
|
|
runPluginContractShards ? createPluginContractTestShards() : [],
|
|
),
|
|
run_channel_contracts_shards: channelContractShards.length > 0,
|
|
channel_contracts_matrix: createMatrix(channelContractShards),
|
|
run_checks: runNodeFull,
|
|
run_checks_node_core_nondist: nodeTestNonDistShards.length > 0,
|
|
checks_node_core_nondist_matrix: createMatrix(nodeTestNonDistShards),
|
|
run_checks_node_core_dist: runNodeCoreDist,
|
|
run_check: runNodeFull,
|
|
run_check_additional: runNodeFull,
|
|
run_check_docs: docsChanged && eventName !== "push",
|
|
run_format_check: runFormatCheck,
|
|
run_control_ui_i18n: runControlUiI18n,
|
|
run_ui_tests: runUiTests,
|
|
run_native_i18n: runNativeI18n,
|
|
run_skills_python_job: runSkillsPython,
|
|
run_checks_windows: runWindows,
|
|
checks_windows_matrix: createMatrix(
|
|
runWindows
|
|
? [
|
|
{
|
|
check_name: "checks-windows-node-test",
|
|
runtime: "node",
|
|
task: "test",
|
|
runner: "blacksmith-8vcpu-windows-2025",
|
|
},
|
|
]
|
|
: [],
|
|
),
|
|
run_macos_node: runMacos,
|
|
macos_node_matrix: createMatrix(
|
|
runMacos ? [{ check_name: "macos-node", runtime: "node", task: "test" }] : [],
|
|
),
|
|
run_macos_swift:
|
|
runMacos && (!frozenTarget || compatibilityTarget || supportsCurrentMacosSwiftCi),
|
|
run_openclawkit_tests: runMacos && supportsOpenClawKitTests,
|
|
run_ios_build: runIosBuild,
|
|
run_android_job: runAndroid,
|
|
use_compatible_android_ci: useCompatibleAndroidCi,
|
|
run_protocol_event_coverage: runProtocolEventCoverage,
|
|
android_matrix: createMatrix(
|
|
runAndroid
|
|
? [
|
|
// android-ci-contract-v3: phone variants, Wear modules, Android lint, benchmark, and ktlint.
|
|
{
|
|
check_name: "android-test-play",
|
|
task: useCompatibleAndroidCi ? "test-play-compat" : "test-play",
|
|
},
|
|
{ check_name: "android-test-third-party", task: "test-third-party" },
|
|
...(!useCompatibleAndroidCi
|
|
? [{ check_name: "android-test-wear", task: "test-wear" }]
|
|
: []),
|
|
{
|
|
check_name: "android-build-play",
|
|
task: useCompatibleAndroidCi ? "build-play-compat" : "build-play",
|
|
},
|
|
...(!useCompatibleAndroidCi
|
|
? [
|
|
{ check_name: "android-build-wear", task: "build-wear" },
|
|
{ check_name: "android-ktlint", task: "ktlint" },
|
|
]
|
|
: []),
|
|
]
|
|
: [],
|
|
),
|
|
};
|
|
|
|
for (const [key, value] of Object.entries(manifest)) {
|
|
appendFileSync(
|
|
outputPath,
|
|
`${key}=${typeof value === "string" ? value : JSON.stringify(value)}\n`,
|
|
"utf8",
|
|
);
|
|
}
|
|
EOF
|
|
|
|
- name: Check mobile protocol event coverage
|
|
if: steps.manifest.outputs.run_protocol_event_coverage == 'true'
|
|
run: node scripts/check-protocol-event-coverage.mjs
|
|
|
|
# Canonical main cannot be cancelled by a newer push. Publish the sole
|
|
# dependency snapshot here before fanout. Blacksmith may expose a fresh
|
|
# commit only to a later run; readers retain the marker-checked fallback.
|
|
- name: Refresh sticky dependency snapshot
|
|
if: github.repository == 'openclaw/openclaw' && github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.manifest.outputs.run_node == 'true'
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
save-sticky-disk: "true"
|
|
sticky-disk: "true"
|
|
use-actions-cache: "false"
|
|
|
|
- name: Maintain sticky dependency store budget
|
|
if: github.repository == 'openclaw/openclaw' && github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.manifest.outputs.run_node == 'true'
|
|
shell: bash
|
|
env:
|
|
OPENCLAW_PNPM_STORE_MAX_KIB: "8388608"
|
|
run: |
|
|
set -euo pipefail
|
|
store_dir="${PNPM_CONFIG_STORE_DIR:?}"
|
|
before_kib="$(du -sk "$store_dir" | cut -f1)"
|
|
after_kib="$before_kib"
|
|
pruned=false
|
|
|
|
if [ "$before_kib" -gt "$OPENCLAW_PNPM_STORE_MAX_KIB" ]; then
|
|
echo "pnpm store is ${before_kib} KiB; pruning above ${OPENCLAW_PNPM_STORE_MAX_KIB} KiB ceiling"
|
|
PNPM_CONFIG_STORE_DIR="$store_dir" pnpm store prune
|
|
after_kib="$(du -sk "$store_dir" | cut -f1)"
|
|
pruned=true
|
|
else
|
|
echo "pnpm store is ${before_kib} KiB; below ${OPENCLAW_PNPM_STORE_MAX_KIB} KiB ceiling"
|
|
fi
|
|
|
|
{
|
|
echo "### Dependency store maintenance"
|
|
echo
|
|
echo "- Before: ${before_kib} KiB"
|
|
echo "- After: ${after_kib} KiB"
|
|
echo "- Pruned: ${pruned}"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
if [ "$after_kib" -gt "$OPENCLAW_PNPM_STORE_MAX_KIB" ]; then
|
|
echo "::warning::pnpm store remains above its 8 GiB maintenance ceiling after prune"
|
|
fi
|
|
|
|
# Run dependency-free security checks on a hosted runner in parallel with
|
|
# scope detection. No downstream job waits for Python/pre-commit setup.
|
|
security-fast:
|
|
permissions:
|
|
contents: read
|
|
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
env:
|
|
PRE_COMMIT_HOME: .cache/pre-commit-security-fast
|
|
steps:
|
|
- name: Checkout
|
|
if: github.event_name != 'workflow_dispatch' || inputs.target_ref == ''
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
fetch-depth: 2
|
|
persist-credentials: false
|
|
|
|
# Manual target validation has a distinct fallback contract: a missing branch/tag
|
|
# falls back to the workflow SHA, while transport timeouts still fail closed.
|
|
- name: Checkout manual target
|
|
if: github.event_name == 'workflow_dispatch' && inputs.target_ref != ''
|
|
env:
|
|
CHECKOUT_REPO: ${{ github.repository }}
|
|
CHECKOUT_REF: ${{ inputs.target_ref }}
|
|
CHECKOUT_FALLBACK_REF: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
git init "$GITHUB_WORKSPACE"
|
|
git -C "$GITHUB_WORKSPACE" config gc.auto 0
|
|
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
|
|
fetch_checkout_ref() {
|
|
local ref="$1"
|
|
local fetch_status
|
|
for attempt in 1 2 3; do
|
|
timeout --signal=TERM --kill-after=10s 120s git -C "$GITHUB_WORKSPACE" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=2 origin \
|
|
"+${ref}:refs/remotes/origin/checkout" && return 0
|
|
fetch_status="$?"
|
|
if [ "$fetch_status" != "124" ] && [ "$fetch_status" != "137" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
if [ "$attempt" = "3" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
echo "::warning::checkout fetch for '$ref' timed out on attempt $attempt; retrying"
|
|
sleep 5
|
|
done
|
|
}
|
|
if fetch_checkout_ref "$CHECKOUT_REF"; then
|
|
:
|
|
else
|
|
fetch_status="$?"
|
|
if [ "$fetch_status" = "124" ] || [ "$fetch_status" = "137" ]; then
|
|
echo "::error::checkout fetch for '$CHECKOUT_REF' timed out"
|
|
exit "$fetch_status"
|
|
fi
|
|
if [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then
|
|
exit "$fetch_status"
|
|
fi
|
|
echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"
|
|
fetch_checkout_ref "$CHECKOUT_FALLBACK_REF"
|
|
fi
|
|
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
|
|
|
|
- name: Resolve security diff base
|
|
id: diff_base
|
|
env:
|
|
EVENT_BASE_SHA: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha || '' }}
|
|
run: |
|
|
set -euo pipefail
|
|
base_sha="$EVENT_BASE_SHA"
|
|
if [ "$GITHUB_EVENT_NAME" = "push" ] && [[ "$base_sha" =~ ^0+$ ]]; then
|
|
echo "::error title=ambiguous main push::github.event.before is zero; refusing to infer a diff base for a created or recreated main branch." >&2
|
|
exit 1
|
|
fi
|
|
if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
|
|
# Do not execute a helper from the untrusted PR tree before trusted
|
|
# pre-commit configuration is selected.
|
|
read -r head_sha first_parent second_parent extra <<< \
|
|
"$(git rev-list --parents -n 1 HEAD)"
|
|
if [[
|
|
"$head_sha" = "$(git rev-parse HEAD)" &&
|
|
"$first_parent" =~ ^[0-9a-f]{40}$ &&
|
|
"$second_parent" =~ ^[0-9a-f]{40}$ &&
|
|
-z "${extra:-}"
|
|
]]; then
|
|
base_sha="$first_parent"
|
|
fi
|
|
fi
|
|
echo "sha=$base_sha" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Ensure security base commit
|
|
if: github.event_name != 'workflow_dispatch'
|
|
uses: ./.github/actions/ensure-base-commit
|
|
with:
|
|
base-sha: ${{ steps.diff_base.outputs.sha }}
|
|
fetch-ref: ${{ github.event_name == 'push' && github.ref_name || github.event.pull_request.base.ref }}
|
|
|
|
- name: Fetch pull request scan history
|
|
if: github.event_name == 'pull_request'
|
|
env:
|
|
PR_COMMIT_COUNT: ${{ github.event.pull_request.commits }}
|
|
PR_MERGE_SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
if ! [[ "$PR_COMMIT_COUNT" =~ ^[0-9]+$ ]]; then
|
|
echo "::error::Invalid pull request commit count: $PR_COMMIT_COUNT"
|
|
exit 2
|
|
fi
|
|
# Include the synthetic merge, every pull request commit, and one
|
|
# ancestor so TruffleHog can clone and resolve the bounded range.
|
|
fetch_depth=$((PR_COMMIT_COUNT + 2))
|
|
timeout --signal=TERM --kill-after=10s 120s git \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --no-recurse-submodules --depth="$fetch_depth" origin "$PR_MERGE_SHA"
|
|
|
|
- name: Scan pull request for leaked credentials
|
|
if: github.event_name == 'pull_request'
|
|
uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
|
|
with:
|
|
base: ${{ steps.diff_base.outputs.sha }}
|
|
head: ${{ github.sha }}
|
|
version: "3.95.9@sha256:59b244249d1a1aef4baa24fe73d3c931616264482580d806d77f6c74d26b3e42"
|
|
extra_args: --results=verified,unknown --fail-on-scan-errors
|
|
|
|
- name: Prepare trusted pre-commit config
|
|
if: github.event_name == 'pull_request'
|
|
env:
|
|
BASE_SHA: ${{ steps.diff_base.outputs.sha }}
|
|
BASE_REF: ${{ github.event.pull_request.base.ref }}
|
|
run: |
|
|
set -euo pipefail
|
|
trusted_config="$RUNNER_TEMP/pre-commit-base.yaml"
|
|
if git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null &&
|
|
git cat-file -e "${BASE_SHA}:.pre-commit-config.yaml" 2>/dev/null; then
|
|
git show "${BASE_SHA}:.pre-commit-config.yaml" > "$trusted_config"
|
|
elif git show "refs/remotes/origin/${BASE_REF}:.pre-commit-config.yaml" \
|
|
> "$trusted_config" 2>/dev/null; then
|
|
echo "Base SHA ${BASE_SHA} does not expose .pre-commit-config.yaml; using origin/${BASE_REF} instead."
|
|
else
|
|
echo "::warning title=trusted pre-commit config unavailable::Could not read .pre-commit-config.yaml from ${BASE_SHA} or origin/${BASE_REF}; falling back to the checked-out config."
|
|
rm -f "$trusted_config"
|
|
exit 0
|
|
fi
|
|
echo "PRE_COMMIT_CONFIG_PATH=$trusted_config" >> "$GITHUB_ENV"
|
|
|
|
- name: Resolve Python runtime
|
|
id: setup-python
|
|
run: |
|
|
set -euo pipefail
|
|
python3 --version
|
|
version="$(python3 - <<'PY'
|
|
import platform
|
|
print(platform.python_version())
|
|
PY
|
|
)"
|
|
echo "python-version=${version}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Install pre-commit
|
|
run: python3 -m pip install --disable-pip-version-check pre-commit==4.2.0
|
|
|
|
- name: Detect committed private keys
|
|
run: pre-commit run --config "${PRE_COMMIT_CONFIG_PATH:-.pre-commit-config.yaml}" --all-files detect-private-key
|
|
|
|
- name: Audit changed GitHub workflows with zizmor
|
|
env:
|
|
BASE_SHA: ${{ steps.diff_base.outputs.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [ -z "${BASE_SHA:-}" ] || [ "${BASE_SHA}" = "0000000000000000000000000000000000000000" ]; then
|
|
echo "No usable base SHA detected; skipping zizmor."
|
|
exit 0
|
|
fi
|
|
|
|
if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
|
|
echo "Base SHA ${BASE_SHA} is unavailable; skipping zizmor."
|
|
exit 0
|
|
fi
|
|
|
|
mapfile -t workflow_files < <(
|
|
git diff --name-only "${BASE_SHA}" HEAD -- '.github/workflows/*.yml' '.github/workflows/*.yaml'
|
|
)
|
|
if [ "${#workflow_files[@]}" -eq 0 ]; then
|
|
echo "No workflow changes detected; skipping zizmor."
|
|
exit 0
|
|
fi
|
|
|
|
printf 'Auditing workflow files:\n%s\n' "${workflow_files[@]}"
|
|
pre-commit run --config "${PRE_COMMIT_CONFIG_PATH:-.pre-commit-config.yaml}" zizmor --files "${workflow_files[@]}"
|
|
|
|
- name: Setup Node.js
|
|
env:
|
|
REQUESTED_NODE_VERSION: "24.x"
|
|
run: |
|
|
set -euo pipefail
|
|
source .github/actions/setup-pnpm-store-cache/ensure-node.sh
|
|
openclaw_ensure_node "$REQUESTED_NODE_VERSION"
|
|
|
|
- name: Audit production dependencies
|
|
run: node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high
|
|
|
|
# Warm the lockfile- and pnpm-pinned Actions cache for PR and manual runs.
|
|
# Canonical main publishes its sticky snapshot in preflight before fanout.
|
|
pnpm-store-warmup:
|
|
permissions:
|
|
contents: read
|
|
needs: [preflight]
|
|
if: ${{ (needs.preflight.outputs.run_node == 'true' || needs.preflight.outputs.run_check_docs == 'true') && !(github.repository == 'openclaw/openclaw' && github.event_name == 'push' && github.ref == 'refs/heads/main') }}
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
steps:
|
|
- &linux_node_checkout_step
|
|
name: Checkout
|
|
shell: bash
|
|
env:
|
|
CHECKOUT_REPO: ${{ github.repository }}
|
|
CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
workdir="$GITHUB_WORKSPACE"
|
|
reset_checkout_dir() {
|
|
mkdir -p "$workdir"
|
|
find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
|
|
}
|
|
|
|
checkout_attempt() {
|
|
local attempt="$1"
|
|
|
|
reset_checkout_dir
|
|
git init "$workdir" >/dev/null
|
|
git config --global --add safe.directory "$workdir"
|
|
git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
|
|
git -C "$workdir" config gc.auto 0
|
|
|
|
fetch_refs=("+${CHECKOUT_SHA}:refs/remotes/origin/ci-target")
|
|
if [ -n "${CHECKOUT_BASE_SHA:-}" ]; then
|
|
fetch_refs+=("+${CHECKOUT_BASE_SHA}:refs/remotes/origin/ci-max-lines-base")
|
|
fi
|
|
|
|
timeout --signal=TERM --kill-after=10s 120s git -C "$workdir" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
|
|
"${fetch_refs[@]}" || return 1
|
|
|
|
git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1
|
|
test -f "$workdir/.github/actions/setup-node-env/action.yml" || return 1
|
|
echo "checkout attempt ${attempt}/5 succeeded"
|
|
}
|
|
|
|
for attempt in 1 2 3 4 5; do
|
|
if checkout_attempt "$attempt"; then
|
|
exit 0
|
|
fi
|
|
echo "checkout attempt ${attempt}/5 failed"
|
|
sleep $((attempt * 5))
|
|
done
|
|
|
|
echo "checkout failed after 5 attempts" >&2
|
|
exit 1
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
save-actions-cache: "true"
|
|
|
|
# Build dist once for Node-relevant changes and share it with downstream jobs.
|
|
# Keep this overlapping with the fast correctness lanes so green PRs get heavy
|
|
# test/build feedback sooner instead of waiting behind a full `check` pass.
|
|
build-artifacts:
|
|
permissions:
|
|
contents: read
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_build_artifacts == 'true'
