name: CI

on:

workflow_dispatch:

inputs:

target_ref:

description: Optional branch, tag, or full commit SHA to validate instead of the workflow ref

required: false

default: ""

type: string

include_android:

description: Run Android lanes for this manual CI dispatch.

required: false

default: false

type: boolean

release_gate:

description: Run an exact-SHA maintainer release-gate fallback when PR CI is capacity-stalled.

required: false

default: false

type: boolean

push:

branches: [main]

paths-ignore:

- "**/*.md"

- "docs/**"

pull_request:

types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]

paths-ignore:

- "CHANGELOG.md"

permissions:

contents: read

run-name: ${{ github.event_name == 'workflow_dispatch' && inputs.release_gate && format('CI release gate {0}', inputs.target_ref) || 'CI' }}

concurrency:

group: ${{ github.event_name == 'workflow_dispatch' && format('{0}-manual-v1-{1}', github.workflow, github.run_id) || (github.event_name == 'pull_request' && format('{0}-v7-{1}', github.workflow, github.event.pull_request.number) || (github.repository == 'openclaw/openclaw' && format('{0}-v7-{1}', github.workflow, github.ref) || format('{0}-v7-{1}-{2}', github.workflow, github.ref, github.sha))) }}

cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.repository == 'openclaw/openclaw' && github.ref == 'refs/heads/main') }}

env:

FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:

# Keep the canonical main queue quiet long enough for a follow-up push to

# cancel this run before it registers the Blacksmith matrix.

runner-admission:

permissions:

contents: read

runs-on: ubuntu-24.04

timeout-minutes: 3

env:

OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS: "90"

steps:

- name: Debounce canonical main pushes

if: github.event_name == 'push' && github.repository == 'openclaw/openclaw' && github.ref == 'refs/heads/main'

run: |

set -euo pipefail

echo "Waiting ${OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS}s for a superseding main push before Blacksmith admission"

sleep "${OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS}"

- name: Admit non-main CI runs immediately

if: github.event_name != 'push' || github.repository != 'openclaw/openclaw' || github.ref != 'refs/heads/main'

run: echo "No canonical main debounce required"

# Preflight: establish routing truth and job matrices once, then let real

# work fan out from a single source of truth.

preflight:

permissions:

contents: read

needs: [runner-admission]

if: github.event_name != 'pull_request' || !github.event.pull_request.draft

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20

outputs:

checkout_revision: ${{ steps.checkout_ref.outputs.sha }}

docs_only: ${{ steps.manifest.outputs.docs_only }}

docs_changed: ${{ steps.manifest.outputs.docs_changed }}

run_node: ${{ steps.manifest.outputs.run_node }}

run_macos: ${{ steps.manifest.outputs.run_macos }}

run_android: ${{ steps.manifest.outputs.run_android }}

run_skills_python: ${{ steps.manifest.outputs.run_skills_python }}

run_skills_python_job: ${{ steps.manifest.outputs.run_skills_python_job }}

run_windows: ${{ steps.manifest.outputs.run_windows }}

run_build_artifacts: ${{ steps.manifest.outputs.run_build_artifacts }}

run_checks_fast_core: ${{ steps.manifest.outputs.run_checks_fast_core }}

run_checks_fast: ${{ steps.manifest.outputs.run_checks_fast }}

checks_fast_core_matrix: ${{ steps.manifest.outputs.checks_fast_core_matrix }}

run_plugin_contracts_shards: ${{ steps.manifest.outputs.run_plugin_contracts_shards }}

plugin_contracts_matrix: ${{ steps.manifest.outputs.plugin_contracts_matrix }}

channel_contracts_matrix: ${{ steps.manifest.outputs.channel_contracts_matrix }}

run_checks: ${{ steps.manifest.outputs.run_checks }}

run_checks_node_core_nondist: ${{ steps.manifest.outputs.run_checks_node_core_nondist }}

checks_node_core_nondist_matrix: ${{ steps.manifest.outputs.checks_node_core_nondist_matrix }}

run_checks_node_core_dist: ${{ steps.manifest.outputs.run_checks_node_core_dist }}

run_check: ${{ steps.manifest.outputs.run_check }}

run_check_additional: ${{ steps.manifest.outputs.run_check_additional }}

run_check_docs: ${{ steps.manifest.outputs.run_check_docs }}

run_control_ui_i18n: ${{ steps.manifest.outputs.run_control_ui_i18n }}

run_native_i18n: ${{ steps.manifest.outputs.run_native_i18n }}

run_checks_windows: ${{ steps.manifest.outputs.run_checks_windows }}

checks_windows_matrix: ${{ steps.manifest.outputs.checks_windows_matrix }}

run_macos_node: ${{ steps.manifest.outputs.run_macos_node }}

macos_node_matrix: ${{ steps.manifest.outputs.macos_node_matrix }}

run_macos_swift: ${{ steps.manifest.outputs.run_macos_swift }}

run_ios_build: ${{ steps.manifest.outputs.run_ios_build }}

run_android_job: ${{ steps.manifest.outputs.run_android_job }}

android_matrix: ${{ steps.manifest.outputs.android_matrix }}

steps:

