Skip to content

Commit 451563b

Browse files
steipetesteipete
committed
ci: allow Tideclaw alpha release workflows
1 parent e66a6c8 commit 451563b

5 files changed

Lines changed: 154 additions & 16 deletions

File tree

‎.github/workflows/openclaw-npm-release.yml‎

Lines changed: 53 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,28 @@ jobs:
8888
ref: ${{ inputs.tag }}
8989
fetch-depth: 0
9090

91+
- name: Validate Tideclaw alpha preflight target
92+
if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')
93+
env:
94+
RELEASE_REF: ${{ inputs.tag }}
95+
WORKFLOW_REF: ${{ github.ref }}
96+
run: |
97+
set -euo pipefail
98+
if [[ ! "${RELEASE_REF}" == *"-alpha."* && ! "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ ]]; then
99+
echo "Tideclaw alpha preflight runs must target an alpha prerelease tag or SHA." >&2
100+
exit 1
101+
fi
102+
if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
103+
echo "Tideclaw alpha preflight runs must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2
104+
exit 1
105+
fi
106+
alpha_branch="${WORKFLOW_REF#refs/heads/}"
107+
git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
108+
if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then
109+
echo "Alpha preflight target must be reachable from ${alpha_branch}." >&2
110+
exit 1
111+
fi
112+
91113
- name: Setup Node environment
92114
uses: ./.github/actions/setup-node-env
93115
with:
@@ -347,13 +369,19 @@ jobs:
347369
permissions:
348370
contents: read
349371
steps:
350-
- name: Require main or release workflow ref for publish
372+
- name: Require trusted workflow ref for publish
351373
env:
374+
RELEASE_TAG: ${{ inputs.tag }}
375+
RELEASE_NPM_DIST_TAG: ${{ inputs.npm_dist_tag }}
352376
WORKFLOW_REF: ${{ github.ref }}
353377
run: |
354378
set -euo pipefail
355-
if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then
356-
echo "Real publish runs must be dispatched from main or release/YYYY.M.D. Use preflight_only=true for other branch validation."
379+
tideclaw_alpha_publish=false
380+
if [[ "${RELEASE_TAG}" == *"-alpha."* && "${RELEASE_NPM_DIST_TAG}" == "alpha" && "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
381+
tideclaw_alpha_publish=true
382+
fi
383+
if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] && [[ "${tideclaw_alpha_publish}" != "true" ]]; then
384+
echo "Real publish runs must be dispatched from main, release/YYYY.M.D, or a Tideclaw alpha branch for alpha prereleases. Use preflight_only=true for other branch validation."
357385
exit 1
358386
fi
359387
@@ -409,6 +437,28 @@ jobs:
409437
ref: refs/tags/${{ inputs.tag }}
410438
fetch-depth: 0
411439

440+
- name: Validate Tideclaw alpha publish target
441+
if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')
442+
env:
443+
RELEASE_TAG: ${{ inputs.tag }}
444+
WORKFLOW_REF: ${{ github.ref }}
445+
run: |
446+
set -euo pipefail
447+
if [[ ! "${RELEASE_TAG}" == *"-alpha."* ]]; then
448+
echo "Tideclaw alpha publish runs must target an alpha prerelease tag." >&2
449+
exit 1
450+
fi
451+
if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
452+
echo "Tideclaw alpha publish runs must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2
453+
exit 1
454+
fi
455+
alpha_branch="${WORKFLOW_REF#refs/heads/}"
456+
git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
457+
if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then
458+
echo "Alpha publish tag must be reachable from ${alpha_branch}." >&2
459+
exit 1
460+
fi
461+
412462
- name: Setup Node environment
413463
uses: ./.github/actions/setup-node-env
414464
with:

‎.github/workflows/openclaw-release-checks.yml‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,13 +113,21 @@ jobs:
113113
release_package_spec: ${{ steps.inputs.outputs.release_package_spec }}
114114
package_acceptance_package_spec: ${{ steps.inputs.outputs.package_acceptance_package_spec }}
115115
steps:
116-
- name: Require main or release workflow ref for release checks
116+
- name: Require trusted workflow ref for release checks
117117
env:
118+
RELEASE_REF: ${{ inputs.ref }}
118119
WORKFLOW_REF: ${{ github.ref }}
119120
run: |
120121
set -euo pipefail
121-
if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release-ci/[0-9a-f]{12}-[0-9]+$ ]]; then
122-
echo "Release checks must be dispatched from main, release/YYYY.M.D, or a Full Release Validation release-ci/<sha>-<timestamp> ref so workflow logic and secrets stay controlled." >&2
122+
tideclaw_alpha_check=false
123+
if [[ "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
124+
workflow_branch="${WORKFLOW_REF#refs/heads/}"
125+
if [[ "${RELEASE_REF}" == *"-alpha."* || "${RELEASE_REF}" =~ ^[0-9a-fA-F]{40}$ || "${RELEASE_REF}" == "${workflow_branch}" || "${RELEASE_REF}" == "refs/heads/${workflow_branch}" ]]; then
126+
tideclaw_alpha_check=true
127+
fi
128+
fi
129+
if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] && [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/release-ci/[0-9a-f]{12}-[0-9]+$ ]] && [[ "${tideclaw_alpha_check}" != "true" ]]; then
130+
echo "Release checks must be dispatched from main, release/YYYY.M.D, a Full Release Validation release-ci/<sha>-<timestamp> ref, or a Tideclaw alpha branch for alpha prereleases." >&2
123131
exit 1
124132
fi
125133
@@ -219,6 +227,25 @@ jobs:
219227
fi
220228
echo "sha=${selected_sha,,}" >> "$GITHUB_OUTPUT"
221229
230+
- name: Validate Tideclaw alpha target matches workflow branch
231+
if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')
232+
working-directory: workflow
233+
env:
234+
SELECTED_SHA: ${{ steps.ref.outputs.sha }}
235+
WORKFLOW_REF: ${{ github.ref }}
236+
run: |
237+
set -euo pipefail
238+
if [[ ! "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
239+
echo "Tideclaw alpha release checks must run from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2
240+
exit 1
241+
fi
242+
alpha_branch="${WORKFLOW_REF#refs/heads/}"
243+
git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
244+
if ! git merge-base --is-ancestor "${SELECTED_SHA}" "refs/remotes/origin/${alpha_branch}"; then
245+
echo "Alpha release target ${SELECTED_SHA} must be reachable from ${alpha_branch}." >&2
246+
exit 1
247+
fi
248+
222249
- name: Capture selected inputs
223250
id: inputs
224251
env:

‎.github/workflows/openclaw-release-publish.yml‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,12 @@ jobs:
115115
echo "publish_openclaw_npm=true requires full_release_validation_run_id." >&2
116116
exit 1
117117
fi
118-
if [[ "${PUBLISH_OPENCLAW_NPM}" == "true" && "${WORKFLOW_REF}" != "refs/heads/main" && ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then
119-
echo "publish_openclaw_npm=true requires dispatching this workflow from main or release/YYYY.M.D." >&2
118+
tideclaw_alpha_publish=false
119+
if [[ "${RELEASE_TAG}" == *"-alpha."* && "${RELEASE_NPM_DIST_TAG}" == "alpha" && "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
120+
tideclaw_alpha_publish=true
121+
fi
122+
if [[ "${PUBLISH_OPENCLAW_NPM}" == "true" && "${WORKFLOW_REF}" != "refs/heads/main" && ! "${WORKFLOW_REF}" =~ ^refs/heads/release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ && "${tideclaw_alpha_publish}" != "true" ]]; then
123+
echo "publish_openclaw_npm=true requires dispatching this workflow from main, release/YYYY.M.D, or a Tideclaw alpha branch for alpha prereleases." >&2
120124
exit 1
121125
fi
122126
if [[ "${PLUGIN_PUBLISH_SCOPE}" == "selected" && -z "${PLUGINS}" ]]; then
@@ -279,7 +283,10 @@ jobs:
279283
exit 1
280284
fi
281285
282-
- name: Validate release tag is reachable from main or release branch
286+
- name: Validate release tag is reachable from a trusted release branch
287+
env:
288+
RELEASE_TAG: ${{ inputs.tag }}
289+
WORKFLOW_REF_NAME: ${{ github.ref_name }}
283290
run: |
284291
set -euo pipefail
285292
git fetch --no-tags origin \
@@ -293,7 +300,17 @@ jobs:
293300
exit 0
294301
fi
295302
done < <(git for-each-ref --format='%(refname)' refs/remotes/origin/release)
296-
echo "Release tag must point to a commit reachable from main or release/*." >&2
303+
if [[ "${RELEASE_TAG}" == *"-alpha."* ]]; then
304+
if [[ ! "${WORKFLOW_REF_NAME}" =~ ^tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
305+
echo "Alpha publish tags must be dispatched from tideclaw/alpha/YYYY-MM-DD-HHMMZ." >&2
306+
exit 1
307+
fi
308+
git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}"
309+
if git merge-base --is-ancestor HEAD "refs/remotes/origin/${WORKFLOW_REF_NAME}"; then
310+
exit 0
311+
fi
312+
fi
313+
echo "Release tag must point to a commit reachable from main, release/*, or the matching Tideclaw alpha branch for alpha prereleases." >&2
297314
exit 1
298315
299316
- name: Summarize release target

