fix(release): make Windows recovery fail closed

fuller-stack-dev · fuller-stack-dev · commit 7b1ce34f0c6a · 2026-06-13T02:46:08.000-06:00
diff --git a/.github/workflows/windows-node-release.yml b/.github/workflows/windows-node-release.yml
@@ -40,6 +40,10 @@ jobs:
           if ($env:RELEASE_TAG -notmatch '^v[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*((-(alpha|beta)\.[1-9][0-9]*)|(-[1-9][0-9]*))?$') {
             throw "Invalid OpenClaw release tag: $env:RELEASE_TAG"
           }
+          $stableRelease = -not (
+            $env:RELEASE_TAG.Contains("-alpha.") -or
+            $env:RELEASE_TAG.Contains("-beta.")
+          )
           if ($env:WINDOWS_NODE_TAG -notmatch '^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$') {
             throw "windows_node_tag must be an explicit openclaw-windows-node release tag, not latest: $env:WINDOWS_NODE_TAG"
           }
@@ -54,6 +58,10 @@ jobs:
             "OpenClawCompanion-Setup-x64.exe",
             "OpenClawCompanion-Setup-arm64.exe"
           )
+          $allowedTargetCompanionAssetNames = @(
+            $requiredInstallerNames
+            "OpenClawCompanion-SHA256SUMS.txt"
+          )
           if ($expectedDigests.Count -ne $requiredInstallerNames.Count) {
             throw "expected_installer_digests must contain exactly the current installer asset contract."
           }
@@ -64,10 +72,22 @@ jobs:
             }
           }
 
-          $targetRelease = gh release view $env:RELEASE_TAG --repo $env:GITHUB_REPOSITORY --json tagName,isDraft,isPrerelease,url | ConvertFrom-Json
+          $targetRelease = gh release view $env:RELEASE_TAG --repo $env:GITHUB_REPOSITORY --json tagName,isDraft,isPrerelease,assets,url | ConvertFrom-Json
           if ($targetRelease.tagName -ne $env:RELEASE_TAG) {
             throw "OpenClaw release tag mismatch: expected $env:RELEASE_TAG, got $($targetRelease.tagName)"
           }
+          $unexpectedTargetCompanionAssets = @(
+            $targetRelease.assets |
+              Where-Object {
+                $_.name.StartsWith("OpenClawCompanion-") -and
+                $_.name -notin $allowedTargetCompanionAssetNames
+              } |
+              ForEach-Object name |
+              Sort-Object
+          )
+          if ($unexpectedTargetCompanionAssets.Count -ne 0) {
+            throw "Target OpenClaw release contains unexpected OpenClawCompanion assets before upload: $($unexpectedTargetCompanionAssets -join ', ')"
+          }
 
           $sourceRelease = gh release view $env:WINDOWS_NODE_TAG --repo openclaw/openclaw-windows-node --json tagName,isDraft,isPrerelease,url | ConvertFrom-Json
           if ($sourceRelease.tagName -ne $env:WINDOWS_NODE_TAG) {
@@ -76,7 +96,7 @@ jobs:
           if ($sourceRelease.isDraft) {
             throw "Windows source release must be published: $($sourceRelease.url)"
           }
-          if (-not $targetRelease.isPrerelease -and $sourceRelease.isPrerelease) {
+          if ($stableRelease -and $sourceRelease.isPrerelease) {
             throw "Stable OpenClaw releases require a non-prerelease Windows source release: $($sourceRelease.url)"
           }
 
diff --git a/test/scripts/package-acceptance-workflow.test.ts b/test/scripts/package-acceptance-workflow.test.ts
@@ -1656,6 +1656,24 @@ describe("package artifact reuse", () => {
     expect(releaseWorkflow).toContain('else error("malformed Windows checksum manifest entry")');
   });
 
+  it("rejects unsafe direct Windows recovery before uploading assets", () => {
+    const windowsWorkflow = readFileSync(WINDOWS_NODE_RELEASE_WORKFLOW, "utf8");
+    const classifyStableReleaseIndex = windowsWorkflow.indexOf("$stableRelease = -not (");
+    const rejectPrereleaseSourceIndex = windowsWorkflow.indexOf(
+      "if ($stableRelease -and $sourceRelease.isPrerelease)",
+    );
+    const rejectUnexpectedTargetAssetsIndex = windowsWorkflow.indexOf(
+      "Target OpenClaw release contains unexpected OpenClawCompanion assets before upload",
+    );
+    const uploadAssetsIndex = windowsWorkflow.indexOf("gh release upload $env:RELEASE_TAG");
+
+    expect(classifyStableReleaseIndex).toBeGreaterThan(-1);
+    expect(rejectPrereleaseSourceIndex).toBeGreaterThan(classifyStableReleaseIndex);
+    expect(windowsWorkflow).not.toContain("-not $targetRelease.isPrerelease");
+    expect(rejectUnexpectedTargetAssetsIndex).toBeGreaterThan(-1);
+    expect(uploadAssetsIndex).toBeGreaterThan(rejectUnexpectedTargetAssetsIndex);
+  });
+
   it("keeps beta release verification and ClawHub publish repair hooks wired", () => {
     const packageJson = JSON.parse(readFileSync("package.json", "utf8")) as {
       scripts?: Record<string, string>;