|
|
# 32 vCPU: the dist build sits on the light-run critical path alongside
|
|
# check-lint/check-dependencies; tsdown parallelizes across the extra
|
|
# cores for roughly the same billed core-minutes.
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-32vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && 35 || 20 }}
|
|
outputs:
|
|
channels-result: ${{ steps.built_artifact_checks.outputs['channels-result'] }}
|
|
core-support-boundary-result: ${{ steps.built_artifact_checks.outputs['core-support-boundary-result'] }}
|
|
gateway-watch-result: ${{ steps.built_artifact_checks.outputs['gateway-watch-result'] }}
|
|
tui-pty-result: ${{ steps.built_artifact_checks.outputs['tui-pty-result'] }}
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Ensure secrets base commit (PR fast path)
|
|
if: github.event_name == 'pull_request'
|
|
uses: ./.github/actions/ensure-base-commit
|
|
with:
|
|
base-sha: ${{ needs.preflight.outputs.diff_base_revision }}
|
|
fetch-ref: ${{ github.event.pull_request.base.ref }}
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
node-compile-cache: "true"
|
|
node-compile-cache-scope: "build"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
save-node-compile-cache: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'true' || 'false' }}
|
|
|
|
- name: Restore build-all step cache
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: .artifacts/build-all-cache
|
|
key: ${{ runner.os }}-build-all-v4-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'scripts/build-all.mts', 'scripts/runtime-postbuild.mjs', 'scripts/runtime-postbuild.mts', 'scripts/lib/tsx-cli-shim.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entries.mts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-private-local-only-subpaths.json', 'scripts/lib/plugin-sdk-deprecated-public-subpaths.json', 'scripts/lib/plugin-sdk-deprecated-barrel-subpaths.json', 'tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'src/**', 'packages/**', '!src/**/dist/**', '!src/**/node_modules/**', '!packages/**/dist/**', '!packages/**/node_modules/**') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-build-all-v4-
|
|
|
|
- name: Restore dist build cache
|
|
id: dist_build_cache
|
|
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: |
|
|
dist/
|
|
dist-runtime/
|
|
packages/*/dist/
|
|
extensions/*/src/host/**/.bundle.hash
|
|
extensions/*/src/host/**/*.bundle.js
|
|
key: ${{ runner.os }}-dist-build-v3-${{ needs.preflight.outputs.checkout_revision }}
|
|
|
|
- name: Build dist
|
|
if: steps.dist_build_cache.outputs.cache-hit != 'true'
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=8192
|
|
run: pnpm build:ci-artifacts
|
|
|
|
# Reruns the (warm, seconds-cheap) asset hooks and fails on drift so
|
|
# packages/-only PRs cannot land stale committed plugin bundles; the
|
|
# extension byte-equality suites do not run for those diffs.
|
|
- name: Check bundled plugin generated assets
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if node --input-type=module <<'NODE'
|
|
import { readFileSync } from "node:fs";
|
|
|
|
const packageJson = JSON.parse(readFileSync("package.json", "utf8"));
|
|
process.exit(packageJson.scripts?.["plugins:assets:check"] ? 0 : 1);
|
|
NODE
|
|
then
|
|
pnpm plugins:assets:check
|
|
else
|
|
# Frozen release candidates predate this generated-asset contract.
|
|
# Their own build remains the available asset validation surface.
|
|
echo "Selected release candidate predates plugins:assets:check; skipping unavailable check."
|
|
fi
|
|
|
|
- name: Pack built runtime artifacts
|
|
run: tar --posix -cf dist-runtime-build.tar.zst --use-compress-program zstdmt dist dist-runtime packages/*/dist
|
|
|
|
- name: Upload built runtime artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: dist-runtime-build
|
|
path: dist-runtime-build.tar.zst
|
|
retention-days: 1
|
|
|
|
- name: Upload bundled plugin asset artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: bundled-plugin-assets
|
|
path: |
|
|
extensions/*/src/host/**/.bundle.hash
|
|
extensions/*/src/host/**/*.bundle.js
|
|
include-hidden-files: true
|
|
retention-days: 1
|
|
|
|
- name: Smoke test CLI launcher help
|
|
run: node openclaw.mjs --help
|
|
|
|
- name: Smoke test CLI launcher status json
|
|
run: node openclaw.mjs status --json --timeout 1
|
|
|
|
- name: Verify built Doctor plugin index persistence
|
|
run: |
|
|
if [[ -f test/scripts/doctor-config-preflight-plugin-index.built-cli.e2e.test.ts ]]; then
|
|
# Cold hosted runners can spend over five minutes in E2E setup before
|
|
# this proof's own bounded test can report a result.
|
|
env OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS=660000 node scripts/run-vitest.mjs run \
|
|
--config test/vitest/vitest.e2e.config.ts \
|
|
test/scripts/doctor-config-preflight-plugin-index.built-cli.e2e.test.ts
|
|
else
|
|
echo "Selected target predates the built Doctor plugin index persistence proof."
|
|
fi
|
|
|
|
- name: Smoke test built bundled plugin singleton
|
|
run: pnpm test:build:singleton
|
|
|
|
- name: Check CLI startup memory
|
|
shell: bash
|
|
env:
|
|
# GitHub-hosted Linux reports a higher RSS baseline than Blacksmith for
|
|
# the same built CLI. Keep the tighter Blacksmith regression ceiling.
|
|
OPENCLAW_STARTUP_MEMORY_PLUGINS_LIST_MB: ${{ runner.environment == 'github-hosted' && '425' || '400' }}
|
|
run: |
|
|
set +e
|
|
pnpm test:startup:memory
|
|
status=$?
|
|
if [[ -f .artifacts/startup-memory/summary.md ]]; then
|
|
cat .artifacts/startup-memory/summary.md >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
exit "$status"
|
|
|
|
- name: Upload startup memory report
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: startup-memory
|
|
path: .artifacts/startup-memory/
|
|
if-no-files-found: ignore
|
|
retention-days: 7
|
|
|
|
- name: Run built artifact checks
|
|
id: built_artifact_checks
|
|
if: needs.preflight.outputs.run_checks == 'true' || needs.preflight.outputs.run_checks_node_core_dist == 'true' || needs.preflight.outputs.run_check_additional == 'true'
|
|
env:
|
|
PARALLEL_GATEWAY_WATCH: ${{ runner.environment != 'github-hosted' && 'true' || 'false' }}
|
|
RUN_CHANNELS: ${{ needs.preflight.outputs.run_checks }}
|
|
RUN_CORE_SUPPORT_BOUNDARY: ${{ needs.preflight.outputs.run_checks_node_core_dist }}
|
|
RUN_GATEWAY_WATCH: ${{ needs.preflight.outputs.run_check_additional }}
|
|
RUN_TUI_PTY: ${{ needs.preflight.outputs.run_checks_node_core_dist }}
|
|
shell: bash
|
|
run: |
|
|
set -uo pipefail
|
|
|
|
names=()
|
|
pids=()
|
|
logs=()
|
|
declare -A results=(
|
|
["channels"]="skipped"
|
|
["core-support-boundary"]="skipped"
|
|
["gateway-watch"]="skipped"
|
|
["tui-pty"]="skipped"
|
|
)
|
|
|
|
start_check() {
|
|
local name="$1"
|
|
shift
|
|
local log="${RUNNER_TEMP}/${name}.log"
|
|
names+=("$name")
|
|
logs+=("$log")
|
|
echo "starting ${name}: $*"
|
|
"$@" >"$log" 2>&1 &
|
|
pids+=("$!")
|
|
}
|
|
|
|
wait_checks() {
|
|
local index name log pid result
|
|
for index in "${!pids[@]}"; do
|
|
name="${names[$index]}"
|
|
log="${logs[$index]}"
|
|
pid="${pids[$index]}"
|
|
|
|
if wait "$pid"; then
|
|
result="success"
|
|
else
|
|
result="failure"
|
|
fi
|
|
|
|
echo "::group::${name} log"
|
|
cat "$log"
|
|
echo "::endgroup::"
|
|
results["$name"]="$result"
|
|
done
|
|
names=()
|
|
pids=()
|
|
logs=()
|
|
}
|
|
|
|
if [ "$RUN_CHANNELS" = "true" ]; then
|
|
start_check "channels" env \
|
|
NODE_OPTIONS=--max-old-space-size=8192 \
|
|
OPENCLAW_VITEST_MAX_WORKERS=1 \
|
|
pnpm test:channels
|
|
fi
|
|
|
|
if [ "$RUN_CORE_SUPPORT_BOUNDARY" = "true" ]; then
|
|
start_check "core-support-boundary" env \
|
|
NODE_OPTIONS=--max-old-space-size=8192 \
|
|
OPENCLAW_VITEST_MAX_WORKERS=2 \
|
|
node scripts/run-vitest.mjs run --config test/vitest/vitest.full-core-support-boundary.config.ts
|
|
fi
|
|
|
|
if [ "$RUN_GATEWAY_WATCH" = "true" ] && [ "$PARALLEL_GATEWAY_WATCH" = "true" ]; then
|
|
start_check "gateway-watch" \
|
|
pnpm test:gateway:watch-regression -- --skip-build
|
|
fi
|
|
|
|
wait_checks
|
|
|
|
# Preserve the low-core hosted path; concurrent Vitest can otherwise
|
|
# starve the Gateway readiness deadline used by this regression gate.
|
|
if [ "$RUN_GATEWAY_WATCH" = "true" ] && [ "$PARALLEL_GATEWAY_WATCH" != "true" ]; then
|
|
start_check "gateway-watch" \
|
|
pnpm test:gateway:watch-regression -- --skip-build
|
|
wait_checks
|
|
fi
|
|
|
|
# The dedicated Node shard owns the full built-CLI PTY suite. Keep
|
|
# only the local roundtrip and Gateway-connect artifact canaries here.
|
|
if [ "$RUN_TUI_PTY" = "true" ]; then
|
|
start_check "tui-pty" env \
|
|
NODE_OPTIONS=--max-old-space-size=8192 \
|
|
OPENCLAW_TUI_PTY_INCLUDE_LOCAL=1 \
|
|
OPENCLAW_TUI_PTY_USE_BUILT_CLI=1 \
|
|
OPENCLAW_VITEST_MAX_WORKERS=2 \
|
|
node scripts/run-vitest.mjs run \
|
|
--config test/vitest/vitest.tui-pty.config.ts \
|
|
src/tui/tui-pty-local.e2e.test.ts \
|
|
--testNamePattern "launches openclaw (chat as local mode|tui against a real Gateway) through a real PTY"
|
|
wait_checks
|
|
fi
|
|
|
|
for name in channels core-support-boundary gateway-watch tui-pty; do
|
|
echo "${name}-result=${results[$name]}" >> "$GITHUB_OUTPUT"
|
|
done
|
|
|
|
failures=0
|
|
for name in channels core-support-boundary gateway-watch tui-pty; do
|
|
if [ "${results[$name]}" = "failure" ]; then
|
|
echo "::error title=${name} failed::${name} failed"
|
|
failures=1
|
|
fi
|
|
done
|
|
exit "$failures"
|
|
|
|
- name: Save dist build cache
|
|
if: steps.dist_build_cache.outputs.cache-hit != 'true'
|
|
uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
continue-on-error: true
|
|
with:
|
|
path: |
|
|
dist/
|
|
dist-runtime/
|
|
packages/*/dist/
|
|
extensions/*/src/host/**/.bundle.hash
|
|
extensions/*/src/host/**/*.bundle.js
|
|
key: ${{ steps.dist_build_cache.outputs.cache-primary-key }}
|
|
|
|
- name: Upload gateway watch regression artifacts
|
|
if: always() && needs.preflight.outputs.run_check_additional == 'true'
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: gateway-watch-regression
|
|
path: .local/gateway-watch-regression/
|
|
retention-days: 7
|
|
|
|
native-i18n:
|
|
permissions:
|
|
contents: read
|
|
needs: [preflight]
|
|
if: ${{ !cancelled() && always() && needs.preflight.outputs.run_native_i18n == 'true' }}
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ needs.preflight.outputs.checkout_revision }}
|
|
persist-credentials: false
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- name: Verify native app i18n source
|
|
run: |
|
|
if node -e 'const scripts = require("./package.json").scripts ?? {}; process.exit(scripts["native:i18n:verify"] ? 0 : 1)'; then
|
|
pnpm native:i18n:verify
|
|
else
|
|
# Historical release targets predate the source/generated split.
|
|
pnpm native:i18n:check
|
|
pnpm android:i18n:check
|
|
pnpm apple:i18n:check
|
|
fi
|
|
|
|
- name: Check native app generated locale parity
|
|
if: ${{ needs.preflight.outputs.strict_native_i18n == 'true' }}
|
|
run: |
|
|
if node -e 'const scripts = require("./package.json").scripts ?? {}; process.exit(scripts["native:i18n:verify"] ? 0 : 1)'; then
|
|
pnpm native:i18n:check
|
|
else
|
|
echo "Historical target was validated by the legacy native checks."
|
|
fi
|
|
|
|
checks-ui:
|
|
permissions:
|
|
contents: read
|
|
name: checks-ui
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_ui_tests == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
env:
|
|
COMPATIBILITY_TARGET: ${{ needs.preflight.outputs.compatibility_target }}
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: "24.x"
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- &install_playwright_chromium
|
|
name: Install Playwright Chromium
|
|
env:
|
|
FROZEN_TARGET: ${{ needs.preflight.outputs.frozen_target }}
|
|
run: |
|
|
if [[ "${COMPATIBILITY_TARGET:-false}" == "true" ]]; then
|
|
# Legacy Vitest configs cannot pass a discovered system browser to Playwright.
|
|
# Install the managed browser revision pinned by the selected target instead.
|
|
pnpm --dir ui exec playwright install chromium
|
|
elif [[ -f scripts/ensure-playwright-chromium.mts ]]; then
|
|
node --import tsx scripts/ensure-playwright-chromium.mts
|
|
elif [[ "$FROZEN_TARGET" == "true" && -f scripts/ensure-playwright-chromium.mjs ]]; then
|
|
node scripts/ensure-playwright-chromium.mjs
|
|
else
|
|
echo "Target does not provide a supported Playwright Chromium installer." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Lint Control UI window.open usage
|
|
run: pnpm lint:ui:no-raw-window-open
|
|
|
|
- name: Test Control UI
|
|
run: |
|
|
if [[ "$COMPATIBILITY_TARGET" == "true" ]]; then
|
|
# Frozen targets can contain timing-sensitive tests fixed on current main.
|
|
# Give legacy browser fixtures enough headroom on shared hosted runners.
|
|
# Isolate files because older suites can still leak module mocks between tests.
|
|
# Do not retry whole files: several rely on one-shot mocked browser globals.
|
|
pnpm --dir ui test --testTimeout=30000 --isolate
|
|
else
|
|
# Three workers deliberately exercise stable non-default file packing so
|
|
# isolate:false mock-registry leaks fail close to the introducing change.
|
|
pnpm --dir ui test --maxWorkers 3
|
|
fi
|
|
|
|
checks-ui-e2e:
|
|
permissions:
|
|
contents: read
|
|
name: checks-ui-e2e (${{ matrix.shard }}/4)
|
|
needs: [preflight]
|
|
# Compatibility targets pin a frozen Control UI whose e2e expectations track
|
|
# that release, not current main.
|
|
if: needs.preflight.outputs.run_ui_tests == 'true' && needs.preflight.outputs.compatibility_target != 'true'
|
|
# First-attempt same-repo runs use Blacksmith; manual dispatches, forks, and
|
|
# same-repo PR retries use GitHub-hosted capacity as an independent fallback.
|
|
runs-on: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.run_attempt > 1)) && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
# Keep Chromium ownership serial within each independently required shard.
|
|
timeout-minutes: 25
|
|
env:
|
|
OPENCLAW_UI_E2E_SKIP_REAL_GATEWAY: "1"
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 4
|
|
matrix:
|
|
shard: [1, 2, 3, 4]
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: "24.x"
|
|
install-bun: "false"