‎.github/workflows/plugin-clawhub-release.yml‎

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ on:
1616
required: false
1717
type: string
1818
ref:
19-
description: Commit SHA on main or a release branch to publish from; defaults to the workflow ref
19+
description: Commit SHA on main, a release branch, or the matching Tideclaw alpha branch to publish from; defaults to the workflow ref
2020
required: false
2121
default: ""
2222
type: string
@@ -82,7 +82,9 @@ jobs:
8282
fi
8383
echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
8484
85-
- name: Validate ref is on main or a release branch
85+
- name: Validate ref is on a trusted publish branch
86+
env:
87+
WORKFLOW_REF: ${{ github.ref }}
8688
run: |
8789
set -euo pipefail
8890
if git merge-base --is-ancestor HEAD origin/main; then
@@ -93,7 +95,14 @@ jobs:
9395
exit 0
9496
fi
9597
done < <(git for-each-ref --format='%(refname)' refs/remotes/origin/release)
96-
echo "Plugin ClawHub publishes must target a commit reachable from main or release/*." >&2
98+
if [[ "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
99+
alpha_branch="${WORKFLOW_REF#refs/heads/}"
100+
git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
101+
if git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then
102+
exit 0
103+
fi
104+
fi
105+
echo "Plugin ClawHub publishes must target a commit reachable from main, release/*, or the matching Tideclaw alpha branch." >&2
97106
exit 1
98107
99108
- name: Validate publishable plugin metadata
@@ -168,6 +177,19 @@ jobs:
168177
echo "::error::One or more selected plugin versions already exist on ClawHub. Bump the version before running a real publish."
169178
exit 1
170179
180+
- name: Validate Tideclaw alpha plugin channels
181+
if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')
182+
run: |
183+
set -euo pipefail
184+
invalid="$(
185+
jq -r '.candidates[]? | select(.publishTag != "alpha" or .channel != "alpha") | "- \(.packageName)@\(.version) [\(.publishTag)]"' .local/plugin-clawhub-release-plan.json
186+
)"
187+
if [[ -n "${invalid}" ]]; then
188+
echo "Tideclaw alpha ClawHub publishes may only publish alpha plugin versions." >&2
189+
printf '%s\n' "${invalid}" >&2
190+
exit 1
191+
fi
192+
171193
- name: Verify OpenClaw ClawHub package ownership
172194
if: steps.plan.outputs.has_candidates == 'true'
173195
env:

‎.github/workflows/plugin-npm-release.yml‎

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ on:
2525
- selected
2626
- all-publishable
2727
ref:
28-
description: Commit SHA on main or a release branch to publish from (copy from the preview run)
28+
description: Commit SHA on main, a release branch, or the matching Tideclaw alpha branch to publish from
2929
required: true
3030
type: string
3131
plugins:
@@ -71,7 +71,9 @@ jobs:
7171
id: ref
7272
run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
7373

74-
- name: Validate ref is on main or a release branch
74+
- name: Validate ref is on a trusted publish branch
75+
env:
76+
WORKFLOW_REF: ${{ github.ref }}
7577
run: |
7678
set -euo pipefail
7779
git fetch --no-tags origin \
@@ -85,7 +87,14 @@ jobs:
8587
exit 0
8688
fi
8789
done < <(git for-each-ref --format='%(refname)' refs/remotes/origin/release)
88-
echo "Plugin npm publishes must target a commit reachable from main or release/*." >&2
90+
if [[ "${WORKFLOW_REF}" =~ ^refs/heads/tideclaw/alpha/[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9]{4}Z$ ]]; then
91+
alpha_branch="${WORKFLOW_REF#refs/heads/}"
92+
git fetch --no-tags origin "+refs/heads/${alpha_branch}:refs/remotes/origin/${alpha_branch}"
93+
if git merge-base --is-ancestor HEAD "refs/remotes/origin/${alpha_branch}"; then
94+
exit 0
95+
fi
96+
fi
97+
echo "Plugin npm publishes must target a commit reachable from main, release/*, or the matching Tideclaw alpha branch." >&2
8998
exit 1
9099
91100
- name: Validate publishable plugin metadata
@@ -151,6 +160,19 @@ jobs:
151160
echo "Already published / skipped:"
152161
jq -r '.skippedPublished[]? | "- \(.packageName)@\(.version)"' .local/plugin-npm-release-plan.json
153162
163+
- name: Validate Tideclaw alpha plugin channels
164+
if: startsWith(github.ref, 'refs/heads/tideclaw/alpha/')
165+
run: |
166+
set -euo pipefail
167+
invalid="$(
168+
jq -r '.candidates[]? | select(.publishTag != "alpha" or .channel != "alpha") | "- \(.packageName)@\(.version) [\(.publishTag)]"' .local/plugin-npm-release-plan.json
169+
)"
170+
if [[ -n "${invalid}" ]]; then
171+
echo "Tideclaw alpha plugin npm publishes may only publish alpha plugin versions." >&2
172+
printf '%s\n' "${invalid}" >&2
173+
exit 1
174+
fi
175+
154176
preview_plugin_pack:
155177
needs: preview_plugins_npm
156178
if: needs.preview_plugins_npm.outputs.has_candidates == 'true'

0 commit comments

Comments
 (0)