- name: Validate release-gate dispatch

if: github.event_name == 'workflow_dispatch' && inputs.release_gate

env:

TARGET_REF: ${{ inputs.target_ref }}

run: |

set -euo pipefail

if [[ ! "$TARGET_REF" =~ ^[0-9a-f]{40}$ ]]; then

echo "release_gate requires target_ref to be a full commit SHA" >&2

exit 1

fi

if [[ "$GITHUB_SHA" != "$TARGET_REF" ]]; then

echo "release_gate must run from the branch at target_ref" >&2

exit 1

fi

- name: Checkout

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_REF: ${{ inputs.target_ref || github.sha }}

CHECKOUT_EVENT_REF: ${{ github.ref }}

CHECKOUT_FALLBACK_REF: ${{ github.sha }}

GITHUB_EVENT_NAME: ${{ github.event_name }}

run: |

set -euo pipefail

git init "$GITHUB_WORKSPACE"

git -C "$GITHUB_WORKSPACE" config gc.auto 0

git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"

fetch_checkout_ref() {

local ref="$1"

local fetch_status

for attempt in 1 2 3; do

timeout --signal=TERM --kill-after=10s 120s git -C "$GITHUB_WORKSPACE" \

-c protocol.version=2 \

fetch --no-tags --prune --no-recurse-submodules --depth=2 origin \

"+${ref}:refs/remotes/origin/checkout" && return 0

fetch_status="$?"

if [ "$fetch_status" != "124" ] && [ "$fetch_status" != "137" ]; then

return "$fetch_status"

fi

if [ "$attempt" = "3" ]; then

return "$fetch_status"

fi

echo "::warning::checkout fetch for '$ref' timed out on attempt $attempt; retrying"

sleep 5

done

}

# Manual release-gate runs commonly validate the workflow ref's exact SHA.

# Fetch the branch/tag ref first so GitHub does not have to negotiate an

# arbitrary SHA fetch, then verify the resolved commit stayed pinned.

checkout_ref="$CHECKOUT_REF"

requested_sha=""

if [[ "$CHECKOUT_REF" =~ ^[0-9a-f]{40}$ ]]; then

requested_sha="$CHECKOUT_REF"

if [[

"$GITHUB_EVENT_NAME" == "workflow_dispatch" &&

"$CHECKOUT_REF" == "$CHECKOUT_FALLBACK_REF" &&

-n "$CHECKOUT_EVENT_REF"

]]; then

checkout_ref="$CHECKOUT_EVENT_REF"

fi

fi

if fetch_checkout_ref "$checkout_ref"; then

:

else

fetch_status="$?"

if [ "$fetch_status" = "124" ] || [ "$fetch_status" = "137" ]; then

echo "::error::checkout fetch for '$checkout_ref' timed out"

exit "$fetch_status"

fi

if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then

exit "$fetch_status"

fi

echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"

fetch_checkout_ref "$CHECKOUT_FALLBACK_REF"

fi

if [ -n "$requested_sha" ]; then

resolved_sha="$(git -C "$GITHUB_WORKSPACE" rev-parse refs/remotes/origin/checkout)"

if [ "$resolved_sha" != "$requested_sha" ]; then

echo "::error::checkout ref '$checkout_ref' resolved to '$resolved_sha'," \

"expected '$requested_sha'" >&2

exit 1

fi

fi

git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout

- name: Resolve checkout SHA

id: checkout_ref

run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

- name: Ensure preflight base commit

if: github.event_name != 'workflow_dispatch'

uses: ./.github/actions/ensure-base-commit

with:

base-sha: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }}

fetch-ref: ${{ github.event_name == 'push' && github.ref_name || github.event.pull_request.base.ref }}

- name: Detect docs-only changes

id: docs_scope

if: github.event_name != 'workflow_dispatch'

uses: ./.github/actions/detect-docs-changes

- name: Detect changed scopes

id: changed_scope

if: github.event_name != 'workflow_dispatch' && steps.docs_scope.outputs.docs_only != 'true'

shell: bash

run: |

set -euo pipefail

if [ "${{ github.event_name }}" = "push" ]; then

BASE="${{ github.event.before }}"

node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD

else

BASE="${{ github.event.pull_request.base.sha }}"

node scripts/ci-changed-scope.mjs --base "$BASE" --head HEAD --merge-head-first-parent

fi

- name: Build CI manifest

id: manifest

env:

OPENCLAW_CI_DOCS_ONLY: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.docs_scope.outputs.docs_only }}

OPENCLAW_CI_DOCS_CHANGED: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.docs_scope.outputs.docs_changed }}

OPENCLAW_CI_RUN_NODE: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_node || 'false' }}

OPENCLAW_CI_RUN_MACOS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_macos || 'false' }}

OPENCLAW_CI_RUN_IOS_BUILD: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_ios_build || 'false' }}

OPENCLAW_CI_RUN_ANDROID: ${{ github.event_name == 'workflow_dispatch' && (inputs.release_gate || inputs.include_android) && 'true' || steps.changed_scope.outputs.run_android || 'false' }}

OPENCLAW_CI_RUN_WINDOWS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_windows || 'false' }}

OPENCLAW_CI_RUN_NODE_FAST_ONLY: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_only || 'false' }}

OPENCLAW_CI_RUN_NODE_FAST_PLUGIN_CONTRACTS: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_plugin_contracts || 'false' }}

OPENCLAW_CI_RUN_NODE_FAST_CI_ROUTING: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_ci_routing || 'false' }}

OPENCLAW_CI_RUN_SKILLS_PYTHON: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_skills_python || 'false' }}

OPENCLAW_CI_RUN_CONTROL_UI_I18N: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_control_ui_i18n || 'false' }}

OPENCLAW_CI_RUN_NATIVE_I18N: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_native_i18n || 'false' }}

OPENCLAW_CI_CHECKOUT_REVISION: ${{ steps.checkout_ref.outputs.sha }}

OPENCLAW_CI_REPOSITORY: ${{ github.repository }}

OPENCLAW_CI_EVENT_NAME: ${{ github.event_name }}

run: |

node --input-type=module <<'EOF'

import { appendFileSync } from "node:fs";

import {

createNodeTestShardBundles,

} from "./scripts/lib/ci-node-test-plan.mjs";

import {

createChannelContractTestShards,

} from "./scripts/lib/channel-contract-test-plan.mjs";

const parseBoolean = (value, fallback = false) => {

if (value === undefined) return fallback;

const normalized = value.trim().toLowerCase();

if (normalized === "true" || normalized === "1") return true;

if (normalized === "false" || normalized === "0" || normalized === "") return false;

return fallback;

};

const { createPluginContractTestShards } = await import(

"./scripts/lib/plugin-contract-test-plan.mjs"

).catch((error) => {

if (error?.code !== "ERR_MODULE_NOT_FOUND") {

throw error;

}

return {

createPluginContractTestShards: () => [

{

checkName: "checks-fast-contracts-plugins-legacy",

includePatterns: ["src/plugins/contracts/**/*.test.ts"],

runtime: "node",

task: "contracts-plugins",

},

],

};

});

const createMatrix = (include) => ({ include });

const outputPath = process.env.GITHUB_OUTPUT;

const isCanonicalRepository = process.env.OPENCLAW_CI_REPOSITORY === "openclaw/openclaw";

const docsOnly = parseBoolean(process.env.OPENCLAW_CI_DOCS_ONLY);

const docsChanged = parseBoolean(process.env.OPENCLAW_CI_DOCS_CHANGED);

const eventName = process.env.OPENCLAW_CI_EVENT_NAME ?? "";

const runNode = parseBoolean(process.env.OPENCLAW_CI_RUN_NODE) && !docsOnly;

const runNodeFastOnly =

runNode && parseBoolean(process.env.OPENCLAW_CI_RUN_NODE_FAST_ONLY);

const runNodeFull = runNode && !runNodeFastOnly;

const runNodeFastPluginContracts =

runNode && parseBoolean(process.env.OPENCLAW_CI_RUN_NODE_FAST_PLUGIN_CONTRACTS);

const runNodeFastCiRouting =

runNode && parseBoolean(process.env.OPENCLAW_CI_RUN_NODE_FAST_CI_ROUTING);

const runPluginContractShards = runNodeFull || runNodeFastPluginContracts;

const runMacos =

parseBoolean(process.env.OPENCLAW_CI_RUN_MACOS) && !docsOnly && isCanonicalRepository;

const runIosBuild =

parseBoolean(process.env.OPENCLAW_CI_RUN_IOS_BUILD) && !docsOnly && isCanonicalRepository;

const runAndroid =

parseBoolean(process.env.OPENCLAW_CI_RUN_ANDROID) && !docsOnly && isCanonicalRepository;

const runWindows =

parseBoolean(process.env.OPENCLAW_CI_RUN_WINDOWS) &&

!docsOnly &&

!runNodeFastOnly &&

isCanonicalRepository;

const runSkillsPython = parseBoolean(process.env.OPENCLAW_CI_RUN_SKILLS_PYTHON) && !docsOnly;

const runControlUiI18n =

parseBoolean(process.env.OPENCLAW_CI_RUN_CONTROL_UI_I18N) && !docsOnly;

const runNativeI18n =

parseBoolean(process.env.OPENCLAW_CI_RUN_NATIVE_I18N) && !docsOnly;

const checksFastCoreTasks = [];

if (runNodeFull) {

checksFastCoreTasks.push(

{ check_name: "checks-fast-bundled-protocol", runtime: "node", task: "bundled-protocol" },