|
|
# Hosted paths use Actions cache and never touch repository-global sticky snapshots.
|
|
sticky-disk: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.run_attempt > 1)) && 'false' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false') }}
|
|
use-actions-cache: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.run_attempt > 1)) && 'true' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true') }}
|
|
|
|
- *install_playwright_chromium
|
|
|
|
- name: Test Control UI end-to-end
|
|
run: >-
|
|
node scripts/run-vitest.mjs run
|
|
--config test/vitest/vitest.ui-e2e.config.ts
|
|
--configLoader runner
|
|
--shard ${{ matrix.shard }}/4
|
|
|
|
- name: Test browser extension bootstrap end-to-end
|
|
if: matrix.shard == 1
|
|
run: pnpm test:e2e:browser-extension
|
|
|
|
checks-ui-e2e-real-gateway:
|
|
permissions:
|
|
contents: read
|
|
name: checks-ui-e2e-real-gateway
|
|
needs: [preflight]
|
|
# Compatibility targets pin a frozen Control UI whose e2e expectations track
|
|
# that release, not current main.
|
|
if: needs.preflight.outputs.run_ui_tests == 'true' && needs.preflight.outputs.compatibility_target != 'true'
|
|
# First-attempt same-repo runs use Blacksmith; manual dispatches, forks, and
|
|
# same-repo PR retries use GitHub-hosted capacity as an independent fallback.
|
|
runs-on: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.run_attempt > 1)) && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: "24.x"
|
|
install-bun: "false"
|
|
# Hosted paths use Actions cache and never touch repository-global sticky snapshots.
|
|
sticky-disk: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.run_attempt > 1)) && 'false' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false') }}
|
|
use-actions-cache: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.run_attempt > 1)) && 'true' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true') }}
|
|
|
|
- *install_playwright_chromium
|
|
|
|
- name: Test MCP app conformance with a real Gateway
|
|
run: >-
|
|
node scripts/run-vitest.mjs run
|
|
--config test/vitest/vitest.ui-e2e.config.ts
|
|
--configLoader runner
|
|
ui/src/e2e/mcp-app-conformance.e2e.test.ts
|
|
|
|
- name: Test Control UI auth transports with a real Gateway
|
|
run: >-
|
|
node scripts/run-vitest.mjs run
|
|
--config test/vitest/vitest.ui-e2e.config.ts
|
|
--configLoader runner
|
|
ui/src/e2e/control-ui-auth-transports.e2e.test.ts
|
|
|
|
control-ui-i18n:
|
|
permissions:
|
|
contents: read
|
|
name: control-ui-i18n
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_control_ui_i18n == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 10
|
|
env:
|
|
COMPATIBILITY_TARGET: ${{ needs.preflight.outputs.compatibility_target }}
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: "24.x"
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- name: Verify Control UI i18n source
|
|
run: |
|
|
if node -e 'process.exit(require("./package.json").scripts?.["ui:i18n:verify"] ? 0 : 1)'; then
|
|
pnpm ui:i18n:verify
|
|
elif [[ "$COMPATIBILITY_TARGET" == "true" ]]; then
|
|
echo "Skipping ui:i18n:verify: unavailable on the selected compatibility target." >> "$GITHUB_STEP_SUMMARY"
|
|
else
|
|
echo "ui:i18n:verify is required for non-compatibility targets." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Check Control UI locale parity
|
|
# Source-only drift stays advisory because the post-merge bot owns
|
|
# repair. Generated locale changes and full release CI remain strict.
|
|
continue-on-error: ${{ needs.preflight.outputs.strict_control_ui_i18n != 'true' }}
|
|
run: pnpm ui:i18n:check
|
|
|
|
checks-fast-core:
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
name: ${{ matrix.check_name }}
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_checks_fast_core == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && (matrix.runner || 'blacksmith-4vcpu-ubuntu-2404') || 'ubuntu-24.04') }}
|
|
timeout-minutes: 60
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 12
|
|
matrix: ${{ fromJson(needs.preflight.outputs.checks_fast_core_matrix) }}
|
|
env:
|
|
CHECKOUT_BASE_SHA: ${{ matrix.task == 'max-lines-ratchet' && needs.preflight.outputs.diff_base_revision || '' }}
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Prepare release-gate max-lines merge tree
|
|
if: matrix.task == 'max-lines-ratchet' && github.event_name == 'workflow_dispatch' && inputs.release_gate
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PULL_REQUEST_NUMBER: ${{ inputs.pull_request_number }}
|
|
TARGET_SHA: ${{ inputs.target_ref }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
pr_head="$(
|
|
gh api --method GET "repos/${GITHUB_REPOSITORY}/pulls/${PULL_REQUEST_NUMBER}" |
|
|
jq -r --arg repo "$GITHUB_REPOSITORY" --arg target "$TARGET_SHA" '
|
|
select(.state == "open" and .head.sha == $target and .base.repo.full_name == $repo)
|
|
| .head.sha
|
|
'
|
|
)"
|
|
if [[ "$pr_head" != "$TARGET_SHA" ]]; then
|
|
echo "release-gate pull request must be open and match the target head" >&2
|
|
exit 1
|
|
fi
|
|
# Freeze GitHub's canonical merge snapshot once it contains the exact head.
|
|
# Base freshness belongs to the landing gate; chasing moving main here can never converge.
|
|
prepared=false
|
|
for attempt in {1..6}; do
|
|
if timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=2 origin \
|
|
"+refs/pull/${PULL_REQUEST_NUMBER}/merge:refs/remotes/origin/ci-max-lines-merge"; then
|
|
merge_sha="$(git rev-parse refs/remotes/origin/ci-max-lines-merge)"
|
|
read -r frozen_base_sha merge_head extra_parent <<<"$(git show -s --format=%P "$merge_sha")"
|
|
if [[ "$merge_head" == "$TARGET_SHA" && -z "$extra_parent" ]]; then
|
|
prepared=true
|
|
break
|
|
fi
|
|
fi
|
|
if [[ "$attempt" != "6" ]]; then
|
|
sleep 5
|
|
fi
|
|
done
|
|
if [[ "$prepared" != "true" ]]; then
|
|
echo "release-gate merge tree did not refresh to the target head" >&2
|
|
exit 1
|
|
fi
|
|
git checkout --detach "$merge_sha"
|
|
echo "RATCHET_BASE_REF=${frozen_base_sha}" >> "$GITHUB_ENV"
|
|
echo "RATCHET_RELEASE_MERGE_TREE=true" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: ${{ matrix.task == 'bun-launcher' && 'true' || 'false' }}
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- name: Run ${{ matrix.task }} (${{ matrix.runtime }})
|
|
env:
|
|
OPENCLAW_TEST_PROJECTS_PARALLEL: 3
|
|
PROTOCOL_SINCE_BASE_SHA: ${{ needs.preflight.outputs.diff_base_revision }}
|
|
RATCHET_PR_HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
|
|
TASK: ${{ matrix.task }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
has_package_script() {
|
|
node -e '
|
|
const scripts = require("./package.json").scripts ?? {};
|
|
process.exit(Object.hasOwn(scripts, process.argv[1]) ? 0 : 1);
|
|
' "$1"
|
|
}
|
|
case "$TASK" in
|
|
bundled-protocol)
|
|
pnpm test:bundled
|
|
git fetch --no-tags --no-recurse-submodules --depth=1 origin \
|
|
"+${PROTOCOL_SINCE_BASE_SHA}:refs/remotes/origin/protocol-since-base"
|
|
pnpm protocol:check
|
|
;;
|
|
contracts-plugins-ci-routing)
|
|
pnpm test:contracts:plugins
|
|
pnpm test src/commands/status.scan-result.test.ts src/scripts/ci-changed-scope*.test.ts test/scripts/changed-lanes.test.ts test/scripts/ci-changed-node-test-plan.test.ts test/scripts/ci-run-node-test-shard.test.ts test/scripts/ci-workflow-guards.test.ts test/scripts/run-vitest.test.ts test/scripts/test-projects.test.ts
|
|
;;
|
|
ci-routing)
|
|
pnpm test src/commands/status.scan-result.test.ts src/scripts/ci-changed-scope*.test.ts test/scripts/changed-lanes.test.ts test/scripts/ci-changed-node-test-plan.test.ts test/scripts/ci-run-node-test-shard.test.ts test/scripts/ci-workflow-guards.test.ts test/scripts/run-vitest.test.ts test/scripts/test-projects.test.ts
|
|
;;
|
|
max-lines-ratchet)
|
|
if ! has_package_script "check:max-lines-ratchet"; then
|
|
echo "Current CI targets must provide check:max-lines-ratchet." >&2
|
|
exit 1
|
|
fi
|
|
base_ref="${RATCHET_BASE_REF:-refs/remotes/origin/ci-max-lines-base}"
|
|
if ! git cat-file -e "${base_ref}^{commit}" 2>/dev/null; then
|
|
echo "Prepared max-lines base ${base_ref} is unavailable." >&2
|
|
exit 1
|
|
fi
|
|
if [[ -n "${RATCHET_PR_HEAD_SHA:-}" ]]; then
|
|
mapfile -t merge_parents < <(git cat-file -p HEAD | sed -n 's/^parent //p')
|
|
if [[ "${#merge_parents[@]}" != "2" || "${merge_parents[1]:-}" != "$RATCHET_PR_HEAD_SHA" ]]; then
|
|
echo "Pull request checkout is not the expected two-parent merge tree." >&2
|
|
exit 1
|
|
fi
|
|
prepared_base="$(git rev-parse "$base_ref")"
|
|
if [[ "${merge_parents[0]}" != "$prepared_base" ]]; then
|
|
echo "Pull request merge base does not match the prepared preflight base." >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
pnpm check:max-lines-ratchet --base "$base_ref"
|
|
if [[ "${RATCHET_RELEASE_MERGE_TREE:-}" == "true" ]]; then
|
|
node --import tsx scripts/run-oxlint-shards.mts --only=core --only=extensions --split-core --threads=1
|
|
fi
|
|
;;
|
|
bun-launcher)
|
|
OPENCLAW_TEST_BUN_LAUNCHER=1 pnpm test test/openclaw-launcher.e2e.test.ts
|
|
;;
|
|
*)
|
|
echo "Unsupported checks-fast task: $TASK" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
qa-smoke-ci-profile:
|
|
permissions:
|
|
contents: read
|
|
name: QA Smoke CI (${{ matrix.name }})
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_qa_smoke_ci == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 60
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 4
|
|
matrix:
|
|
include:
|
|
- name: profile 1/4
|
|
lane: profile-1
|
|
slug: profile-1-of-4
|
|
- name: profile 2/4
|
|
lane: profile-2
|
|
slug: profile-2-of-4
|
|
docker_cache: true
|
|
- name: profile 3/4
|
|
lane: profile-3
|
|
slug: profile-3-of-4
|
|
- name: profile 4/4
|
|
lane: profile-4
|
|
slug: profile-4-of-4
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- name: Set up Blacksmith Docker layer cache
|
|
if: ${{ matrix.docker_cache == true && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') }}
|
|
uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1
|
|
with:
|
|
max-cache-size-mb: 800000
|
|
|
|
- name: Build QA smoke runtime
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=8192
|
|
run: |
|
|
# Pack the public runtime before overlaying private QA artifacts so they cannot leak.
|
|
unset OPENCLAW_BUILD_PRIVATE_QA
|
|
pnpm build qaRuntime
|
|
pnpm ui:build
|
|
package_args=(
|
|
--skip-build
|
|
--output-dir .artifacts/qa-e2e/smoke-ci-package
|
|
--output-name openclaw-current.tgz
|
|
)
|
|
package_script="scripts/package-openclaw-for-docker.mts"
|
|
if [[ ! -f "$package_script" ]]; then
|
|
package_script="scripts/package-openclaw-for-docker.mjs"
|
|
fi
|
|
if grep -Fq -- '--allow-unreleased-changelog' "$package_script"; then
|
|
package_args=(--allow-unreleased-changelog "${package_args[@]}")
|
|
fi
|
|
node scripts/package-openclaw-for-docker.mjs "${package_args[@]}"
|
|
OPENCLAW_BUILD_PRIVATE_QA=1 pnpm build qaRuntime
|
|
|
|
- name: Run smoke profile part
|
|
env:
|
|
PROFILE_PART: ${{ matrix.lane }}
|
|
PROFILE_PART_SLUG: ${{ matrix.slug }}
|
|
OPENCLAW_QA_SUITE_WORKER_START_STAGGER_MS: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && '0' || '1500' }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
output_dir=".artifacts/qa-e2e/smoke-ci-profile-${PROFILE_PART_SLUG}"
|
|
export OPENCLAW_BUILD_PRIVATE_QA=1
|
|
export OPENCLAW_ENABLE_PRIVATE_QA_CLI=1
|
|
export OPENCLAW_DISABLE_BUNDLED_PLUGINS=0
|
|
export OPENCLAW_QA_REDACT_PUBLIC_METADATA=1
|
|
export OPENCLAW_QA_TRANSPORT_READY_TIMEOUT_MS=180000
|
|
export NODE_OPTIONS=--max-old-space-size=16384
|
|
export OPENCLAW_CURRENT_PACKAGE_TGZ="$PWD/.artifacts/qa-e2e/smoke-ci-package/openclaw-current.tgz"
|
|
PROFILE_RUNS_TSV="$(
|
|
node --import tsx --input-type=module <<'EOF'
|
|
const smokePlan = await import("./extensions/qa-lab/src/ci-smoke-plan.ts");
|
|
const partId = process.env.PROFILE_PART ?? "";
|
|
let runs;
|
|
if (typeof smokePlan.createQaSmokeCiPart === "function") {
|
|
try {
|
|
runs = smokePlan.createQaSmokeCiPart(partId).runs;
|
|
} catch (error) {
|
|
// Frozen/compat targets ship older planners that declare fewer
|
|
// profile parts; the declared parts still cover every scenario.
|
|
if (/unknown QA smoke CI profile part/.test(String(error)) && partId !== "profile-1") {
|
|
// stdout is the TSV contract consumed below. Keep diagnostics on stderr
|
|
// so an empty compatibility shard remains empty instead of becoming a run.
|
|
console.error(`[skip] ${partId} is not declared by this checkout's smoke plan`);
|
|
process.exit(0);
|
|
}
|
|
throw error;
|
|
}
|
|
} else if (typeof smokePlan.createQaSmokeCiMatrix === "function") {
|
|
// Legacy planners select the entire profile and can mix long-lived
|
|
// execution kinds. Reuse the current bounded smoke contract and
|
|
// isolate each scenario so one invocation cannot pin a profile part.
|
|
const compatibilityScenarioIds = new Set([
|
|
"control-ui-chat-flow-playwright",
|
|
"system-agent-ring-zero-setup",
|
|
"gateway-smoke",
|
|
"group-visible-reply-tool",
|
|
"long-running-release-audit",
|
|
"luna-thinking-visibility-switch",
|
|
"matrix-restart-resume",
|
|
"personal-task-followthrough-status",
|
|
"plugin-lifecycle-hot-reload",
|
|
"subagent-completion-direct-fallback",
|
|
"telegram-commands-command",
|
|
]);
|
|
const partIndex = partId === "profile-1" ? 0 : partId === "profile-2" ? 1 : -1;
|
|
if (partIndex < 0) {
|
|
throw new Error(`unknown QA smoke CI profile part: ${partId}`);
|
|
}
|
|
const scenarioCatalog = await import("./extensions/qa-lab/src/scenario-catalog.ts");
|
|
const scenarioKindById = new Map(
|
|
scenarioCatalog
|
|
.readQaScenarioPack()
|
|
.scenarios.map((scenario) => [scenario.id, scenario.execution.kind]),
|
|
);
|
|
const legacyRuns = smokePlan
|
|
.createQaSmokeCiMatrix()
|
|
.include.filter((_, index) => index % 2 === partIndex);
|
|
runs = legacyRuns.flatMap((run) =>
|
|
run.scenario_ids.flatMap((scenarioId) => {
|
|
if (!compatibilityScenarioIds.has(scenarioId)) {
|
|
return [];
|
|
}
|
|
const kind = scenarioKindById.get(scenarioId);
|
|
if (!kind) {
|
|
throw new Error(`legacy QA smoke scenario not found: ${scenarioId}`);
|
|
}
|
|
return [
|
|
{
|
|
...run,
|
|
slug: `${run.slug}-${kind}-${scenarioId}`,
|
|
scenario_ids: [scenarioId],
|
|
},
|
|
];
|
|
}),
|
|
);
|
|
} else {
|
|
throw new Error("QA smoke plan does not expose a supported CI planner.");
|
|
}
|
|
for (const run of runs) {
|
|
const scenarioIds = Buffer.from(JSON.stringify(run.scenario_ids)).toString("base64");
|
|
process.stdout.write(`${run.slug}\t${scenarioIds}\n`);
|
|
}
|
|
EOF
|
|
)"
|
|
if [[ -z "${PROFILE_RUNS_TSV//[[:space:]]/}" ]]; then
|
|
echo "No QA smoke runs assigned to ${PROFILE_PART}; skipping this compatibility shard."
