maturity_scorecard_release_checks:

name: Render maturity scorecard release docs

needs: [resolve_target]

if: contains(fromJSON('["all","qa"]'), needs.resolve_target.outputs.rerun_group)

permissions:

actions: read

contents: read

uses: ./.github/workflows/maturity-scorecard.yml

with:

ref: ${{ needs.resolve_target.outputs.ref }}

expected_sha: ${{ needs.resolve_target.outputs.revision }}

secrets:

OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

- maturity_scorecard_release_checks

`Full Release Validation` is the manual umbrella workflow for "run everything before release." It accepts a branch, tag, or full commit SHA, dispatches the manual `CI` workflow with that target, dispatches `Plugin Prerelease` for release-only plugin/package/static/Docker proof, and dispatches `OpenClaw Release Checks` for install smoke, package acceptance, cross-OS package checks, maturity scorecard rendering from QA profile evidence, QA Lab parity, Matrix, and Telegram lanes. Stable and full profiles always include exhaustive live/E2E and Docker release-path soak coverage; the beta profile can opt in with `run_release_soak=true`. The canonical package Telegram E2E runs inside Package Acceptance, so a full candidate does not start a duplicate live poller. After publishing, pass `release_package_spec` to reuse the shipped npm package across release checks, Package Acceptance, Docker, cross-OS, and Telegram without rebuilding. Use `npm_telegram_package_spec` only for a focused published-package Telegram rerun. The Codex plugin live package lane uses the same selected state by default: published `release_package_spec=openclaw@<tag>` derives `codex_plugin_spec=npm:@openclaw/codex@<tag>`, while SHA/artifact runs pack `extensions/codex` from the selected ref. Set `codex_plugin_spec` explicitly for custom plugin sources such as `npm:`, `npm-pack:`, or `git:` specs.

function readReleaseChecksWorkflow() {

return parse(readFileSync(".github/workflows/openclaw-release-checks.yml", "utf8"));

expect(maturityWorkflow.on.workflow_call.inputs).toMatchObject({

qa_evidence_run_id: {

description: "Optional workflow run id containing qa-evidence.json",

required: false,

default: "",

type: "string",

},

ref: {

description: "OpenClaw branch, tag, or SHA containing the maturity score source",

required: true,

type: "string",

},

expected_sha: {

description: "Optional full SHA that ref must resolve to",

required: false,

default: "",

type: "string",

},

});

expect(maturityWorkflow.on.workflow_call.secrets.OPENAI_API_KEY.required).toBe(true);

expect(

maturityWorkflow.on.workflow_call.secrets.OPENCLAW_MATURITY_SCORECARD_AGENT_OPENAI_API_KEY

.required,

).toBe(false);

expect(maturityWorkflow.on.workflow_call.secrets.GH_APP_PRIVATE_KEY.required).toBe(false);

expect(maturityWorkflow.on.workflow_call.secrets.GH_APP_PRIVATE_KEY_FALLBACK.required).toBe(

false,

);

expected_sha: "${{ needs.validate_selected_ref.outputs.selected_revision }}",

const validateRefStep = maturityWorkflow.jobs.validate_selected_ref.steps.find(

(step) => step.name === "Validate selected ref",

);

expect(validateRefStep.env.EXPECTED_SHA).toBe("${{ inputs.expected_sha }}");

expect(validateRefStep.run).toContain("expected_sha must be a full 40-character SHA");

expect(validateRefStep.run).toContain('"${selected_revision,,}" != "$expected_sha"');

const createTokenStep = publishJob.steps.find(

(step) => step.name === "Create generated docs PR app token",

);

const createFallbackTokenStep = publishJob.steps.find(

(step) => step.name === "Create generated docs PR fallback app token",

);

const openDocsPrStep = publishJob.steps.find((step) => step.name === "Open generated docs PR");

expect(createTokenStep.if).toBe("${{ github.event_name == 'workflow_dispatch' }}");

expect(createFallbackTokenStep.if).toBe(

"${{ github.event_name == 'workflow_dispatch' && steps.app-token.outcome == 'failure' }}",

);

expect(openDocsPrStep.if).toBe("${{ github.event_name == 'workflow_dispatch' }}");

});

it("runs maturity scorecard from release checks", () => {

const releaseWorkflow = readReleaseChecksWorkflow();

const job = releaseWorkflow.jobs.maturity_scorecard_release_checks;

const summaryJob = releaseWorkflow.jobs.summary;

const verifyStep = summaryJob.steps.find(

(step) => step.name === "Verify release check results",

);

expect(releaseWorkflow.jobs).not.toHaveProperty("qa_profile_release_evidence_release_checks");

expect(job.name).toBe("Render maturity scorecard release docs");

expect(job.if).toBe(

'contains(fromJSON(\'["all","qa"]\'), needs.resolve_target.outputs.rerun_group)',

);

expect(job.permissions).toMatchObject({

actions: "read",

contents: "read",

});

expect(job.uses).toBe("./.github/workflows/maturity-scorecard.yml");

expect(job.with).toMatchObject({

ref: "${{ needs.resolve_target.outputs.ref }}",

expected_sha: "${{ needs.resolve_target.outputs.revision }}",

});

expect(job.with).not.toHaveProperty("qa_profile");

expect(summaryJob.needs).toContain("maturity_scorecard_release_checks");

expect(verifyStep.run).toContain(

'"maturity_scorecard_release_checks=${{ needs.maturity_scorecard_release_checks.result }}"',

);

expect(verifyStep.run).not.toContain("qa_profile_release_evidence_release_checks");