{

check_name: "QA Smoke CI",

runtime: "node",

task: "qa-smoke-ci",

runner: "blacksmith-16vcpu-ubuntu-2404",

},

{ check_name: "checks-fast-bun-launcher", runtime: "bun", task: "bun-launcher" },

);

} else {

if (runNodeFastCiRouting) {

checksFastCoreTasks.push({

check_name: "checks-fast-ci-routing",

runtime: "node",

task: "ci-routing",

});

}

}

const compactPullRequest = isCanonicalRepository && eventName === "pull_request";

const nodeTestShards = runNodeFull

? createNodeTestShardBundles({

includeReleaseOnlyPluginShards: false,

compact: compactPullRequest,

}).map((shard) => ({

check_name: shard.checkName,

runtime: "node",

task: "test-shard",

shard_name: shard.shardName,

groups: shard.groups,

configs: shard.configs,

env: shard.env,

includePatterns: shard.includePatterns,

requires_dist: shard.requiresDist,

runner: shard.runner,

timeout_minutes: shard.timeoutMinutes,

}))

: [];

const nodeTestNonDistShards = nodeTestShards.filter((shard) => !shard.requires_dist);

const nodeTestDistShards = nodeTestShards.filter((shard) => shard.requires_dist);

const manifest = {

docs_only: docsOnly,

docs_changed: docsChanged,

run_node: runNode,

run_macos: runMacos,

run_android: runAndroid,

run_skills_python: runSkillsPython,

run_windows: runWindows,

run_build_artifacts: runNodeFull,

run_checks_fast_core: checksFastCoreTasks.length > 0,

run_checks_fast: runNodeFull,

checks_fast_core_matrix: createMatrix(checksFastCoreTasks),

run_plugin_contracts_shards: runPluginContractShards,

plugin_contracts_matrix: createMatrix(

runPluginContractShards ? createPluginContractTestShards() : [],

),

channel_contracts_matrix: createMatrix(

runNodeFull ? createChannelContractTestShards() : [],

),

run_checks: runNodeFull,

run_checks_node_core_nondist: nodeTestNonDistShards.length > 0,

checks_node_core_nondist_matrix: createMatrix(nodeTestNonDistShards),

run_checks_node_core_dist: nodeTestDistShards.length > 0,

run_check: runNodeFull,

run_check_additional: runNodeFull,

run_check_docs: docsChanged && eventName !== "push",

run_control_ui_i18n: runControlUiI18n,

run_native_i18n: runNativeI18n,

run_skills_python_job: runSkillsPython,

run_checks_windows: runWindows,

checks_windows_matrix: createMatrix(

runWindows

? [

{

check_name: "checks-windows-node-test",

runtime: "node",

task: "test",

runner: "blacksmith-8vcpu-windows-2025",

},

]

: [],

),

run_macos_node: runMacos,

macos_node_matrix: createMatrix(

runMacos ? [{ check_name: "macos-node", runtime: "node", task: "test" }] : [],

),

run_macos_swift: runMacos,

run_ios_build: runIosBuild,

run_android_job: runAndroid,

android_matrix: createMatrix(

runAndroid

? [

{ check_name: "android-test-play", task: "test-play" },

{ check_name: "android-test-third-party", task: "test-third-party" },

{ check_name: "android-build-play", task: "build-play" },

]

: [],

),

};

for (const [key, value] of Object.entries(manifest)) {

appendFileSync(

outputPath,

`${key}=${typeof value === "string" ? value : JSON.stringify(value)}\n`,

"utf8",

);

}

EOF

# Run dependency-free security checks in parallel with scope detection so the

# main Node jobs do not have to wait for Python/pre-commit setup.

security-fast:

permissions:

contents: read

needs: [runner-admission]

if: github.event_name != 'pull_request' || !github.event.pull_request.draft

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20

env:

PRE_COMMIT_HOME: .cache/pre-commit-security-fast

steps:

- name: Checkout

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_REF: ${{ inputs.target_ref || github.sha }}

CHECKOUT_FALLBACK_REF: ${{ github.sha }}

GITHUB_EVENT_NAME: ${{ github.event_name }}

run: |

set -euo pipefail

git init "$GITHUB_WORKSPACE"

git -C "$GITHUB_WORKSPACE" config gc.auto 0

git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"

fetch_checkout_ref() {

local ref="$1"

local fetch_status

for attempt in 1 2 3; do

timeout --signal=TERM --kill-after=10s 120s git -C "$GITHUB_WORKSPACE" \

-c protocol.version=2 \

fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \

"+${ref}:refs/remotes/origin/checkout" && return 0

fetch_status="$?"