|
|
exit 0
|
|
fi
|
|
qa_exit_code=0
|
|
while IFS=$'\t' read -r run_slug scenario_ids_base64; do
|
|
export SCENARIO_IDS_BASE64="$scenario_ids_base64"
|
|
mapfile -t scenario_ids < <(
|
|
node -e 'for (const id of JSON.parse(Buffer.from(process.env.SCENARIO_IDS_BASE64, "base64"))) console.log(id)'
|
|
)
|
|
scenario_args=()
|
|
for scenario_id in "${scenario_ids[@]}"; do
|
|
scenario_args+=(--scenario "$scenario_id")
|
|
done
|
|
timeout --signal=TERM --kill-after=15s 10m node openclaw.mjs qa run \
|
|
--repo-root . \
|
|
--qa-profile smoke-ci \
|
|
--concurrency 10 \
|
|
--output-dir "$output_dir/$run_slug" \
|
|
"${scenario_args[@]}" || qa_exit_code=$?
|
|
done <<< "$PROFILE_RUNS_TSV"
|
|
echo "QA smoke profile evidence: \`${output_dir}\`" >> "$GITHUB_STEP_SUMMARY"
|
|
if [ "$qa_exit_code" -ne 0 ]; then
|
|
echo "::error title=QA smoke profile failed::smoke-ci profile part ${PROFILE_PART_SLUG} exited ${qa_exit_code}; evidence upload will still run"
|
|
exit "$qa_exit_code"
|
|
fi
|
|
|
|
- name: Upload QA smoke profile evidence
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: qa-smoke-profile-${{ matrix.slug }}-${{ github.run_id }}-${{ github.run_attempt }}
|
|
path: .artifacts/qa-e2e/smoke-ci-profile-${{ matrix.slug }}/
|
|
if-no-files-found: warn
|
|
retention-days: 7
|
|
|
|
checks-fast-plugin-contracts-shard:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.checkName }}
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_plugin_contracts_shards == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 60
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 12
|
|
matrix: ${{ fromJson(needs.preflight.outputs.plugin_contracts_matrix) }}
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- name: Run plugin contract shard
|
|
env:
|
|
OPENCLAW_CONTRACT_INCLUDE_PATTERNS_JSON: ${{ toJson(matrix.includePatterns) }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
include_file="$RUNNER_TEMP/plugin-contract-include.json"
|
|
INCLUDE_FILE="$include_file" node --input-type=module <<'EOF'
|
|
import { writeFileSync } from "node:fs";
|
|
|
|
const includePatterns = JSON.parse(process.env.OPENCLAW_CONTRACT_INCLUDE_PATTERNS_JSON ?? "[]");
|
|
if (!Array.isArray(includePatterns) || includePatterns.length === 0) {
|
|
console.error("Missing plugin contract include patterns");
|
|
process.exit(1);
|
|
}
|
|
writeFileSync(process.env.INCLUDE_FILE, JSON.stringify(includePatterns), "utf8");
|
|
EOF
|
|
OPENCLAW_VITEST_INCLUDE_FILE="$include_file" pnpm test:contracts:plugins
|
|
|
|
checks-fast-channel-contracts-shard:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.checkName }}
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_channel_contracts_shards == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 60
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 12
|
|
matrix: ${{ fromJson(needs.preflight.outputs.channel_contracts_matrix) }}
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- name: Run channel contract shard
|
|
env:
|
|
OPENCLAW_CONTRACT_INCLUDE_PATTERNS_JSON: ${{ toJson(matrix.includePatterns) }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
include_file="$RUNNER_TEMP/channel-contract-include.json"
|
|
INCLUDE_FILE="$include_file" node --input-type=module <<'EOF'
|
|
import { writeFileSync } from "node:fs";
|
|
|
|
const includePatterns = JSON.parse(process.env.OPENCLAW_CONTRACT_INCLUDE_PATTERNS_JSON ?? "[]");
|
|
if (!Array.isArray(includePatterns) || includePatterns.length === 0) {
|
|
console.error("Missing channel contract include patterns");
|
|
process.exit(1);
|
|
}
|
|
writeFileSync(process.env.INCLUDE_FILE, JSON.stringify(includePatterns), "utf8");
|
|
EOF
|
|
OPENCLAW_VITEST_INCLUDE_FILE="$include_file" pnpm test:contracts:channels
|
|
|
|
checks-node-compat:
|
|
permissions:
|
|
contents: read
|
|
name: checks-node-compat-node22
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_build_artifacts == 'true' && github.event_name == 'workflow_dispatch'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 60
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: "22.22.3"
|
|
install-bun: "false"
|
|
build-all-cache-scope: full
|
|
|
|
- name: Configure Node test resources
|
|
run: echo "OPENCLAW_VITEST_MAX_WORKERS=2" >> "$GITHUB_ENV"
|
|
|
|
- name: Run Node 22 compatibility
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=8192
|
|
run: |
|
|
pnpm build
|
|
pnpm ui:build
|
|
node openclaw.mjs --help
|
|
node openclaw.mjs status --json --timeout 1
|
|
pnpm test:build:singleton
|
|
|
|
checks-node-core-test-nondist-shard:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.check_name }}
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_checks_node_core_nondist == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && (matrix.runner || 'blacksmith-4vcpu-ubuntu-2404') || 'ubuntu-24.04') }}
|
|
timeout-minutes: ${{ matrix.timeout_minutes || 60 }}
|
|
strategy:
|
|
fail-fast: false
|
|
# Canonical main admits only one complete run at a time, so widen this
|
|
# matrix within the current runner-registration budget.
|
|
max-parallel: 28
|
|
matrix: ${{ fromJson(needs.preflight.outputs.checks_node_core_nondist_matrix) }}
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
node-version: "${{ matrix.node_version || '24.x' }}"
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ (matrix.node_version == null || matrix.node_version == '24.x') && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ (matrix.node_version == null || matrix.node_version == '24.x') && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
vitest-fs-cache: "true"
|
|
node-compile-cache: "true"
|
|
node-compile-cache-scope: "test"
|
|
# CI shards only read the protected immutable seed. The scheduled or
|
|
# explicitly dispatched warmer is the sole test-cache writer.
|
|
|
|
- name: Setup Go for docs i18n
|
|
if: matrix.requires_go == true
|
|
# The current workflow validates frozen targets whose go.mod may predate this patch pin.
|
|
# Keep the runner toolchain owned by the workflow while using the target only for cache keys.
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: "1.25.12"
|
|
cache-dependency-path: scripts/docs-i18n/go.sum
|
|
|
|
- name: Verify docs i18n Go toolchain
|
|
if: matrix.requires_go == true
|
|
run: test "$(go env GOVERSION)" = "go1.25.12"
|
|
|
|
- name: Configure Node test resources
|
|
# Scale the in-process Vitest worker budget with the cores the job
|
|
# actually received: runner labels over-promise under fleet load
|
|
# (observed: a 16 vCPU label delivering a 4-CPU cgroup) and dispatch
|
|
# runs fall back to hosted runners regardless of matrix.runner.
|
|
# Serial-plan bins (planConcurrency 1) get the full budget; anything
|
|
# that can overlap Vitest processes keeps the proven 2-worker cap.
|
|
# Timing-sensitive groups stay pinned to 2 via plan-level env.
|
|
env:
|
|
SHARD_PLAN_CONCURRENCY: ${{ matrix.plan_concurrency || '' }}
|
|
run: |
|
|
cores="$(nproc)"
|
|
if [ "$SHARD_PLAN_CONCURRENCY" != "1" ]; then
|
|
workers=2
|
|
elif [ "$cores" -ge 12 ]; then
|
|
workers=6
|
|
elif [ "$cores" -ge 6 ]; then
|
|
workers=4
|
|
else
|
|
workers=3
|
|
fi
|
|
echo "detected cores=$cores plan_concurrency=${SHARD_PLAN_CONCURRENCY:-default} -> workers=$workers"
|
|
echo "OPENCLAW_VITEST_MAX_WORKERS=$workers" >> "$GITHUB_ENV"
|
|
|
|
- name: Checkout trusted Node shard runner
|
|
# Frozen release targets can predate the workflow-owned shard runner.
|
|
# Keep its implementation pinned to this workflow revision, while tests
|
|
# continue to run against the checked-out candidate.
|
|
if: ${{ hashFiles('scripts/ci-run-node-test-shard.mts') == '' }}
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ github.workflow_sha }}
|
|
path: .ci-workflow
|
|
sparse-checkout: |
|
|
scripts/ci-run-node-test-shard.mts
|
|
scripts/lib/direct-run.mjs
|
|
scripts/lib/local-heavy-check-runtime.mts
|
|
sparse-checkout-cone-mode: false
|
|
persist-credentials: false
|
|
|
|
- name: Run Node test shard
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=8192
|
|
OPENCLAW_NODE_TEST_GROUPS_JSON: ${{ toJson(matrix.groups || null) }}
|
|
OPENCLAW_NODE_TEST_CONFIGS_JSON: ${{ toJson(matrix.configs) }}
|
|
OPENCLAW_NODE_TEST_ENV_JSON: ${{ toJson(matrix.env) }}
|
|
OPENCLAW_NODE_TEST_INCLUDE_PATTERNS_JSON: ${{ toJson(matrix.includePatterns) }}
|
|
OPENCLAW_NODE_TEST_TARGETS_JSON: ${{ toJson(matrix.targets) }}
|
|
# Frozen targets can carry integration hooks whose cold setup exceeds
|
|
# the current defaults on shared release runners. Keep the no-output
|
|
# watchdog above Vitest so it cannot preempt hook diagnostics.
|
|
OPENCLAW_NODE_TEST_VITEST_ARGS_JSON: ${{ needs.preflight.outputs.compatibility_target == 'true' && '["--hookTimeout=600000"]' || '[]' }}
|
|
OPENCLAW_VITEST_SHARD_NAME: ${{ matrix.shard_name }}
|
|
OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS: ${{ needs.preflight.outputs.compatibility_target == 'true' && '660000' || '300000' }}
|
|
OPENCLAW_VITEST_NO_OUTPUT_RETRY: "1"
|
|
OPENCLAW_NODE_TEST_PLAN_CONCURRENCY: ${{ matrix.plan_concurrency }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
runner="scripts/ci-run-node-test-shard.mts"
|
|
if [[ ! -f "$runner" ]]; then
|
|
runner=".ci-workflow/${runner}"
|
|
[[ -f "$runner" ]]
|
|
fi
|
|
node --import tsx "$runner"
|
|
|
|
# Types, lint, and format check shards.
|
|
check-shard:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.check_name }}
|
|
needs: [preflight]
|
|
if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check == 'true' }}
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && (matrix.runner || 'blacksmith-4vcpu-ubuntu-2404') || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 12
|
|
matrix:
|
|
include:
|
|
- check_name: check-guards
|
|
task: guards
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-npm-lock
|
|
task: npm-lock
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-bundled-channel-config-metadata
|
|
task: bundled-channel-config-metadata
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-prod-types
|
|
task: prod-types
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-lint
|
|
task: lint
|
|
# Top light-run pole (~186s of shard work); oxlint shard
|
|
# concurrency scales with cores at similar billed core-minutes.
|
|
runner: blacksmith-32vcpu-ubuntu-2404
|
|
- check_name: check-dependencies
|
|
task: dependencies
|
|
# Concurrent Knip scans need cores and memory headroom; the wall
|
|
# clock roughly halves for similar billed core-minutes.
|
|
runner: blacksmith-32vcpu-ubuntu-2404
|
|
- check_name: check-test-types
|
|
task: test-types
|
|
# Slowest static lane (~3.5min on 4 vCPU); extra cores shorten the
|
|
# PR critical path for roughly the same billed core-minutes.
|
|
runner: blacksmith-16vcpu-ubuntu-2404
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
# check-lint's shard runner rebuilds the same plugin-sdk boundary
|
|
# artifacts the boundary lane snapshots (~72s cold); restore them from
|
|
# the shared sticky. Strictly read-only (commit: false): only the
|
|
# protected boundary lane may publish this repository-global snapshot.
|
|
- name: Mount extension boundary sticky disk
|
|
if: matrix.task == 'lint' && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw')
|
|
uses: useblacksmith/stickydisk@6d373c96a74cbde0c99fedc5ea5d3a7ba66ba494 # main (post-v1.4.0 hot-attach fix)
|
|
with:
|
|
# One stable disk for the whole repository. The v1 per-PR/per-config
|
|
# keys minted a new backing disk for every PR and toolchain change
|
|
# and helped saturate Blacksmith's installation-wide sticky-disk
|
|
# budget, 429-failing every mount. Snapshot validity lives in the
|
|
# in-job marker checked below instead of the key.
|
|
key: ${{ github.repository }}-ext-boundary-v2
|
|
path: /var/tmp/openclaw-ext-boundary
|
|
commit: "false"
|
|
|
|
- name: Restore extension boundary artifacts from sticky disk
|
|
if: matrix.task == 'lint' && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw')
|
|
shell: bash
|
|
env:
|
|
# Config/toolchain inputs the tree-OID gate below cannot see; must
|
|
# stay identical to the boundary lane's fingerprint composition.
|
|
BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'package.json', 'pnpm-lock.yaml') }}
|
|
run: |
|
|
set -euo pipefail
|
|
sticky_root=/var/tmp/openclaw-ext-boundary
|
|
if [ ! -f "$sticky_root/.snapshot-ready" ]; then
|
|
echo "boundary artifact snapshot not seeded yet; lint prepares cold"
|
|
exit 0
|
|
fi
|
|
# Same tree-OID gate as the boundary lane: restore only artifacts
|
|
# produced from identical generative sources, so stale snapshots can
|
|
# neither false-skip rebuilds nor leave ghost declarations.
|
|
current_trees="$({ git rev-parse HEAD:src/plugin-sdk HEAD:packages HEAD:extensions HEAD:src/auto-reply HEAD:src/types HEAD:src/plugins/types.ts HEAD:src/video-generation HEAD:src/channels; node --version; corepack pnpm --version 2>/dev/null || pnpm --version; echo "$BOUNDARY_CONFIG_HASH"; })"
|
|
if [ ! -f "$sticky_root/.source-trees" ] || [ "$current_trees" != "$(cat "$sticky_root/.source-trees")" ]; then
|
|
echo "boundary source trees changed since snapshot; lint prepares cold"
|
|
exit 0
|
|
fi
|
|
for payload in dist packages extensions; do
|
|
if [ -d "$sticky_root/$payload" ]; then
|
|
rsync -a "$sticky_root/$payload/" "$payload/"
|
|
fi
|
|
done
|
|
|
|
- name: Run check shard
|
|
env:
|
|
FROZEN_TARGET: ${{ needs.preflight.outputs.frozen_target }}
|
|
HISTORICAL_TARGET: ${{ needs.preflight.outputs.compatibility_target }}
|
|
FORMAT_CHECK: ${{ needs.preflight.outputs.run_format_check }}
|
|
RUN_CONTROL_UI_I18N: ${{ needs.preflight.outputs.run_control_ui_i18n }}
|
|
RUN_UI_TESTS: ${{ needs.preflight.outputs.run_ui_tests }}
|
|
OPENCLAW_LOCAL_CHECK: "0"
|
|
TASK: ${{ matrix.task }}
|
|
PR_BASE_SHA: ${{ github.event_name == 'pull_request' && needs.preflight.outputs.diff_base_revision || '' }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
has_package_script() {
|
|
node -e '
|
|
const scripts = require("./package.json").scripts ?? {};
|
|
process.exit(Object.hasOwn(scripts, process.argv[1]) ? 0 : 1);
|
|
' "$1"
|
|
}
|
|
case "$TASK" in
|
|
guards)
|
|
pnpm check:no-conflict-markers
|
|
if has_package_script "check:doctor-deprecation-registry"; then
|
|
pnpm check:doctor-deprecation-registry
|
|
elif [[ "$FROZEN_TARGET" == "true" ]]; then
|
|
echo "[skip] frozen target predates the wall-clock doctor deprecation registry guard"
|
|
else
|
|
echo "Current CI targets must provide the check:doctor-deprecation-registry package script." >&2
|
|
exit 1
|
|
fi
|
|
pnpm tool-display:check
|
|
pnpm check:host-env-policy:swift
|
|
pnpm dup:check:coverage
|
|
if [ -n "$PR_BASE_SHA" ]; then
|
|
timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags --depth=1 origin "+${PR_BASE_SHA}:refs/remotes/origin/ci-base"
|
|
node scripts/report-test-temp-creations.mjs --base refs/remotes/origin/ci-base --head HEAD --no-merge-base
|
|
fi
|
|
pnpm deps:patches:check
|
|
pnpm lint:webhook:no-low-level-body-read
|
|
pnpm lint:auth:no-pairing-store-group
|
|
pnpm lint:auth:pairing-account-scope
|
|
pnpm check:import-cycles
|
|
;;
|
|
npm-lock)
|
|
if has_package_script "deps:npm-lock:check"; then
|
|
pnpm deps:npm-lock:check
|
|
elif [[ "$HISTORICAL_TARGET" != "true" ]]; then
|
|
echo "Current CI targets must provide the deps:npm-lock:check package script." >&2
|
|
exit 1
|
|
else
|
|
echo "[skip] historical target predates the transient npm lock contract"
|
|
fi
|
|
;;
|
|
bundled-channel-config-metadata)
|
|
pnpm check:bundled-channel-config-metadata
|
|
;;
|
|
prod-types)
|
|
pnpm tsgo:prod
|
|
;;
|
|
lint)
|
|
# The i18n verify covers keys extracted from every ui/ source,
|
|
# not just ui/src/i18n; any ui-touching diff (run_ui_tests) or
|
|
# i18n-tooling diff must run it. oxlint always runs.
|
|
lint_args=(--threads=8)
|
|
if [ "$(nproc)" -lt 8 ]; then
|
|
# Fork PRs run on 4-core hosted runners with 16GB. Bound both
|
|
# the core process size and its threads so type-aware oxlint
|
|
# does not intermittently lose the runner under memory pressure.
|
|
lint_args=(--split-core --threads=1)
|
|
fi
|
|
if [ "$RUN_CONTROL_UI_I18N" = "true" ] || [ "$RUN_UI_TESTS" = "true" ]; then
|
|
pnpm lint "${lint_args[@]}"
|
|
else
|
|
echo "[skip] changed scope cannot affect control-UI i18n catalogs"
|
|
node --import tsx scripts/run-oxlint-shards.mts "${lint_args[@]}"
|
|
fi
|
|
if [ "$FORMAT_CHECK" = "true" ]; then
|
|
pnpm format:check
|
|
fi
|
|
;;
|
|
dependencies)
|
|
# The beta.1 release commit backported this workflow-only helper after its
|
|
# Knip config was frozen. Register that exact executable root without
|
|
# weakening the target's remaining dead-code scan.
|
|
release_evidence_entry='"scripts/generate-dependency-release-evidence.mts!"'
