Skip to content

Commit 6e8d5cd

Browse files
author
Onur
authored
Release: privatize macOS publish flow (#53166)
1 parent ade0182 commit 6e8d5cd

2 files changed

Lines changed: 59 additions & 336 deletions

File tree

‎.agents/skills/openclaw-release-maintainer/SKILL.md‎

Lines changed: 43 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,9 @@ OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT=1 pnpm test:install:smoke
8585
- `pnpm release:check`
8686
- `OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT=1 pnpm test:install:smoke`
8787
- Check all release-related build surfaces touched by the release, not only the npm package.
88-
- Include mac release readiness in preflight by running or inspecting the mac
89-
packaging, notarization, and appcast flow for every release.
88+
- Include mac release readiness in preflight by running the public validation
89+
workflow in `openclaw/openclaw` and the real mac preflight in
90+
`openclaw/releases-private` for every release.
9091
- Treat the `appcast.xml` update on `main` as part of mac release readiness, not an optional follow-up.
9192
- The workflows remain tag-based. The agent is responsible for making sure
9293
preflight runs complete successfully before any publish run starts.
@@ -104,34 +105,42 @@ OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT=1 pnpm test:install:smoke
104105

105106
- OpenClaw publish uses GitHub trusted publishing.
106107
- The publish run must be started manually with `workflow_dispatch`.
107-
- Both release workflows accept `preflight_only=true` to run CI
108-
validation/build steps without entering the gated publish job.
108+
- The npm workflow and the private mac publish workflow accept
109+
`preflight_only=true` to run validation/build/package steps without uploading
110+
public release assets.
109111
- `preflight_only=true` on the npm workflow is also the right way to validate an
110112
existing tag after publish; it should keep running the build checks even when
111113
the npm version is already published.
112114
- Validation-only runs may be dispatched from a branch when you are testing a
113115
workflow change before merge.
114-
- macOS release workflows run on GitHub's xlarge macOS runner and use a
116+
- `.github/workflows/macos-release.yml` in `openclaw/openclaw` is now a
117+
public validation-only handoff. It validates the tag/release state and points
118+
operators to the private repo; it does not build or publish macOS artifacts.
119+
- Real mac preflight and real mac publish both use
120+
`openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml`.
121+
- The private mac workflow runs on GitHub's xlarge macOS runner and uses a
115122
SwiftPM cache because the Swift build/test/package path is CPU-heavy.
116-
- macOS preflight uploads the ad-hoc `.zip` output as a workflow artifact so
117-
maintainers can download and inspect the built package before any real
118-
publish run.
119-
- npm preflight and macOS preflight must both pass before any publish run
120-
starts.
123+
- Private mac preflight uploads notarized build artifacts as workflow artifacts
124+
instead of uploading public GitHub release assets.
125+
- npm preflight, public mac validation, and private mac preflight must all pass
126+
before any real publish run starts.
121127
- Real publish runs must be dispatched from `main`; branch-dispatched publish
122128
attempts should fail before the protected environment is reached.
123129
- The release workflows stay tag-based; rely on the documented release sequence
124130
rather than workflow-level SHA pinning.
125131
- The `npm-release` environment must be approved by `@openclaw/openclaw-release-managers` before publish continues.
126-
- Mac publish uses `.github/workflows/macos-release.yml` for build, signing,
127-
notarization, stable-feed `appcast.xml` artifact generation, and release-asset
128-
upload.
132+
- Mac publish uses
133+
`openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml` for
134+
build, signing, notarization, stable-feed `appcast.xml` artifact generation,
135+
and release-asset upload.
129136
- The agent must download the signed `appcast.xml` artifact from a successful
130-
stable mac workflow and then update `appcast.xml` on `main`.
137+
stable private mac workflow and then update `appcast.xml` on `main`.
131138
- For beta mac releases, do not update the shared production `appcast.xml`
132139
unless a separate beta Sparkle feed exists.
133-
- `.github/workflows/macos-release.yml` still requires the `mac-release`
134-
environment approval.
140+
- The private repo targets a dedicated `mac-release` environment. If the GitHub
141+
plan does not yet support required reviewers there, do not assume the
142+
environment alone is the approval boundary; rely on private repo access and
143+
CODEOWNERS until those settings can be enabled.
135144
- Do not use `NPM_TOKEN` or the plugin OTP flow for OpenClaw releases.
136145
- `@openclaw/*` plugin publishes use a separate maintainer-only flow.
137146
- Only publish plugins that already exist on npm; bundled disk-tree-only plugins stay unpublished.
@@ -165,25 +174,27 @@ OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT=1 pnpm test:install:smoke
165174
8. Create or refresh the matching GitHub release.
166175
9. Start `.github/workflows/openclaw-npm-release.yml` with `preflight_only=true`
167176
and wait for it to pass.
168-
10. Start `.github/workflows/macos-release.yml` with `preflight_only=true` and
169-
wait for it to pass.
170-
11. If either preflight fails, fix the issue on a new commit, delete the tag
171-
and matching GitHub release, recreate them from the fixed commit, and rerun
172-
both preflights from scratch before continuing. Never reuse old preflight
173-
results after the commit changes.
174-
12. Start `.github/workflows/openclaw-npm-release.yml` with the same tag for
177+
10. Start `.github/workflows/macos-release.yml` in `openclaw/openclaw` and wait
178+
for the public validation-only run to pass.
179+
11. Start
180+
`openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml`
181+
with `preflight_only=true` and wait for it to pass.
182+
12. If any preflight or validation run fails, fix the issue on a new commit,
183+
delete the tag and matching GitHub release, recreate them from the fixed
184+
commit, and rerun all relevant preflights from scratch before continuing.
185+
Never reuse old preflight results after the commit changes.
186+
13. Start `.github/workflows/openclaw-npm-release.yml` with the same tag for
175187
the real publish.
176-
13. Wait for `npm-release` approval from `@openclaw/openclaw-release-managers`.
177-
14. Start `.github/workflows/macos-release.yml` for the real publish and wait
178-
for `mac-release` approval and success.
179-
15. For stable releases, let the mac workflow generate the signed
180-
`appcast.xml` artifact before it uploads the public mac assets, then
181-
download that artifact from the successful run, update `appcast.xml` on
182-
`main`, and verify the feed.
183-
16. For beta releases, publish the mac assets but expect no shared production
188+
14. Wait for `npm-release` approval from `@openclaw/openclaw-release-managers`.
189+
15. Start
190+
`openclaw/releases-private/.github/workflows/openclaw-macos-publish.yml`
191+
for the real publish and wait for success.
192+
16. For stable releases, download `macos-appcast-<tag>` from the successful
193+
private mac run, update `appcast.xml` on `main`, and verify the feed.
194+
17. For beta releases, publish the mac assets but expect no shared production
184195
`appcast.xml` artifact and do not update the shared production feed unless a
185196
separate beta feed exists.
186-
17. After publish, verify npm and any attached release artifacts.
197+
18. After publish, verify npm and any attached release artifacts.
187198

188199
## GHSA advisory work
189200

0 commit comments

Comments
 (0)