if [ "$fetch_status" != "124" ] && [ "$fetch_status" != "137" ]; then

return "$fetch_status"

fi

if [ "$attempt" = "3" ]; then

return "$fetch_status"

fi

echo "::warning::checkout fetch for '$ref' timed out on attempt $attempt; retrying"

sleep 5

done

}

if fetch_checkout_ref "$CHECKOUT_REF"; then

:

else

fetch_status="$?"

if [ "$fetch_status" = "124" ] || [ "$fetch_status" = "137" ]; then

echo "::error::checkout fetch for '$CHECKOUT_REF' timed out"

exit "$fetch_status"

fi

if [ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ] || [ "$CHECKOUT_REF" = "$CHECKOUT_FALLBACK_REF" ]; then

exit "$fetch_status"

fi

echo "::warning::workflow_dispatch target_ref '$CHECKOUT_REF' is unavailable; falling back to head SHA '$CHECKOUT_FALLBACK_REF'"

fetch_checkout_ref "$CHECKOUT_FALLBACK_REF"

fi

git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout

- name: Ensure security base commit

if: github.event_name != 'workflow_dispatch'

uses: ./.github/actions/ensure-base-commit

with:

base-sha: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }}

fetch-ref: ${{ github.event_name == 'push' && github.ref_name || github.event.pull_request.base.ref }}

- name: Prepare trusted pre-commit config

if: github.event_name == 'pull_request'

env:

BASE_SHA: ${{ github.event.pull_request.base.sha }}

BASE_REF: ${{ github.event.pull_request.base.ref }}

run: |

set -euo pipefail

trusted_config="$RUNNER_TEMP/pre-commit-base.yaml"

if git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null &&

git cat-file -e "${BASE_SHA}:.pre-commit-config.yaml" 2>/dev/null; then

git show "${BASE_SHA}:.pre-commit-config.yaml" > "$trusted_config"

elif git show "refs/remotes/origin/${BASE_REF}:.pre-commit-config.yaml" \

> "$trusted_config" 2>/dev/null; then

echo "Base SHA ${BASE_SHA} does not expose .pre-commit-config.yaml; using origin/${BASE_REF} instead."

else

echo "::warning title=trusted pre-commit config unavailable::Could not read .pre-commit-config.yaml from ${BASE_SHA} or origin/${BASE_REF}; falling back to the checked-out config."

rm -f "$trusted_config"

exit 0

fi

echo "PRE_COMMIT_CONFIG_PATH=$trusted_config" >> "$GITHUB_ENV"

- name: Resolve Python runtime

id: setup-python

run: |

set -euo pipefail

python3 --version

version="$(python3 - <<'PY'

import platform

print(platform.python_version())

PY

)"

echo "python-version=${version}" >> "$GITHUB_OUTPUT"

- name: Install pre-commit

run: python3 -m pip install --disable-pip-version-check pre-commit==4.2.0

- name: Detect committed private keys

run: pre-commit run --config "${PRE_COMMIT_CONFIG_PATH:-.pre-commit-config.yaml}" --all-files detect-private-key

- name: Audit changed GitHub workflows with zizmor

env:

BASE_SHA: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }}

run: |

set -euo pipefail

if [ -z "${BASE_SHA:-}" ] || [ "${BASE_SHA}" = "0000000000000000000000000000000000000000" ]; then

echo "No usable base SHA detected; skipping zizmor."

exit 0

fi

if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then

echo "Base SHA ${BASE_SHA} is unavailable; skipping zizmor."

exit 0

fi

mapfile -t workflow_files < <(

git diff --name-only "${BASE_SHA}" HEAD -- '.github/workflows/*.yml' '.github/workflows/*.yaml'

)

if [ "${#workflow_files[@]}" -eq 0 ]; then

echo "No workflow changes detected; skipping zizmor."

exit 0

fi

printf 'Auditing workflow files:\n%s\n' "${workflow_files[@]}"

pre-commit run --config "${PRE_COMMIT_CONFIG_PATH:-.pre-commit-config.yaml}" zizmor --files "${workflow_files[@]}"

- name: Setup Node.js

env:

REQUESTED_NODE_VERSION: "24.x"

run: |

set -euo pipefail

source .github/actions/setup-pnpm-store-cache/ensure-node.sh

openclaw_ensure_node "$REQUESTED_NODE_VERSION"