|
|
if [[
|
|
"$FROZEN_TARGET" == "true" &&
|
|
-f scripts/generate-dependency-release-evidence.mts &&
|
|
-f config/knip.config.ts
|
|
]] && ! grep -Fq "$release_evidence_entry" config/knip.config.ts; then
|
|
RELEASE_EVIDENCE_ENTRY="$release_evidence_entry" node --input-type=module -e '
|
|
import { readFileSync, writeFileSync } from "node:fs";
|
|
const configPath = "config/knip.config.ts";
|
|
const marker = "const repositoryScriptEntries = [";
|
|
const source = readFileSync(configPath, "utf8");
|
|
if (!source.includes(marker)) throw new Error(`${configPath} is missing ${marker}`);
|
|
writeFileSync(configPath, source.replace(
|
|
marker,
|
|
`${marker}\n ${process.env.RELEASE_EVIDENCE_ENTRY},`,
|
|
));
|
|
'
|
|
fi
|
|
if has_package_script "deadcode:dependencies" &&
|
|
has_package_script "deadcode:unused-files"; then
|
|
# The three deadcode scripts spawn independent Knip scans over
|
|
# separate configs; run them concurrently (with buffered logs
|
|
# so output stays readable) instead of paying ~3 minutes of
|
|
# serial scanning.
|
|
dc_scripts=(deadcode:dependencies deadcode:unused-files)
|
|
if has_package_script "deadcode:exports"; then
|
|
dc_scripts+=(deadcode:exports)
|
|
elif [[ "$HISTORICAL_TARGET" != "true" ]]; then
|
|
echo "Current CI targets must provide the deadcode:exports package script." >&2
|
|
exit 1
|
|
fi
|
|
if [ "$(nproc)" -lt 8 ]; then
|
|
# Hosted/dispatch runners are too small for up to seven
|
|
# concurrent Knip processes; keep the serial path there.
|
|
for dc in "${dc_scripts[@]}"; do
|
|
pnpm "$dc"
|
|
done
|
|
else
|
|
dc_pids=()
|
|
dc_logs=()
|
|
for dc in "${dc_scripts[@]}"; do
|
|
dc_log="$(mktemp -t deadcode-log.XXXXXX)"
|
|
dc_logs+=("$dc_log")
|
|
pnpm "$dc" >"$dc_log" 2>&1 &
|
|
dc_pids+=($!)
|
|
done
|
|
dc_failures=0
|
|
for i in "${!dc_scripts[@]}"; do
|
|
if wait "${dc_pids[$i]}"; then
|
|
echo "[ok] ${dc_scripts[$i]}"
|
|
else
|
|
echo "::error title=${dc_scripts[$i]} failed::${dc_scripts[$i]} failed"
|
|
dc_failures=1
|
|
fi
|
|
cat "${dc_logs[$i]}"
|
|
done
|
|
if [ "$dc_failures" -ne 0 ]; then
|
|
exit 1
|
|
fi
|
|
fi
|
|
elif [[ "$HISTORICAL_TARGET" == "true" ]] && has_package_script "deadcode:ci"; then
|
|
pnpm deadcode:ci
|
|
else
|
|
echo "Target does not provide a supported deadcode check." >&2
|
|
exit 1
|
|
fi
|
|
;;
|
|
test-types)
|
|
pnpm check:test-types
|
|
if pnpm run --silent 2>/dev/null | grep -q '^ tsgo:scripts$'; then
|
|
pnpm tsgo:scripts
|
|
elif [[ "$HISTORICAL_TARGET" != "true" ]]; then
|
|
echo "Current CI targets must provide the tsgo:scripts package script." >&2
|
|
exit 1
|
|
fi
|
|
if pnpm run --silent 2>/dev/null | grep -q '^ tsgo:test:root$'; then
|
|
pnpm tsgo:test:root
|
|
elif [[ "$HISTORICAL_TARGET" != "true" ]]; then
|
|
echo "Current CI targets must provide the tsgo:test:root package script." >&2
|
|
exit 1
|
|
fi
|
|
;;
|
|
*)
|
|
echo "Unsupported check task: $TASK" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
check-additional-shard:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.check_name }}
|
|
needs: [preflight]
|
|
if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check_additional == 'true' }}
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && (matrix.runner || 'blacksmith-4vcpu-ubuntu-2404') || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 12
|
|
matrix:
|
|
include:
|
|
- check_name: check-additional-boundaries-a
|
|
group: boundaries
|
|
boundary_shard: 1/4
|
|
runner: blacksmith-8vcpu-ubuntu-2404
|
|
- check_name: check-additional-boundaries-bcd
|
|
group: boundaries
|
|
boundary_shard: 2/4,3/4,4/4
|
|
runner: blacksmith-8vcpu-ubuntu-2404
|
|
# Prompt snapshot regeneration evaluates the full agent tool/prompt
|
|
# import graph and used to own the boundaries-a wall clock; keep it
|
|
# in its own lane.
|
|
- check_name: check-prompt-snapshots
|
|
group: prompt-snapshots
|
|
runner: blacksmith-8vcpu-ubuntu-2404
|
|
- check_name: check-export-name-collisions
|
|
group: export-name-collisions
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-session-accessor-boundary
|
|
group: session-accessor-boundary
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-session-transcript-reader-boundary
|
|
group: session-transcript-reader-boundary
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-sqlite-session-schema-baseline
|
|
group: sqlite-session-schema-baseline
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-plugin-sdk-api-baseline
|
|
group: plugin-sdk-api-baseline
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
- check_name: check-sqlite-session-flip-proof
|
|
group: sqlite-session-flip-proof
|
|
runner: blacksmith-8vcpu-ubuntu-2404
|
|
- check_name: check-additional-extension-package-boundary
|
|
group: extension-package-boundary
|
|
# Light-run critical-path pole: cold runs spend ~100s in nine
|
|
# parallel plugin-sdk dts builds plus ~58s compiling 122 plugins
|
|
# at concurrency 6 on 8 vCPUs. Both phases scale with cores at
|
|
# similar billed core-minutes.
|
|
runner: blacksmith-32vcpu-ubuntu-2404
|
|
- check_name: check-additional-runtime-topology-architecture
|
|
group: runtime-topology-architecture
|
|
runner: blacksmith-4vcpu-ubuntu-2404
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
# Same-repo runs carry boundary artifacts on a Blacksmith sticky disk:
|
|
# the GitHub cache below is evicted so quickly under the repo quota that
|
|
# its prefix restore never hits, leaving every run to rebuild ~113s of
|
|
# plugin-sdk declarations. Fork PRs must never produce writable
|
|
# repository-global snapshots, so they keep the GitHub cache path.
|
|
- name: Mount extension boundary sticky disk
|
|
if: matrix.group == 'extension-package-boundary' && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw')
|
|
uses: useblacksmith/stickydisk@6d373c96a74cbde0c99fedc5ea5d3a7ba66ba494 # main (post-v1.4.0 hot-attach fix)
|
|
with:
|
|
# One stable disk for the whole repository. The v1 per-PR/per-config
|
|
# keys minted a new backing disk for every PR and toolchain change
|
|
# and helped saturate Blacksmith's installation-wide sticky-disk
|
|
# budget, 429-failing every mount. Snapshot validity lives in the
|
|
# in-job marker checked below instead of the key, so source and
|
|
# toolchain changes refresh this disk in place.
|
|
key: ${{ github.repository }}-ext-boundary-v2
|
|
path: /var/tmp/openclaw-ext-boundary
|
|
# Single semantic writer: only protected pushes commit, so
|
|
# pull_request clones stay read-only and the snapshot tracks main.
|
|
# Explicit true (not on-change/if-missing) because the allocated-byte
|
|
# heuristic can miss a same-size refresh, permanently stranding
|
|
# consumers on a stale marker. v1.4.0 skips commit after
|
|
# failed/cancelled steps, so a broken build cannot poison this key.
|
|
commit: ${{ github.event_name != 'pull_request' && 'true' || 'false' }}
|
|
|
|
- name: Restore extension boundary artifacts from sticky disk
|
|
id: boundary-sticky-restore
|
|
if: matrix.group == 'extension-package-boundary' && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw')
|
|
shell: bash
|
|
env:
|
|
# Config/toolchain inputs the tree-OID gate below cannot see; must
|
|
# stay identical to the seed step and check-lint's restore gate.
|
|
BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'package.json', 'pnpm-lock.yaml') }}
|
|
run: |
|
|
set -euo pipefail
|
|
sticky_root=/var/tmp/openclaw-ext-boundary
|
|
if [ ! -f "$sticky_root/.snapshot-ready" ]; then
|
|
echo "restored=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
# Restore only when the generative source trees AND the runner
|
|
# toolchain match the snapshotting run. Tree OIDs cover source
|
|
# content exactly; the node/pnpm versions and the config hash cover
|
|
# toolchain/config/scripts/lockfile changes the OIDs cannot see.
|
|
# Restored artifacts are valid by construction: no clock-skew mtime
|
|
# race can false-skip a rebuild, and deleted/renamed sources or a
|
|
# toolchain bump build cold.
|
|
current_trees="$({ git rev-parse HEAD:src/plugin-sdk HEAD:packages HEAD:extensions HEAD:src/auto-reply HEAD:src/types HEAD:src/plugins/types.ts HEAD:src/video-generation HEAD:src/channels; node --version; corepack pnpm --version 2>/dev/null || pnpm --version; echo "$BOUNDARY_CONFIG_HASH"; })"
|
|
if [ ! -f "$sticky_root/.source-trees" ] || [ "$current_trees" != "$(cat "$sticky_root/.source-trees")" ]; then
|
|
echo "boundary source trees changed since snapshot; building cold"
|
|
echo "restored=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
for payload in dist packages extensions; do
|
|
if [ -d "$sticky_root/$payload" ]; then
|
|
rsync -a "$sticky_root/$payload/" "$payload/"
|
|
fi
|
|
done
|
|
echo "restored=true" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Cache extension package boundary artifacts
|
|
id: extension-package-boundary-cache
|
|
if: matrix.group == 'extension-package-boundary'
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: |
|
|
dist/plugin-sdk
|
|
packages/plugin-sdk/dist
|
|
extensions/*/dist/.boundary-tsc.tsbuildinfo
|
|
extensions/*/dist/.boundary-tsc.stamp
|
|
key: ${{ runner.os }}-extension-package-boundary-v1-${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'packages/llm-core/package.json', 'packages/model-catalog-core/package.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'src/plugin-sdk/**', 'src/plugins/types.ts', 'src/auto-reply/**', 'packages/llm-core/src/**', 'packages/model-catalog-core/src/**', 'src/video-generation/dashscope-compatible.ts', 'src/video-generation/types.ts', 'src/types/**', 'extensions/**', 'extensions/tsconfig.package-boundary*.json', 'package.json', 'pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-extension-package-boundary-v1-
|
|
|
|
- name: Preserve extension package boundary cache hit
|
|
if: matrix.group == 'extension-package-boundary' && steps.extension-package-boundary-cache.outputs.cache-hit == 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
find extensions \
|
|
-path '*/dist' -prune -o \
|
|
-path '*/node_modules' -prune -o \
|
|
-type f \( -name '*.ts' -o -name '*.tsx' -o -name '*.mts' -o -name '*.cts' -o -name '*.js' -o -name '*.mjs' -o -name '*.json' \) \
|
|
-exec touch -t 200001010000 {} +
|
|
find src \
|
|
-type f \( -name '*.ts' -o -name '*.tsx' -o -name '*.mts' -o -name '*.cts' -o -name '*.js' -o -name '*.mjs' -o -name '*.json' \) \
|
|
-exec touch -t 200001010000 {} +
|
|
if [ -d packages/llm-core/src ]; then
|
|
find packages/llm-core/src \
|
|
-type f \( -name '*.ts' -o -name '*.tsx' -o -name '*.mts' -o -name '*.cts' -o -name '*.js' -o -name '*.mjs' -o -name '*.json' \) \
|
|
-exec touch -t 200001010000 {} +
|
|
fi
|
|
if [ -d packages/model-catalog-core/src ]; then
|
|
find packages/model-catalog-core/src \
|
|
-type f \( -name '*.ts' -o -name '*.tsx' -o -name '*.mts' -o -name '*.cts' -o -name '*.js' -o -name '*.mjs' -o -name '*.json' \) \
|
|
-exec touch -t 200001010000 {} +
|
|
fi
|
|
cache_inputs=(
|
|
tsconfig.json \
|
|
tsconfig.plugin-sdk.dts.json \
|
|
packages/plugin-sdk/tsconfig.json \
|
|
packages/llm-core/package.json \
|
|
packages/model-catalog-core/package.json \
|
|
scripts/check-extension-package-tsc-boundary.mts \
|
|
scripts/prepare-extension-package-boundary-artifacts.mts \
|
|
scripts/write-plugin-sdk-entry-dts.ts \
|
|
scripts/lib/plugin-sdk-entrypoints.json \
|
|
scripts/lib/plugin-sdk-entries.mts \
|
|
package.json \
|
|
pnpm-lock.yaml
|
|
)
|
|
for cache_input in "${cache_inputs[@]}"; do
|
|
if [ -e "$cache_input" ]; then
|
|
touch -t 200001010000 "$cache_input"
|
|
fi
|
|
done
|
|
|
|
- name: Run additional check shard
|
|
env:
|
|
ADDITIONAL_CHECK_GROUP: ${{ matrix.group }}
|
|
RUN_PROMPT_SNAPSHOTS: ${{ needs.preflight.outputs.run_prompt_snapshots }}
|
|
OPENCLAW_ADDITIONAL_BOUNDARY_SHARD: ${{ matrix.boundary_shard || '' }}
|
|
OPENCLAW_ADDITIONAL_BOUNDARY_CONCURRENCY: 4
|
|
# Matches the boundary lane's 32 vCPU runner (cores/2); the
|
|
# script's default caps at 6 to protect laptops.
|
|
OPENCLAW_EXTENSION_BOUNDARY_CONCURRENCY: 16
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
failures=0
|
|
|
|
run_check() {
|
|
local label="$1"
|
|
shift
|
|
|
|
echo "::group::${label}"
|
|
if "$@"; then
|
|
echo "[ok] ${label}"
|
|
else
|
|
echo "::error title=${label} failed::${label} failed"
|
|
failures=1
|
|
fi
|
|
echo "::endgroup::"
|
|
}
|
|
|
|
case "$ADDITIONAL_CHECK_GROUP" in
|
|
boundaries)
|
|
boundary_runner=(node --import tsx scripts/run-additional-boundary-checks.mts)
|
|
if [[ ! -f scripts/run-additional-boundary-checks.mts ]]; then
|
|
boundary_runner=(node scripts/run-additional-boundary-checks.mjs)
|
|
fi
|
|
"${boundary_runner[@]}"
|
|
;;
|
|
prompt-snapshots)