Original file line number	Diff line number	Diff line change
`@@ -40,6 +40,10 @@ jobs:`
`40`	`40`	`if ($env:RELEASE_TAG -notmatch '^v[0-9]{4}\.[1-9][0-9]\.[1-9][0-9]((-(alpha\|beta)\.[1-9][0-9])\|(-[1-9][0-9]))?$') {`
`41`	`41`	`throw "Invalid OpenClaw release tag: $env:RELEASE_TAG"`
`42`	`42`	`}`
	`43`	`+ $stableRelease = -not (`
	`44`	`+ $env:RELEASE_TAG.Contains("-alpha.") -or`
	`45`	`+ $env:RELEASE_TAG.Contains("-beta.")`
	`46`	`+ )`
`43`	`47`	`if ($env:WINDOWS_NODE_TAG -notmatch '^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$') {`
`44`	`48`	`throw "windows_node_tag must be an explicit openclaw-windows-node release tag, not latest: $env:WINDOWS_NODE_TAG"`
`45`	`49`	`}`
`@@ -54,6 +58,10 @@ jobs:`
`54`	`58`	`"OpenClawCompanion-Setup-x64.exe",`
`55`	`59`	`"OpenClawCompanion-Setup-arm64.exe"`
`56`	`60`	`)`
	`61`	`+ $allowedTargetCompanionAssetNames = @(`
	`62`	`+ $requiredInstallerNames`
	`63`	`+ "OpenClawCompanion-SHA256SUMS.txt"`
	`64`	`+ )`
`57`	`65`	`if ($expectedDigests.Count -ne $requiredInstallerNames.Count) {`
`58`	`66`	`throw "expected_installer_digests must contain exactly the current installer asset contract."`
`59`	`67`	`}`
`@@ -64,10 +72,22 @@ jobs:`
`64`	`72`	`}`
`65`	`73`	`}`
`66`	`74`
`67`		`- $targetRelease = gh release view $env:RELEASE_TAG --repo $env:GITHUB_REPOSITORY --json tagName,isDraft,isPrerelease,url \| ConvertFrom-Json`
	`75`	`+ $targetRelease = gh release view $env:RELEASE_TAG --repo $env:GITHUB_REPOSITORY --json tagName,isDraft,isPrerelease,assets,url \| ConvertFrom-Json`
`68`	`76`	`if ($targetRelease.tagName -ne $env:RELEASE_TAG) {`
`69`	`77`	`throw "OpenClaw release tag mismatch: expected $env:RELEASE_TAG, got $($targetRelease.tagName)"`
`70`	`78`	`}`
	`79`	`+ $unexpectedTargetCompanionAssets = @(`
	`80`	`+ $targetRelease.assets \|`
	`81`	`+ Where-Object {`
	`82`	`+ $_.name.StartsWith("OpenClawCompanion-") -and`
	`83`	`+ $_.name -notin $allowedTargetCompanionAssetNames`
	`84`	`+ } \|`
	`85`	`+ ForEach-Object name \|`
	`86`	`+ Sort-Object`
	`87`	`+ )`
	`88`	`+ if ($unexpectedTargetCompanionAssets.Count -ne 0) {`
	`89`	`+ throw "Target OpenClaw release contains unexpected OpenClawCompanion assets before upload: $($unexpectedTargetCompanionAssets -join ', ')"`
	`90`	`+ }`
`71`	`91`
`72`	`92`	`$sourceRelease = gh release view $env:WINDOWS_NODE_TAG --repo openclaw/openclaw-windows-node --json tagName,isDraft,isPrerelease,url \| ConvertFrom-Json`
`73`	`93`	`if ($sourceRelease.tagName -ne $env:WINDOWS_NODE_TAG) {`
`@@ -76,7 +96,7 @@ jobs:`
`76`	`96`	`if ($sourceRelease.isDraft) {`
`77`	`97`	`throw "Windows source release must be published: $($sourceRelease.url)"`
`78`	`98`	`}`
`79`		`- if (-not $targetRelease.isPrerelease -and $sourceRelease.isPrerelease) {`
	`99`	`+ if ($stableRelease -and $sourceRelease.isPrerelease) {`
`80`	`100`	`throw "Stable OpenClaw releases require a non-prerelease Windows source release: $($sourceRelease.url)"`
`81`	`101`	`}`
`82`	`102`