- name: Audit production dependencies

run: node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high

# Warm the lockfile- and pnpm-pinned store without blocking Linux Node shards.

# On a cold key this job owns the save for later workflow runs.

pnpm-store-warmup:

permissions:

contents: read

needs: [preflight]

if: needs.preflight.outputs.run_node == 'true' || needs.preflight.outputs.run_check_docs == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20

steps:

- &linux_node_checkout_step

name: Checkout

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}

run: |

set -euo pipefail

workdir="$GITHUB_WORKSPACE"

reset_checkout_dir() {

mkdir -p "$workdir"

find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +

}

checkout_attempt() {

local attempt="$1"

reset_checkout_dir

git init "$workdir" >/dev/null

git config --global --add safe.directory "$workdir"

git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"

git -C "$workdir" config gc.auto 0

timeout --signal=TERM --kill-after=10s 120s git -C "$workdir" \

-c protocol.version=2 \

fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \

"+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1

git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1

test -f "$workdir/.github/actions/setup-node-env/action.yml" || return 1

echo "checkout attempt ${attempt}/5 succeeded"

}

for attempt in 1 2 3 4 5; do

if checkout_attempt "$attempt"; then

exit 0

fi

echo "checkout attempt ${attempt}/5 failed"

sleep $((attempt * 5))

done

echo "checkout failed after 5 attempts" >&2

exit 1

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

install-bun: "false"

save-actions-cache: "true"

# Build dist once for Node-relevant changes and share it with downstream jobs.

# Keep this overlapping with the fast correctness lanes so green PRs get heavy

# test/build feedback sooner instead of waiting behind a full `check` pass.

build-artifacts:

permissions:

contents: read

needs: [preflight]

if: needs.preflight.outputs.run_build_artifacts == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20

outputs:

channels-result: ${{ steps.built_artifact_checks.outputs['channels-result'] }}

core-support-boundary-result: ${{ steps.built_artifact_checks.outputs['core-support-boundary-result'] }}

gateway-watch-result: ${{ steps.built_artifact_checks.outputs['gateway-watch-result'] }}

steps:

- *linux_node_checkout_step

- name: Ensure secrets base commit (PR fast path)

if: github.event_name == 'pull_request'

uses: ./.github/actions/ensure-base-commit

with:

base-sha: ${{ github.event.pull_request.base.sha }}

fetch-ref: ${{ github.event.pull_request.base.ref }}

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

install-bun: "false"

- name: Restore build-all step cache

uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5

with:

path: .artifacts/build-all-cache

key: ${{ runner.os }}-build-all-v3-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'npm-shrinkwrap.json', 'packages/plugin-sdk/package.json', 'packages/llm-core/package.json', 'packages/model-catalog-core/package.json', 'packages/memory-host-sdk/package.json', 'scripts/build-all.mjs', 'scripts/write-plugin-sdk-entry-dts.ts', 'scripts/lib/plugin-sdk-entries.mjs', 'tsconfig.json', 'tsconfig.plugin-sdk.dts.json', 'src/plugin-sdk/**', 'packages/llm-core/src/**', 'packages/model-catalog-core/src/**', 'packages/memory-host-sdk/src/**', 'src/types/**', 'src/video-generation/dashscope-compatible.ts', 'src/video-generation/types.ts', 'scripts/copy-export-html-templates.ts', 'scripts/lib/copy-assets.ts', 'src/auto-reply/reply/export-html/**') }}

restore-keys: |

${{ runner.os }}-build-all-v3-

- name: Restore dist build cache

id: dist_build_cache

uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5

with:

path: |

dist/

dist-runtime/

extensions/*/src/host/**/.bundle.hash

extensions/*/src/host/**/*.bundle.js

key: ${{ runner.os }}-dist-build-${{ needs.preflight.outputs.checkout_revision }}

- name: Build dist

if: steps.dist_build_cache.outputs.cache-hit != 'true'

env:

NODE_OPTIONS: --max-old-space-size=8192

run: pnpm build:ci-artifacts

- name: Check Control UI i18n

if: needs.preflight.outputs.run_control_ui_i18n == 'true'

run: pnpm ui:i18n:check

- name: Pack built runtime artifacts

run: tar --posix -cf dist-runtime-build.tar.zst --use-compress-program zstdmt dist dist-runtime

- name: Upload built runtime artifacts

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: dist-runtime-build

path: dist-runtime-build.tar.zst

retention-days: 1

- name: Upload bundled plugin asset artifacts

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: bundled-plugin-assets

path: |

extensions/*/src/host/**/.bundle.hash

extensions/*/src/host/**/*.bundle.js

include-hidden-files: true

retention-days: 1

- name: Smoke test CLI launcher help

run: node openclaw.mjs --help

- name: Smoke test CLI launcher status json

run: node openclaw.mjs status --json --timeout 1

- name: Smoke test built bundled plugin singleton

run: pnpm test:build:singleton

- name: Check CLI startup memory

shell: bash

run: |

set +e

pnpm test:startup:memory

status=$?