|
|
# No presence fallback: the boundary runner previously invoked
|
|
# this unconditionally, and silent success would drop snapshot
|
|
# drift coverage. The manifest gates the lane on the generator's
|
|
# import graph and fixtures; diffs outside both cannot change
|
|
# generated snapshots.
|
|
if [ "$RUN_PROMPT_SNAPSHOTS" != "true" ]; then
|
|
echo "[skip] changed scope cannot affect generated prompt snapshots"
|
|
else
|
|
run_check "prompt:snapshots:check" pnpm prompt:snapshots:check
|
|
fi
|
|
;;
|
|
export-name-collisions)
|
|
if [ ! -f scripts/check-export-name-collisions.mts ]; then
|
|
echo "[skip] export name collision check is not present in this checkout"
|
|
elif ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["lint:tmp:export-name-collisions"] ? 0 : 1);'; then
|
|
echo "[skip] export name collision script is not present in package.json"
|
|
else
|
|
run_check "lint:tmp:export-name-collisions" pnpm run lint:tmp:export-name-collisions
|
|
fi
|
|
;;
|
|
session-accessor-boundary)
|
|
if ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["lint:tmp:session-accessor-boundary"] ? 0 : 1);'; then
|
|
echo "[skip] session accessor boundary script is not present in package.json"
|
|
else
|
|
run_check "lint:tmp:session-accessor-boundary" pnpm run lint:tmp:session-accessor-boundary
|
|
fi
|
|
if ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["lint:tmp:sqlite-transaction-boundary"] ? 0 : 1);'; then
|
|
echo "[skip] SQLite transaction boundary script is not present in package.json"
|
|
else
|
|
run_check "lint:tmp:sqlite-transaction-boundary" pnpm run lint:tmp:sqlite-transaction-boundary
|
|
fi
|
|
;;
|
|
session-transcript-reader-boundary)
|
|
if ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["lint:tmp:session-transcript-reader-boundary"] ? 0 : 1);'; then
|
|
echo "[skip] session transcript reader boundary script is not present in package.json"
|
|
else
|
|
run_check "lint:tmp:session-transcript-reader-boundary" pnpm run lint:tmp:session-transcript-reader-boundary
|
|
fi
|
|
;;
|
|
sqlite-session-schema-baseline)
|
|
if ! node -e 'const pkg = require("./package.json"); process.exit(pkg.scripts?.["sqlite:sessions-schema:check"] ? 0 : 1);'; then
|
|
echo "[skip] SQLite sessions/transcripts schema baseline script is not present in package.json"
|
|
else
|
|
run_check "sqlite:sessions-schema:check" pnpm run sqlite:sessions-schema:check
|
|
fi
|
|
;;
|
|
plugin-sdk-api-baseline)
|
|
run_check "plugin-sdk:api:check" pnpm run plugin-sdk:api:check
|
|
;;
|
|
sqlite-session-flip-proof)
|
|
if [ ! -f test/scripts/sqlite-sessions-transcripts-flip-proof.e2e.test.ts ]; then
|
|
echo "[skip] SQLite sessions/transcripts flip proof is not present in this checkout"
|
|
else
|
|
# This lane owns a 420-second E2E case plus cold hosted-runner setup;
|
|
# keep the global watchdog strict and scope compatibility headroom here.
|
|
run_check "sqlite sessions/transcripts flip proof" env OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS=660000 node scripts/run-vitest.mjs run --config test/vitest/vitest.e2e.config.ts test/scripts/sqlite-sessions-transcripts-flip-proof.e2e.test.ts
|
|
fi
|
|
;;
|
|
extension-package-boundary)
|
|
run_check "test:extensions:package-boundary:compile" pnpm run test:extensions:package-boundary:compile
|
|
run_check "test:extensions:package-boundary:canary" pnpm run test:extensions:package-boundary:canary
|
|
;;
|
|
runtime-topology-architecture)
|
|
run_check "check:architecture" pnpm check:architecture
|
|
;;
|
|
*)
|
|
echo "Unsupported additional check group: $ADDITIONAL_CHECK_GROUP" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
exit "$failures"
|
|
|
|
# Only the protected writer refreshes the snapshot (pull_request mounts
|
|
# never commit, so seeding there would burn wall clock on a discarded
|
|
# clone). Seed the payload before the sticky post-action flushes.
|
|
# rsync -aR mirrors the repo-relative layout the restore step replays.
|
|
- name: Seed extension boundary sticky disk
|
|
if: success() && steps.boundary-sticky-restore.outputs.restored == 'false' && matrix.group == 'extension-package-boundary' && github.event_name != 'workflow_dispatch' && github.event_name != 'pull_request' && github.repository == 'openclaw/openclaw'
|
|
shell: bash
|
|
env:
|
|
# Must stay identical to the restore gates above.
|
|
BOUNDARY_CONFIG_HASH: ${{ hashFiles('tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'packages/plugin-sdk/tsconfig.json', 'scripts/check-extension-package-tsc-boundary.mts', 'scripts/prepare-extension-package-boundary-artifacts.mts', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entrypoints.json', 'scripts/lib/plugin-sdk-entries.mts', 'package.json', 'pnpm-lock.yaml') }}
|
|
run: |
|
|
set -euo pipefail
|
|
sticky_root=/var/tmp/openclaw-ext-boundary
|
|
# A stale marker must not survive a mid-seed failure: drop readiness
|
|
# first so a partial payload can never be restored as valid.
|
|
rm -rf "$sticky_root/.snapshot-ready" "$sticky_root/.source-trees" "$sticky_root/dist" "$sticky_root/packages" "$sticky_root/extensions"
|
|
if [ -d dist/plugin-sdk ]; then
|
|
rsync -aR dist/plugin-sdk "$sticky_root/"
|
|
fi
|
|
if [ -d packages/plugin-sdk/dist ]; then
|
|
rsync -aR packages/plugin-sdk/dist "$sticky_root/"
|
|
fi
|
|
find extensions -maxdepth 3 \( -name '.boundary-tsc.tsbuildinfo' -o -name '.boundary-tsc.stamp' \) \
|
|
-exec rsync -aR {} "$sticky_root/" \;
|
|
{ git rev-parse HEAD:src/plugin-sdk HEAD:packages HEAD:extensions HEAD:src/auto-reply HEAD:src/types HEAD:src/plugins/types.ts HEAD:src/video-generation HEAD:src/channels; node --version; corepack pnpm --version 2>/dev/null || pnpm --version; echo "$BOUNDARY_CONFIG_HASH"; } > "$sticky_root/.source-trees"
|
|
touch "$sticky_root/.snapshot-ready"
|
|
|
|
# Validate docs (format, lint, broken links) only when docs files changed.
|
|
check-docs:
|
|
permissions:
|
|
contents: read
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_check_docs == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
steps:
|
|
- *linux_node_checkout_step
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
# Blacksmith same-repo runs clone dependencies from a sticky disk.
|
|
# Fork PRs must keep actions/cache: sticky snapshots are writable,
|
|
# repository-global state and must never be produced by fork code.
|
|
sticky-disk: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'true' || 'false' }}
|
|
use-actions-cache: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'false' || 'true' }}
|
|
|
|
- name: Check formatting
|
|
if: needs.preflight.outputs.run_format_check == 'true'
|
|
run: pnpm format:check
|
|
|
|
- name: Checkout ClawHub docs source
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
workdir="$GITHUB_WORKSPACE/clawhub-source"
|
|
started_at="$(date +%s)"
|
|
|
|
reset_checkout_dir() {
|
|
mkdir -p "$workdir"
|
|
find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
|
|
}
|
|
|
|
checkout_attempt() {
|
|
local attempt="$1"
|
|
|
|
reset_checkout_dir
|
|
git init "$workdir" >/dev/null
|
|
git -C "$workdir" config gc.auto 0
|
|
git -C "$workdir" remote add origin "https://github.com/openclaw/clawhub.git"
|
|
|
|
timeout --signal=TERM --kill-after=10s 120s git -C "$workdir" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
|
|
"+refs/heads/main:refs/remotes/origin/checkout" || return 1
|
|
|
|
git -C "$workdir" checkout --force --detach refs/remotes/origin/checkout || return 1
|
|
echo "ClawHub checkout attempt ${attempt}/5 succeeded"
|
|
}
|
|
|
|
for attempt in 1 2 3 4 5; do
|
|
if checkout_attempt "$attempt"; then
|
|
elapsed="$(( $(date +%s) - started_at ))"
|
|
echo "ClawHub checkout completed in ${elapsed}s"
|
|
exit 0
|
|
fi
|
|
echo "ClawHub checkout attempt ${attempt}/5 failed"
|
|
sleep $((attempt * 5))
|
|
done
|
|
|
|
echo "ClawHub checkout failed after 5 attempts" >&2
|
|
exit 1
|
|
|
|
- name: Check docs
|
|
env:
|
|
OPENCLAW_DOCS_SYNC_CLAWHUB_REPO: ${{ github.workspace }}/clawhub-source
|
|
run: pnpm check:docs
|
|
|
|
skills-python:
|
|
permissions:
|
|
contents: read
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_skills_python_job == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
env:
|
|
CHECKOUT_REPO: ${{ github.repository }}
|
|
CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
|
|
run: |
|
|
set -euo pipefail
|
|
git init "$GITHUB_WORKSPACE"
|
|
git -C "$GITHUB_WORKSPACE" config gc.auto 0
|
|
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
|
|
fetch_checkout_ref() {
|
|
local fetch_status
|
|
for attempt in 1 2 3; do
|
|
timeout --signal=TERM --kill-after=10s 120s git -C "$GITHUB_WORKSPACE" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
|
|
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout" && return 0
|
|
fetch_status="$?"
|
|
if [ "$fetch_status" != "124" ] && [ "$fetch_status" != "137" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
if [ "$attempt" = "3" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
echo "::warning::checkout fetch for '$CHECKOUT_SHA' timed out on attempt $attempt; retrying"
|
|
sleep 5
|
|
done
|
|
}
|
|
fetch_checkout_ref
|
|
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install Python tooling
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
python -m pip install pytest ruff pyyaml
|
|
|
|
- name: Lint Python skill scripts
|
|
run: python -m ruff check --config skills/pyproject.toml skills
|
|
|
|
- name: Test skill Python scripts
|
|
run: python -m pytest -q -c skills/pyproject.toml skills
|
|
|
|
checks-windows:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.check_name }}
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_checks_windows == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'windows-2025' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && (matrix.runner || 'blacksmith-8vcpu-windows-2025') || 'windows-2025') }}
|
|
timeout-minutes: 60
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=8192
|
|
# Keep total concurrency predictable on the smaller Windows runner.
|
|
OPENCLAW_VITEST_MAX_WORKERS: 1
|
|
OPENCLAW_TEST_SKIP_FULL_EXTENSIONS_SHARD: 1
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 2
|
|
matrix: ${{ fromJson(needs.preflight.outputs.checks_windows_matrix) }}
|
|
steps:
|
|
- &platform_checkout_step
|
|
name: Checkout
|
|
env:
|
|
CHECKOUT_REPO: ${{ github.repository }}
|
|
CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
|
|
run: |
|
|
set -euo pipefail
|
|
git init "$GITHUB_WORKSPACE"
|
|
git -C "$GITHUB_WORKSPACE" config gc.auto 0
|
|
git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
|
|
fetch_timeout_seconds=90
|
|
fetch_checkout_ref_once() {
|
|
git -C "$GITHUB_WORKSPACE" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
|
|
"+${CHECKOUT_SHA}:refs/remotes/origin/checkout" &
|
|
local fetch_pid="$!"
|
|
local elapsed=0
|
|
while kill -0 "$fetch_pid" 2>/dev/null; do
|
|
if [ "$elapsed" -ge "$fetch_timeout_seconds" ]; then
|
|
kill -TERM "$fetch_pid" 2>/dev/null || true
|
|
sleep 10
|
|
kill -KILL "$fetch_pid" 2>/dev/null || true
|
|
wait "$fetch_pid" || true
|
|
return 124
|
|
fi
|
|
sleep 1
|
|
elapsed=$((elapsed + 1))
|
|
done
|
|
wait "$fetch_pid"
|
|
}
|
|
fetch_checkout_ref() {
|
|
local fetch_status
|
|
for attempt in 1 2 3; do
|
|
fetch_checkout_ref_once && return 0
|
|
fetch_status="$?"
|
|
if [ "$fetch_status" != "124" ] && [ "$fetch_status" != "137" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
if [ "$attempt" = "3" ]; then
|
|
return "$fetch_status"
|
|
fi
|
|
echo "::warning::checkout fetch for '$CHECKOUT_SHA' timed out on attempt $attempt; retrying"
|
|
sleep 5
|
|
done
|
|
}
|
|
fetch_checkout_ref
|
|
git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
|
|
|
|
- name: Try to exclude workspace from Windows Defender (best-effort)
|
|
shell: pwsh
|
|
run: |
|
|
$cmd = Get-Command Add-MpPreference -ErrorAction SilentlyContinue
|
|
if (-not $cmd) {
|
|
Write-Host "Add-MpPreference not available, skipping Defender exclusions."
|
|
exit 0
|
|
}
|
|
|
|
try {
|
|
# Defender sometimes intercepts process spawning (vitest workers). If this fails
|
|
# (eg hardened images), keep going and rely on worker limiting above.
|
|
Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE" -ErrorAction Stop
|
|
Add-MpPreference -ExclusionProcess "node.exe" -ErrorAction Stop
|
|
Write-Host "Defender exclusions applied."
|
|
} catch {
|
|
Write-Warning "Failed to apply Defender exclusions, continuing. $($_.Exception.Message)"
|
|
}
|
|
|
|
- name: Setup Node.js
|
|
env:
|
|
REQUESTED_NODE_VERSION: "22.x"
|
|
run: |
|
|
set -euo pipefail
|
|
source .github/actions/setup-pnpm-store-cache/ensure-node.sh
|
|
openclaw_ensure_node "$REQUESTED_NODE_VERSION"
|
|
|
|
- name: Setup pnpm
|
|
uses: ./.github/actions/setup-pnpm-store-cache
|
|
with:
|
|
node-version: 22.x
|
|
|
|
- name: Runtime versions
|
|
run: |
|
|
node -v
|
|
npm -v
|
|
pnpm -v
|
|
|
|
- name: Capture node path
|
|
run: |
|
|
node_bin="$(dirname "$(node -p 'process.execPath')")"
|
|
if command -v cygpath >/dev/null 2>&1; then
|
|
node_bin="$(cygpath -u "$node_bin")"
|
|
fi
|
|
echo "NODE_BIN=$node_bin" >> "$GITHUB_ENV"
|
|
|
|
- name: Install dependencies
|
|
env:
|
|
CI: true
|
|
run: |
|
|
export PATH="$NODE_BIN:$PATH"
|
|
which node
|
|
node -v
|
|
pnpm -v
|
|
# Persist Windows-native postinstall outputs in the pnpm store so restored
|
|
# caches can skip repeated rebuild/download work on later shards/runs.
|
|
pnpm install --frozen-lockfile --prefer-offline --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true --config.side-effects-cache=true || pnpm install --frozen-lockfile --prefer-offline --ignore-scripts=false --config.engine-strict=false --config.enable-pre-post-scripts=true --config.side-effects-cache=true
|
|
|
|
- name: Run ${{ matrix.task }} (${{ matrix.runtime }})
|
|
env:
|
|
TASK: ${{ matrix.task }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
case "$TASK" in
|
|
test)
|
|
# Linux owns the full repo test suite. Keep the Windows runner focused on
|
|
# Windows-native process/path wrappers so platform regressions fail fast.
|
|
pnpm test:windows:ci
|
|
;;
|
|
*)
|
|
echo "Unsupported Windows checks task: $TASK" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
macos-node:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.check_name }}
|
|
needs: [preflight]
|
|
if: ${{ !cancelled() && always() && needs.preflight.outputs.run_macos_node == 'true' }}
|
|
runs-on: ${{ (github.event_name == 'workflow_dispatch' || github.run_attempt > 1) && 'macos-15' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-6vcpu-macos-15' || 'macos-15') }}
|
|
timeout-minutes: 20
|
|
strategy:
|
|
fail-fast: false
|
|
matrix: ${{ fromJson(needs.preflight.outputs.macos_node_matrix) }}
|
|
steps:
|
|
- *platform_checkout_step
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
|
|
- name: TS tests (macOS)
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=4096
|
|
OPENCLAW_VITEST_MAX_WORKERS: 2
|
|
TASK: ${{ matrix.task }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
case "$TASK" in
|
|
test)
|
|
# Linux owns the full repo test suite. Keep macOS CI focused on
|
|
# launchd/Homebrew/runtime path coverage and the process-group wrapper.
|
|
pnpm test:macos:ci
|
|
;;
|
|
*)
|
|
echo "Unsupported macOS node task: $TASK" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
macos-swift:
|
|
permissions:
|
|
contents: read
|
|
name: "macos-swift"
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_macos_swift == 'true'
|
|
runs-on: ${{ (github.event_name == 'workflow_dispatch' || github.run_attempt > 1) && 'macos-26' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-12vcpu-macos-26' || 'macos-26') }}