if [[ -f .artifacts/startup-memory/summary.md ]]; then

cat .artifacts/startup-memory/summary.md >> "$GITHUB_STEP_SUMMARY"

fi

exit "$status"

- name: Upload startup memory report

if: always()

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: startup-memory

path: .artifacts/startup-memory/

if-no-files-found: ignore

retention-days: 7

- name: Run built artifact checks

id: built_artifact_checks

if: needs.preflight.outputs.run_checks == 'true' || needs.preflight.outputs.run_checks_node_core_dist == 'true' || needs.preflight.outputs.run_check_additional == 'true'

env:

RUN_CHANNELS: ${{ needs.preflight.outputs.run_checks }}

RUN_CORE_SUPPORT_BOUNDARY: ${{ needs.preflight.outputs.run_checks_node_core_dist }}

RUN_GATEWAY_WATCH: ${{ needs.preflight.outputs.run_check_additional }}

shell: bash

run: |

set -uo pipefail

names=()

pids=()

logs=()

declare -A results=(

["channels"]="skipped"

["core-support-boundary"]="skipped"

["gateway-watch"]="skipped"

)

start_check() {

local name="$1"

shift

local log="${RUNNER_TEMP}/${name}.log"

names+=("$name")

logs+=("$log")

echo "starting ${name}: $*"

"$@" >"$log" 2>&1 &

pids+=("$!")

}

if [ "$RUN_CHANNELS" = "true" ]; then

start_check "channels" env \

NODE_OPTIONS=--max-old-space-size=8192 \

OPENCLAW_VITEST_MAX_WORKERS=1 \

pnpm test:channels

fi

if [ "$RUN_CORE_SUPPORT_BOUNDARY" = "true" ]; then

start_check "core-support-boundary" env \

NODE_OPTIONS=--max-old-space-size=8192 \

OPENCLAW_VITEST_MAX_WORKERS=2 \

node scripts/run-vitest.mjs run --config test/vitest/vitest.full-core-support-boundary.config.ts

fi

for index in "${!pids[@]}"; do

name="${names[$index]}"

log="${logs[$index]}"

pid="${pids[$index]}"

if wait "$pid"; then

result="success"

else

result="failure"

fi

echo "::group::${name} log"

cat "$log"

echo "::endgroup::"

results["$name"]="$result"

done

if [ "$RUN_GATEWAY_WATCH" = "true" ]; then

log="${RUNNER_TEMP}/gateway-watch.log"

echo "starting gateway-watch: node scripts/check-gateway-watch-regression.mjs --skip-build"

if node scripts/check-gateway-watch-regression.mjs --skip-build >"$log" 2>&1; then

result="success"

else

result="failure"

fi

echo "::group::gateway-watch log"

cat "$log"

echo "::endgroup::"

results["gateway-watch"]="$result"

fi

for name in channels core-support-boundary gateway-watch; do

echo "${name}-result=${results[$name]}" >> "$GITHUB_OUTPUT"

done

failures=0

for name in channels core-support-boundary gateway-watch; do

if [ "${results[$name]}" = "failure" ]; then

echo "::error title=${name} failed::${name} failed"

failures=1

fi

done

exit "$failures"

- name: Save dist build cache

if: steps.dist_build_cache.outputs.cache-hit != 'true'

uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5

continue-on-error: true

with:

path: |

dist/

dist-runtime/

extensions/*/src/host/**/.bundle.hash

extensions/*/src/host/**/*.bundle.js

key: ${{ steps.dist_build_cache.outputs.cache-primary-key }}

- name: Upload gateway watch regression artifacts

if: always() && needs.preflight.outputs.run_check_additional == 'true'

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: gateway-watch-regression

path: .local/gateway-watch-regression/

retention-days: 7

native-i18n:

permissions:

contents: read

needs: [preflight]

if: ${{ !cancelled() && always() && needs.preflight.outputs.run_native_i18n == 'true' }}

runs-on: ${{ github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04' }}

timeout-minutes: 10

steps:

- name: Checkout

uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

with:

ref: ${{ needs.preflight.outputs.checkout_revision }}

persist-credentials: false

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

install-bun: "false"

- name: Check native app i18n inventory

run: pnpm native:i18n:check

- name: Check Android app i18n resources

run: pnpm android:i18n:check

- name: Check Apple app i18n catalogs

run: pnpm apple:i18n:check

checks-fast-core:

permissions:

contents: read

name: ${{ matrix.check_name }}

needs: [preflight]

if: needs.preflight.outputs.run_checks_fast_core == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (matrix.runner || 'blacksmith-4vcpu-ubuntu-2404') || 'ubuntu-24.04') }}

timeout-minutes: 60

strategy:

fail-fast: false

max-parallel: 12

matrix: ${{ fromJson(needs.preflight.outputs.checks_fast_core_matrix) }}

steps:

- *linux_node_checkout_step

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

install-bun: ${{ matrix.task == 'bun-launcher' && 'true' || 'false' }}

- name: Run ${{ matrix.task }} (${{ matrix.runtime }})

env:

OPENCLAW_TEST_PROJECTS_PARALLEL: 3

TASK: ${{ matrix.task }}

shell: bash

run: |

set -euo pipefail

case "$TASK" in

bundled-protocol)

pnpm test:bundled

pnpm protocol:check

;;

qa-smoke-ci)

output_dir=".artifacts/qa-e2e/smoke-ci-profile"

package_dir=".artifacts/qa-e2e/smoke-ci-package"

export OPENCLAW_BUILD_PRIVATE_QA=1

export OPENCLAW_ENABLE_PRIVATE_QA_CLI=1

export OPENCLAW_DISABLE_BUNDLED_PLUGINS=0

export OPENCLAW_QA_REDACT_PUBLIC_METADATA=1

export OPENCLAW_QA_TRANSPORT_READY_TIMEOUT_MS=180000

export NODE_OPTIONS=--max-old-space-size=16384

node scripts/package-openclaw-for-docker.mjs \

--output-dir "$package_dir" \

--output-name openclaw-current.tgz

export OPENCLAW_CURRENT_PACKAGE_TGZ="$PWD/$package_dir/openclaw-current.tgz"

qa_exit_code=0

pnpm openclaw qa run \

--repo-root . \

--qa-profile smoke-ci \

--concurrency 8 \

--output-dir "$output_dir" || qa_exit_code=$?

echo "QA smoke profile evidence: \`${output_dir}\`" >> "$GITHUB_STEP_SUMMARY"

if [ "$qa_exit_code" -ne 0 ]; then

echo "::error title=QA smoke profile failed::smoke-ci exited ${qa_exit_code}; evidence upload will still run"

exit "$qa_exit_code"

fi

;;

contracts-plugins-ci-routing)

pnpm test:contracts:plugins

pnpm test src/commands/status.scan-result.test.ts src/scripts/ci-changed-scope.test.ts test/scripts/changed-lanes.test.ts test/scripts/ci-workflow-guards.test.ts test/scripts/run-vitest.test.ts test/scripts/test-projects.test.ts

;;

ci-routing)

pnpm test src/commands/status.scan-result.test.ts src/scripts/ci-changed-scope.test.ts test/scripts/changed-lanes.test.ts test/scripts/ci-workflow-guards.test.ts test/scripts/run-vitest.test.ts test/scripts/test-projects.test.ts

;;

bun-launcher)

OPENCLAW_TEST_BUN_LAUNCHER=1 pnpm test test/openclaw-launcher.e2e.test.ts

;;

*)

echo "Unsupported checks-fast task: $TASK" >&2

exit 1

;;

esac

- name: Upload QA smoke profile evidence

if: always() && matrix.task == 'qa-smoke-ci'

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

with:

name: qa-smoke-profile-${{ github.run_id }}-${{ github.run_attempt }}

path: .artifacts/qa-e2e/smoke-ci-profile/

if-no-files-found: warn

retention-days: 7

checks-fast-plugin-contracts-shard:

permissions:

contents: read

name: ${{ matrix.checkName }}

needs: [preflight]

if: needs.preflight.outputs.run_plugin_contracts_shards == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 60

strategy:

fail-fast: false

max-parallel: 12

matrix: ${{ fromJson(needs.preflight.outputs.plugin_contracts_matrix) }}

steps:

- *linux_node_checkout_step

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

install-bun: "false"

- name: Run plugin contract shard

env:

OPENCLAW_CONTRACT_INCLUDE_PATTERNS_JSON: ${{ toJson(matrix.includePatterns) }}

shell: bash

run: |

set -euo pipefail

include_file="$RUNNER_TEMP/plugin-contract-include.json"

INCLUDE_FILE="$include_file" node --input-type=module <<'EOF'

import { writeFileSync } from "node:fs";

const includePatterns = JSON.parse(process.env.OPENCLAW_CONTRACT_INCLUDE_PATTERNS_JSON ?? "[]");

if (!Array.isArray(includePatterns) || includePatterns.length === 0) {

console.error("Missing plugin contract include patterns");

process.exit(1);

}

writeFileSync(process.env.INCLUDE_FILE, JSON.stringify(includePatterns), "utf8");

EOF

OPENCLAW_VITEST_INCLUDE_FILE="$include_file" pnpm test:contracts:plugins

checks-fast-channel-contracts-shard:

permissions:

contents: read

name: ${{ matrix.checkName }}

needs: [preflight]

if: needs.preflight.outputs.run_checks_fast == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 60