|
|
# Hosted runs may still be finalizing large Swift caches after every test
|
|
# passes; keep that post-job work non-blocking.
|
|
timeout-minutes: ${{ (github.event_name == 'workflow_dispatch' || github.run_attempt > 1) && 30 || 20 }}
|
|
env:
|
|
HISTORICAL_TARGET: ${{ needs.preflight.outputs.compatibility_target }}
|
|
SWIFT_TEST_EXECUTION: ${{ (github.event_name == 'workflow_dispatch' || github.run_attempt > 1) && 'serial' || 'parallel' }}
|
|
steps:
|
|
- *platform_checkout_step
|
|
|
|
- name: Install XcodeGen / SwiftLint / SwiftFormat
|
|
run: |
|
|
if [[ -x ./scripts/install-xcodegen.sh && -x ./scripts/install-swift-tools.sh ]]; then
|
|
swift_tools_dir="$RUNNER_TEMP/openclaw-swift-tools"
|
|
./scripts/install-xcodegen.sh "$swift_tools_dir"
|
|
./scripts/install-swift-tools.sh "$swift_tools_dir"
|
|
echo "$swift_tools_dir" >> "$GITHUB_PATH"
|
|
"$swift_tools_dir/xcodegen" --version
|
|
"$swift_tools_dir/swiftformat" --version
|
|
"$swift_tools_dir/swiftlint" version
|
|
elif [[ "$HISTORICAL_TARGET" == "true" ]]; then
|
|
# Frozen release targets before the pinned installer used one of these
|
|
# reviewed formatter contracts. Fail closed for any unknown minimum.
|
|
brew update
|
|
brew install xcodegen swiftlint
|
|
swiftformat_min_version="$(awk '$1 == "--min-version" { print $2; exit }' config/swiftformat)"
|
|
case "$swiftformat_min_version" in
|
|
""|0.61.1)
|
|
swiftformat_version="0.61.1"
|
|
swiftformat_checksum="b990400779aceb7d7020796eb9ba814d4480543f671d38fc0ff48cb72f04c584"
|
|
;;
|
|
0.62.1)
|
|
swiftformat_version="0.62.1"
|
|
swiftformat_checksum="7cb1cb1fae04932047c7015441c543848e8e60e1572d808d080e0a1f1661114a"
|
|
;;
|
|
*)
|
|
echo "Unsupported frozen-target SwiftFormat minimum: $swiftformat_min_version" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
swiftformat_archive="$RUNNER_TEMP/swiftformat-$swiftformat_version.zip"
|
|
swift_tools_dir="$RUNNER_TEMP/openclaw-legacy-swift-tools"
|
|
curl --fail --location --silent --show-error \
|
|
--connect-timeout 10 --max-time 120 \
|
|
--retry 3 --retry-max-time 120 \
|
|
--output "$swiftformat_archive" \
|
|
"https://github.com/nicklockwood/SwiftFormat/releases/download/$swiftformat_version/swiftformat.zip"
|
|
if [[ "$(shasum -a 256 "$swiftformat_archive" | awk '{print $1}')" != "$swiftformat_checksum" ]]; then
|
|
echo "SwiftFormat $swiftformat_version archive checksum mismatch" >&2
|
|
exit 1
|
|
fi
|
|
mkdir -p "$swift_tools_dir"
|
|
unzip -q "$swiftformat_archive" -d "$swift_tools_dir"
|
|
chmod +x "$swift_tools_dir/swiftformat"
|
|
echo "$swift_tools_dir" >> "$GITHUB_PATH"
|
|
[[ "$("$swift_tools_dir/swiftformat" --version)" == "$swiftformat_version" ]]
|
|
else
|
|
echo "Current CI targets must provide scripts/install-xcodegen.sh and scripts/install-swift-tools.sh." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Detect Swift toolchain cache key
|
|
id: swift-toolchain
|
|
run: |
|
|
set -euo pipefail
|
|
xcode_version="$(xcodebuild -version | tr '\n' ' ' | sed 's/ */ /g; s/ $//')"
|
|
swift_version="$(swift --version | head -n 1)"
|
|
toolchain_key="$(printf '%s\n%s\n' "$xcode_version" "$swift_version" | shasum -a 256 | awk '{print $1}')"
|
|
echo "key=$toolchain_key" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Cache SwiftPM
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: ~/Library/Caches/org.swift.swiftpm
|
|
key: ${{ runner.os }}-swiftpm-${{ hashFiles('apps/macos/Package.resolved') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-swiftpm-
|
|
|
|
- name: Cache Swift build directory
|
|
id: swift-build-cache
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: apps/macos/.build
|
|
key: ${{ runner.os }}-swift-build-v3-${{ steps.swift-toolchain.outputs.key }}-${{ hashFiles('apps/macos/Package.swift', 'apps/macos/Package.resolved', 'apps/macos/Sources/**', 'apps/macos/Tests/**', 'apps/shared/OpenClawKit/Package.swift', 'apps/shared/OpenClawKit/Sources/**', 'apps/swabble/Package.swift', 'apps/swabble/Sources/**') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-swift-build-v3-${{ steps.swift-toolchain.outputs.key }}-
|
|
|
|
- name: Validate Swift build cache
|
|
id: validate-swift-build-cache
|
|
run: |
|
|
set -euo pipefail
|
|
cache_valid=true
|
|
sparkle_info="apps/macos/.build/artifacts/sparkle/Sparkle/Sparkle.xcframework/Info.plist"
|
|
if [[ -d apps/macos/.build && ! -f "$sparkle_info" ]]; then
|
|
echo "::warning::Swift build cache is missing Sparkle; resetting the local SwiftPM build directory."
|
|
swift package --package-path apps/macos reset
|
|
cache_valid=false
|
|
fi
|
|
echo "cache-valid=$cache_valid" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Preserve Swift build cache hit
|
|
if: steps.swift-build-cache.outputs.cache-hit == 'true' && steps.validate-swift-build-cache.outputs.cache-valid == 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
# Exact source-hash cache hits already match these inputs; checkout
|
|
# mtimes are the only reason SwiftPM rebuilds cached products.
|
|
find apps/macos/Sources apps/macos/Tests apps/shared/OpenClawKit/Sources apps/swabble/Sources apps/macos/.build/checkouts \
|
|
-type f -exec touch -t 200001010000 {} +
|
|
touch -t 200001010000 \
|
|
apps/macos/Package.swift \
|
|
apps/macos/Package.resolved \
|
|
apps/shared/OpenClawKit/Package.swift \
|
|
apps/swabble/Package.swift
|
|
|
|
- name: Show toolchain
|
|
run: |
|
|
sw_vers
|
|
xcodebuild -version
|
|
swift --version
|
|
|
|
- name: Native state schema version contract
|
|
run: |
|
|
if [[ -f scripts/check-native-state-schema-version.mjs ]]; then
|
|
node scripts/check-native-state-schema-version.mjs
|
|
elif [[ "$HISTORICAL_TARGET" == "true" ]]; then
|
|
echo "[skip] native state schema version guard is not present in this historical target"
|
|
else
|
|
echo "Current CI targets must provide scripts/check-native-state-schema-version.mjs." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Swift lint
|
|
run: |
|
|
if [[ -x ./scripts/lint-swift.sh && -x ./scripts/format-swift.sh ]]; then
|
|
./scripts/lint-swift.sh macos
|
|
./scripts/format-swift.sh macos
|
|
elif [[ "$HISTORICAL_TARGET" == "true" ]]; then
|
|
# Frozen release targets before the shared wrappers used these commands directly.
|
|
swiftlint lint --config config/swiftlint.yml
|
|
swiftformat --lint apps/macos/Sources --config config/swiftformat --exclude '**/OpenClawProtocol,**/HostEnvSecurityPolicy.generated.swift'
|
|
else
|
|
echo "Current CI targets must provide the Swift lint and format wrappers." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Swift build (release)
|
|
run: |
|
|
set -euo pipefail
|
|
for attempt in 1 2 3; do
|
|
# The macOS lane validates the desktop app build; the CLI product is
|
|
# intentionally left to its own narrower surfaces instead of making
|
|
# this lane rebuild the whole package graph.
|
|
if swift build --package-path apps/macos --product OpenClaw --configuration release; then
|
|
exit 0
|
|
fi
|
|
if [[ "$attempt" -eq 3 ]]; then
|
|
break
|
|
fi
|
|
echo "swift build failed (attempt $attempt/3). Retrying…"
|
|
# SwiftPM can invalidate a restored binary artifact while planning.
|
|
# Reset so the next attempt downloads a complete dependency graph.
|
|
swift package --package-path apps/macos reset
|
|
sleep $((attempt * 20))
|
|
done
|
|
exit 1
|
|
|
|
- name: OpenClawKit Talk-trait opt-out (no ElevenLabsKit when default traits disabled)
|
|
run: |
|
|
set -euo pipefail
|
|
# Guard: chat-only consumers build OpenClawKit with the Talk trait
|
|
# disabled and must NOT link ElevenLabsKit. Assert that future sources
|
|
# under OpenClawKit cannot silently reintroduce an unconditional
|
|
# ElevenLabsKit dependency while the manifest still looks correct.
|
|
deps="$(swift package --package-path apps/shared/OpenClawKit show-dependencies --disable-default-traits)"
|
|
echo "$deps"
|
|
if grep -qi 'elevenlabs' <<<"$deps"; then
|
|
echo "::error::ElevenLabsKit resolved with the Talk trait disabled; keep it gated behind the Talk trait."
|
|
exit 1
|
|
fi
|
|
swift build --package-path apps/shared/OpenClawKit --target OpenClawKit --disable-default-traits
|
|
|
|
# openclawkit-tests-contract-v1: the target owns an independently runnable package suite.
|
|
- name: OpenClawKit tests
|
|
if: needs.preflight.outputs.run_openclawkit_tests == 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
openclawkit_scratch="$(mktemp -d "$RUNNER_TEMP/openclawkit.XXXXXX")"
|
|
trap 'rm -rf "$openclawkit_scratch"' EXIT
|
|
swift test \
|
|
--package-path apps/shared/OpenClawKit \
|
|
--scratch-path "$openclawkit_scratch" \
|
|
--parallel
|
|
|
|
- name: Swift test
|
|
run: |
|
|
set -euo pipefail
|
|
swift_test_args=(--package-path apps/macos --enable-code-coverage)
|
|
# Hosted release and retry runs have shown test-process contention;
|
|
# keep the faster first-attempt Blacksmith path parallel.
|
|
if [[ "$SWIFT_TEST_EXECUTION" == "parallel" ]]; then
|
|
swift_test_args+=(--parallel)
|
|
else
|
|
swift_test_args+=(--no-parallel)
|
|
fi
|
|
for attempt in 1 2 3; do
|
|
if swift test "${swift_test_args[@]}"; then
|
|
exit 0
|
|
fi
|
|
echo "swift test failed (attempt $attempt/3). Retrying…"
|
|
sleep $((attempt * 20))
|
|
done
|
|
exit 1
|
|
|
|
ios-build:
|
|
permissions:
|
|
contents: read
|
|
name: "ios-build"
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_ios_build == 'true'
|
|
runs-on: ${{ (github.event_name == 'workflow_dispatch' || github.run_attempt > 1) && 'macos-26' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-12vcpu-macos-26' || 'macos-26') }}
|
|
timeout-minutes: 150
|
|
env:
|
|
HISTORICAL_TARGET: ${{ needs.preflight.outputs.compatibility_target }}
|
|
steps:
|
|
- *platform_checkout_step
|
|
|
|
- name: Select Xcode 26
|
|
run: |
|
|
set -euo pipefail
|
|
for xcode_app in /Applications/Xcode_26.5.app /Applications/Xcode-26.5.0.app; do
|
|
if [ -d "$xcode_app/Contents/Developer" ]; then
|
|
sudo xcode-select -s "$xcode_app/Contents/Developer"
|
|
break
|
|
fi
|
|
done
|
|
xcodebuild -version
|
|
xcode_version="$(xcodebuild -version | awk 'NR == 1 { print $2 }')"
|
|
if [[ "$xcode_version" != 26.* ]]; then
|
|
echo "error: expected Xcode 26.x, got $xcode_version" >&2
|
|
exit 1
|
|
fi
|
|
swift --version
|
|
|
|
- name: Setup Node environment
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
|
|
- name: Install iOS Swift tooling
|
|
run: |
|
|
if [[ -x ./scripts/install-xcodegen.sh && -x ./scripts/install-swift-tools.sh ]]; then
|
|
swift_tools_dir="$RUNNER_TEMP/openclaw-swift-tools"
|
|
./scripts/install-xcodegen.sh "$swift_tools_dir"
|
|
./scripts/install-swift-tools.sh "$swift_tools_dir"
|
|
echo "$swift_tools_dir" >> "$GITHUB_PATH"
|
|
"$swift_tools_dir/xcodegen" --version
|
|
"$swift_tools_dir/swiftformat" --version
|
|
"$swift_tools_dir/swiftlint" version
|
|
elif [[ "$HISTORICAL_TARGET" == "true" ]]; then
|
|
# The generated Xcode project runs SwiftFormat during the build, so
|
|
# frozen targets must keep the formatter contract they were authored for.
|
|
brew update
|
|
brew install xcodegen swiftlint
|
|
swiftformat_min_version="$(awk '$1 == "--min-version" { print $2; exit }' config/swiftformat)"
|
|
case "$swiftformat_min_version" in
|
|
""|0.61.1)
|
|
swiftformat_version="0.61.1"
|
|
swiftformat_checksum="b990400779aceb7d7020796eb9ba814d4480543f671d38fc0ff48cb72f04c584"
|
|
;;
|
|
0.62.1)
|
|
swiftformat_version="0.62.1"
|
|
swiftformat_checksum="7cb1cb1fae04932047c7015441c543848e8e60e1572d808d080e0a1f1661114a"
|
|
;;
|
|
*)
|
|
echo "Unsupported frozen-target SwiftFormat minimum: $swiftformat_min_version" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
swiftformat_archive="$RUNNER_TEMP/swiftformat-$swiftformat_version.zip"
|
|
swift_tools_dir="$RUNNER_TEMP/openclaw-legacy-swift-tools"
|
|
curl --fail --location --silent --show-error \
|
|
--connect-timeout 10 --max-time 120 \
|
|
--retry 3 --retry-max-time 120 \
|
|
--output "$swiftformat_archive" \
|
|
"https://github.com/nicklockwood/SwiftFormat/releases/download/$swiftformat_version/swiftformat.zip"
|
|
if [[ "$(shasum -a 256 "$swiftformat_archive" | awk '{print $1}')" != "$swiftformat_checksum" ]]; then
|
|
echo "SwiftFormat $swiftformat_version archive checksum mismatch" >&2
|
|
exit 1
|
|
fi
|
|
mkdir -p "$swift_tools_dir"
|
|
unzip -q "$swiftformat_archive" -d "$swift_tools_dir"
|
|
chmod +x "$swift_tools_dir/swiftformat"
|
|
echo "$swift_tools_dir" >> "$GITHUB_PATH"
|
|
[[ "$("$swift_tools_dir/swiftformat" --version)" == "$swiftformat_version" ]]
|
|
# Legacy generated Xcode phases prepend Homebrew ahead of GITHUB_PATH.
|
|
# Point that lookup at the verified binary or the build can bypass the pin.
|
|
swiftformat_link="$(brew --prefix)/bin/swiftformat"
|
|
ln -sfn "$swift_tools_dir/swiftformat" "$swiftformat_link"
|
|
[[ "$("$swiftformat_link" --version)" == "$swiftformat_version" ]]
|
|
else
|
|
echo "Current CI targets must provide scripts/install-xcodegen.sh and scripts/install-swift-tools.sh." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Swift lint
|
|
run: |
|
|
if [[ -x ./scripts/lint-swift.sh && -x ./scripts/format-swift.sh ]]; then
|
|
./scripts/lint-swift.sh ios
|
|
./scripts/format-swift.sh ios
|
|
else
|
|
# Frozen release targets before the iOS lint lane have no equivalent target-owned step.
|
|
echo "Swift lint wrappers are absent; skipping iOS lint for this frozen target."
|
|
fi
|
|
|
|
- name: Build iOS app
|
|
run: pnpm ios:build
|
|
|
|
# Debug's incremental compilation can miss actor-isolation diagnostics
|
|
# that Swift's optimized whole-module Release build enforces.
|
|
- name: Build iOS app (Release)
|
|
if: env.HISTORICAL_TARGET != 'true'
|
|
run: |
|
|
xcodebuild \
|
|
-project apps/ios/OpenClaw.xcodeproj \
|
|
-scheme OpenClaw \
|
|
-configuration Release \
|
|
-destination "generic/platform=iOS" \
|
|
CODE_SIGNING_ALLOWED=NO \
|
|
build
|
|
|
|
# App compilation and screenshots do not execute approval or notification
|
|
# lifecycles. Exercise both owners on the already provisioned simulator.
|
|
- name: Run focused iOS lifecycle simulator tests
|
|
id: ios_lifecycle_tests
|
|
if: env.HISTORICAL_TARGET != 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
simulator_id="$(
|
|
xcrun simctl list devices available --json | node --input-type=module -e '
|
|
const chunks = [];
|
|
for await (const chunk of process.stdin) chunks.push(chunk);
|
|
const runtimes = JSON.parse(Buffer.concat(chunks).toString("utf8")).devices;
|
|
const simulator = Object.values(runtimes)
|
|
.flat()
|
|
.find((device) => device.isAvailable && device.name.startsWith("iPhone"));
|
|
if (!simulator) {
|
|
console.error("No available iPhone simulator for iOS lifecycle tests");
|
|
process.exit(1);
|
|
}
|
|
process.stdout.write(simulator.udid);
|
|
'
|
|
)"
|
|
result_bundle="apps/ios/build/LifecycleTestResults/OpenClawLifecycleTests.xcresult"
|
|
mkdir -p "apps/ios/build/LifecycleTestResults"
|
|
xcodebuild \
|
|
-project apps/ios/OpenClaw.xcodeproj \
|
|
-scheme OpenClaw \
|
|
-configuration Debug \
|
|
-destination "platform=iOS Simulator,id=${simulator_id}" \
|
|
-resultBundlePath "$result_bundle" \
|
|
-parallel-testing-enabled NO \
|
|
-only-testing:OpenClawTests/DelayedActionGateTests \
|
|
-only-testing:OpenClawTests/NodeAppModelInvokeTests \
|
|
-only-testing:OpenClawTests/NotificationServingPreferenceTests \
|
|
-only-testing:OpenClawTests/RootTabsSourceGuardTests \
|
|
-only-testing:OpenClawTests/TraceHeadingVisualProofTests \
|
|
test
|
|
|
|
- name: Upload iOS lifecycle simulator evidence
|
|
if: ${{ always() && steps.ios_lifecycle_tests.outcome != '' && steps.ios_lifecycle_tests.outcome != 'skipped' }}
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: ios-lifecycle-tests-${{ needs.preflight.outputs.checkout_revision }}
|
|
path: apps/ios/build/LifecycleTestResults/*.xcresult
|
|
if-no-files-found: warn
|
|
retention-days: 14
|
|
|
|
- name: Capture iOS release screenshots
|
|
if: ${{ (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && needs.preflight.outputs.run_macos == 'true')) && env.HISTORICAL_TARGET != 'true' }}
|
|
run: pnpm ios:screenshots
|
|
|
|
- name: Upload iOS release screenshot evidence
|
|
if: ${{ always() && (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && needs.preflight.outputs.run_macos == 'true')) && env.HISTORICAL_TARGET != 'true' }}
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: ios-release-screenshots-${{ needs.preflight.outputs.checkout_revision }}
|
|
path: |
|
|
apps/ios/fastlane/screenshots/en-US/*.png
|
|
apps/ios/build/SnapshotTestResults/*.xcresult
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
|
|
android:
|
|
permissions:
|
|
contents: read
|
|
name: ${{ matrix.check_name }}
|
|
needs: [preflight]
|
|
if: needs.preflight.outputs.run_android_job == 'true'
|
|
runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04') }}
|
|
timeout-minutes: 20
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 2
|
|
matrix: ${{ fromJson(needs.preflight.outputs.android_matrix) }}
|
|
steps:
|
|
- name: Checkout
|
|
shell: bash
|
|
env:
|
|
CHECKOUT_REPO: ${{ github.repository }}
|
|
CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
workdir="$GITHUB_WORKSPACE"
|
|
reset_checkout_dir() {
|
|
mkdir -p "$workdir"
|
|
find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
|
|
}
|
|
|
|
checkout_attempt() {
|
|
local attempt="$1"
|
|
|
|
reset_checkout_dir
|
|
git init "$workdir" >/dev/null
|
|
git config --global --add safe.directory "$workdir"
|
|
git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
|
|
git -C "$workdir" config gc.auto 0
|
|
|
|
timeout --signal=TERM --kill-after=10s 120s git -C "$workdir" \
|
|
-c protocol.version=2 \
|
|
fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
|
|
"+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1
|
|
|
|
git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1
|
|
test -x "$workdir/apps/android/gradlew" || return 1
|
|
echo "checkout attempt ${attempt}/5 succeeded"
|
|
}
|
|
|
|
for attempt in 1 2 3 4 5; do
|
|
if checkout_attempt "$attempt"; then
|
|
exit 0
|
|
fi
|
|
echo "checkout attempt ${attempt}/5 failed"
|
|
sleep $((attempt * 5))
|
|
done
|
|
|
|
echo "checkout failed after 5 attempts" >&2
|
|
exit 1
|
|
|
|
- name: Checkout CI Android toolchain action
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ github.workflow_sha }}
|
|
path: .ci-workflow
|
|
sparse-checkout: .github/actions/setup-android-toolchain
|
|
persist-credentials: false
|
|
|
|
- name: Setup Android toolchain
|
|
# Frozen targets keep their Gradle task contract, but CI toolchain pins remain
|
|
# workflow-owned as before. Load them from the workflow revision so old targets work.
|
|
uses: ./.ci-workflow/.github/actions/setup-android-toolchain
|
|
|
|
- name: Setup Node environment for native resources
|
|
if: needs.preflight.outputs.use_compatible_android_ci != 'true'
|
|
uses: ./.github/actions/setup-node-env
|
|
with:
|
|
install-bun: "false"
|
|
|
|
# Same-repo runs carry the Gradle user home (dependency, wrapper, and
|
|
# build caches) on a Blacksmith sticky disk: the setup-java gradle cache
|
|
# above is evicted so quickly under the repo quota that it rarely
|
|
# restores, leaving every run to re-resolve the full dependency graph.
|
|
# Fork PRs and manual dispatches must never produce writable
|
|
# repository-global snapshots, so they keep the GitHub cache path (their
|
|
# runs-on already selects non-Blacksmith ubuntu-24.04 runners).
|
|
- name: Mount Gradle sticky disk
|
|
if: github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw')
|
|
uses: useblacksmith/stickydisk@6d373c96a74cbde0c99fedc5ea5d3a7ba66ba494 # main (post-v1.4.0 hot-attach fix)
|
|
with:
|
|
# One stable disk per matrix task. The v1 per-PR/per-dependency-hash
|
|
# keys minted a new backing disk for every PR and dependency bump
|
|
# and helped saturate Blacksmith's installation-wide sticky-disk
|
|
# budget, 429-failing every mount. Task scope stays in the key: each
|
|
# matrix task resolves a different dependency set, and a shared key
|
|
# would let a light task (ktlint) pin a thin snapshot the heavy
|
|
# build lanes can never repair. Dependency-file changes live in the
|
|
# runtime fingerprint marker below instead of the key.
|
|
key: ${{ github.repository }}-gradle-v2-${{ matrix.task }}
|
|
path: /var/tmp/openclaw-gradle
|
|
# Single semantic writer: only protected pushes commit, so
|
|
# pull_request clones stay read-only and the snapshot tracks main.
|
|
# Explicit true (not on-change) because the allocated-byte heuristic
|
|
# can miss a same-size refresh and strand the fingerprint marker;
|
|
# v1.4.0 still skips commit after failed/cancelled steps, so a
|
|
# broken build cannot poison this key.
|
|
commit: ${{ github.event_name != 'pull_request' && 'true' || 'false' }}
|
|
|
|
- name: Point Gradle at the sticky disk
|
|
if: github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw')
|
|
shell: bash
|
|
env:
|
|
# Gradle caches are content-addressed, so a stale snapshot is safe
|
|
# to restore (obsolete entries are simply ignored). The fingerprint
|
|
# only bounds disk growth: when dependency inputs change, the writer
|
|
# rebuilds its snapshot from scratch so retired dependency artifacts
|
|
# do not accumulate on the O(1) key forever.
|
|
GRADLE_DEPS_FINGERPRINT: ${{ hashFiles('apps/android/**/*.gradle*', 'apps/android/**/gradle-wrapper.properties', 'apps/android/gradle/libs.versions.toml') }}
|
|
STICKY_WRITER: ${{ github.event_name != 'pull_request' && 'true' || 'false' }}
|
|
run: |
|
|
set -euo pipefail
|
|
sticky_root=/var/tmp/openclaw-gradle
|
|
marker="$sticky_root/.openclaw-gradle-deps-fingerprint"
|
|
disk_fingerprint=""
|
|
if [ -f "$marker" ]; then
|
|
disk_fingerprint="$(<"$marker")"
|
|
fi
|
|
if [ "$disk_fingerprint" != "$GRADLE_DEPS_FINGERPRINT" ]; then
|
|
if [ "$STICKY_WRITER" = "true" ]; then
|
|
echo "Gradle dependency inputs changed; rebuilding snapshot cold to drop retired artifacts"
|
|
rm -rf "$sticky_root/gradle-user-home"
|
|
printf '%s\n' "$GRADLE_DEPS_FINGERPRINT" > "$marker"
|
|
else
|
|
echo "Gradle dependency inputs changed since snapshot; content-addressed caches stay safe to reuse"
|
|
fi
|
|
fi
|
|
mkdir -p "$sticky_root/gradle-user-home"
|
|
echo "GRADLE_USER_HOME=$sticky_root/gradle-user-home" >> "$GITHUB_ENV"
|
|
|
|
- name: Run Android ${{ matrix.task }}
|
|
working-directory: apps/android
|
|
env:
|
|
TASK: ${{ matrix.task }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
case "$TASK" in
|
|
test-play)
|
|
./gradlew --no-daemon --build-cache \
|
|
:app:testPlayDebugUnitTest \
|
|
:wear-shared:testDebugUnitTest
|
|
;;
|
|
test-play-compat)
|
|
# Frozen targets predate the Wear shared project. Keep their app-owned
|
|
# Play unit tests without importing current Android modules.
|
|
./gradlew --no-daemon --build-cache :app:testPlayDebugUnitTest
|
|
;;
|
|
test-third-party)
|
|
./gradlew --no-daemon --build-cache :app:testThirdPartyDebugUnitTest
|
|
;;
|
|
test-wear)
|
|
./gradlew --no-daemon --build-cache :wear:testDebugUnitTest
|
|
;;
|
|
build-play)
|
|
./gradlew --no-daemon --build-cache \
|
|
:app:assemblePlayDebug \
|
|
:app:assembleThirdPartyDebug \
|
|
:app:lintPlayDebug \
|
|
:app:lintThirdPartyDebug \
|
|
:benchmark:assembleDebug \
|
|
:wear-shared:assembleDebug \
|
|
:wear-shared:lintDebug
|
|
;;
|
|
build-wear)
|
|
./gradlew --no-daemon --build-cache \
|
|
:wear:assembleDebug \
|
|
:wear:lintDebug
|
|
;;
|
|
build-play-compat)
|
|
# Frozen targets keep their target-owned Android build contract. New lint rules
|
|
# must not retroactively reject a previously validated release branch.
|
|
./gradlew --no-daemon --build-cache :app:assemblePlayDebug
|
|
;;
|
|
ktlint)
|
|
# Mirrors `pnpm android:lint`; keeps formatting drift out of main (see PR #100304 sweep).
|
|
./gradlew --no-daemon --build-cache \
|
|
:app:ktlintCheck \
|
|
:benchmark:ktlintCheck \
|
|
:wear:ktlintCheck \
|
|
:wear-shared:ktlintCheck
|
|
;;
|
|
*)
|
|
echo "Unsupported Android task: $TASK" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
ci-gate:
|
|
permissions:
|
|
contents: read
|
|
name: openclaw/ci-gate
|
|
needs:
|
|
- preflight
|
|
- security-fast
|
|
- pnpm-store-warmup
|
|
- build-artifacts
|
|
- native-i18n
|
|
- checks-ui
|
|
- checks-ui-e2e
|
|
- checks-ui-e2e-real-gateway
|
|
- control-ui-i18n
|
|
- checks-fast-core
|
|
- qa-smoke-ci-profile
|
|
- checks-fast-plugin-contracts-shard
|
|
- checks-fast-channel-contracts-shard
|
|
- checks-node-compat
|
|
- checks-node-core-test-nondist-shard
|
|
- check-shard
|
|
- check-additional-shard
|
|
- check-docs
|
|
- skills-python
|
|
- checks-windows
|
|
- macos-node
|
|
- macos-swift
|
|
- ios-build
|
|
- android
|
|
if: ${{ always() && (github.event_name != 'pull_request' || !github.event.pull_request.draft) }}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Verify selected CI lanes
|
|
shell: bash
|
|
env:
|
|
REQUIRED_RESULTS: |
|
|
preflight=${{ needs.preflight.result }}
|
|
security-fast=${{ needs.security-fast.result }}
|
|
SELECTED_RESULTS: |
|
|
pnpm-store-warmup=${{ needs.pnpm-store-warmup.result }}
|
|
build-artifacts=${{ needs.build-artifacts.result }}
|
|
native-i18n=${{ needs.native-i18n.result }}
|
|
checks-ui=${{ needs.checks-ui.result }}
|
|
checks-ui-e2e=${{ needs.checks-ui-e2e.result }}
|
|
checks-ui-e2e-real-gateway=${{ needs.checks-ui-e2e-real-gateway.result }}
|
|
control-ui-i18n=${{ needs.control-ui-i18n.result }}
|
|
checks-fast-core=${{ needs.checks-fast-core.result }}
|
|
qa-smoke-ci-profile=${{ needs.qa-smoke-ci-profile.result }}
|
|
checks-fast-plugin-contracts-shard=${{ needs.checks-fast-plugin-contracts-shard.result }}
|
|
checks-fast-channel-contracts-shard=${{ needs.checks-fast-channel-contracts-shard.result }}
|
|
checks-node-compat=${{ needs.checks-node-compat.result }}
|
|
checks-node-core-test-nondist-shard=${{ needs.checks-node-core-test-nondist-shard.result }}
|
|
check-shard=${{ needs.check-shard.result }}
|
|
check-additional-shard=${{ needs.check-additional-shard.result }}
|
|
check-docs=${{ needs.check-docs.result }}
|
|
skills-python=${{ needs.skills-python.result }}
|
|
checks-windows=${{ needs.checks-windows.result }}
|
|
macos-node=${{ needs.macos-node.result }}
|
|
macos-swift=${{ needs.macos-swift.result }}
|
|
ios-build=${{ needs.ios-build.result }}
|
|
android=${{ needs.android.result }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
failures=0
|
|
while IFS= read -r entry; do
|
|
[[ -n "$entry" ]] || continue
|
|
name="${entry%%=*}"
|
|
result="${entry#*=}"
|
|
echo "${name}: ${result}"
|
|
if [[ "$result" != "success" ]]; then
|
|
echo "::error title=Required CI job did not succeed::${name} finished with ${result}"
|
|
failures=1
|
|
fi
|
|
done <<< "$REQUIRED_RESULTS"
|
|
|
|
while IFS= read -r entry; do
|
|
[[ -n "$entry" ]] || continue
|
|
name="${entry%%=*}"
|
|
result="${entry#*=}"
|
|
echo "${name}: ${result}"
|
|
case "$result" in
|
|
success | skipped) ;;
|
|
*)
|
|
echo "::error title=Selected CI job did not succeed::${name} finished with ${result}"
|
|
failures=1
|
|
;;
|
|
esac
|
|
done <<< "$SELECTED_RESULTS"
|
|
|
|
exit "$failures"
|
|
|
|
ci-timings-summary:
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
name: ci-timings-summary
|
|
needs:
|
|
- preflight
|
|
- security-fast
|
|
- pnpm-store-warmup
|
|
- build-artifacts
|
|
- checks-ui
|
|
- checks-ui-e2e
|
|
- checks-ui-e2e-real-gateway
|
|
- control-ui-i18n
|
|
- checks-fast-core
|
|
- checks-fast-plugin-contracts-shard
|
|
- checks-fast-channel-contracts-shard
|
|
- checks-node-compat
|
|
- checks-node-core-test-nondist-shard
|
|
- check-shard
|
|
- check-additional-shard
|
|
- check-docs
|
|
- skills-python
|
|
- checks-windows
|
|
- macos-node
|
|
- macos-swift
|
|
- ios-build
|
|
- android
|
|
# TODO(2026-10-01): Re-enable or delete the CI timing-summary job after the next timing-optimization review.
|
|
if: ${{ false && !cancelled() && always() && github.event_name != 'push' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) }}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Checkout timing summary helper
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || needs.preflight.outputs.checkout_revision || github.sha }}
|
|
fetch-depth: 1
|
|
fetch-tags: false
|
|
persist-credentials: false
|
|
submodules: false
|
|
|
|
- name: Write CI timing summary
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
node scripts/ci-run-timings.mjs "$GITHUB_RUN_ID" --limit 25 > ci-timings-summary.txt
|
|
cat ci-timings-summary.txt >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Upload CI timing summary
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: ci-timings-summary
|
|
path: ci-timings-summary.txt
|
|
retention-days: 14
|