Skip to content

Commit 93e4837

Browse files
fuller-stack-devfuller-stack-dev
committed
Merge remote-tracking branch 'origin/main' into feat/webchat-reply-context
2 parents 105dd69 + 1626a16 commit 93e4837

781 files changed

Lines changed: 66090 additions & 21647 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/create-generated-pr-tokens/action.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,15 @@ inputs:
88
contents-private-key:
99
description: GitHub App private key with contents write access.
1010
required: true
11-
pull-request-app-id:
12-
description: GitHub App id with pull-request write access.
11+
pull-request-client-id:
12+
description: GitHub App client id with pull-request write access.
1313
required: true
1414
pull-request-private-key:
1515
description: GitHub App private key with pull-request write access.
1616
required: true
17+
pull-request-contents-permission:
18+
description: Optional contents permission for pull-request operations that require repository write access.
19+
required: false
1720

1821
outputs:
1922
contents-token:
@@ -40,8 +43,9 @@ runs:
4043
id: pull-request-token
4144
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
4245
with:
43-
app-id: ${{ inputs.pull-request-app-id }}
46+
client-id: ${{ inputs.pull-request-client-id }}
4447
private-key: ${{ inputs.pull-request-private-key }}
4548
owner: ${{ github.repository_owner }}
4649
repositories: ${{ github.event.repository.name }}
50+
permission-contents: ${{ inputs.pull-request-contents-permission }}
4751
permission-pull-requests: write

‎.github/actions/publish-generated-pr/action.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ inputs:
88
contents-private-key:
99
description: GitHub App private key with contents write access.
1010
required: true
11-
pull-request-app-id:
12-
description: GitHub App id with pull-request write access.
11+
pull-request-client-id:
12+
description: GitHub App client id with pull-request write access.
1313
required: true
1414
pull-request-private-key:
1515
description: GitHub App private key with pull-request write access.
@@ -57,8 +57,9 @@ runs:
5757
with:
5858
contents-client-id: ${{ inputs.contents-client-id }}
5959
contents-private-key: ${{ inputs.contents-private-key }}
60-
pull-request-app-id: ${{ inputs.pull-request-app-id }}
60+
pull-request-client-id: ${{ inputs.pull-request-client-id }}
6161
pull-request-private-key: ${{ inputs.pull-request-private-key }}
62+
pull-request-contents-permission: ${{ inputs.auto-merge == 'true' && 'write' || '' }}
6263

6364
- name: Publish generated pull request
6465
shell: bash

‎.github/workflows/control-ui-locale-refresh.yml‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,12 +89,33 @@ jobs:
8989
submodules: false
9090

9191
- name: Create generated PR tokens
92+
id: tokens
9293
uses: ./.github/actions/create-generated-pr-tokens
9394
with:
9495
contents-client-id: Iv23liOECG0slfuhz093
9596
contents-private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }}
96-
pull-request-app-id: ${{ secrets.MANTIS_GITHUB_APP_ID }}
97+
pull-request-client-id: Iv23liPJCozR0uHm6P7G
9798
pull-request-private-key: ${{ secrets.MANTIS_GITHUB_APP_PRIVATE_KEY }}
99+
pull-request-contents-permission: write
100+
101+
- name: Verify repository auto-merge setting
102+
env:
103+
GH_TOKEN: ${{ steps.tokens.outputs.pull-request-token }}
104+
REPOSITORY_NAME: ${{ github.event.repository.name }}
105+
REPOSITORY_OWNER: ${{ github.repository_owner }}
106+
run: |
107+
set -euo pipefail
108+
auto_merge_allowed="$(
109+
gh api graphql \
110+
-f query='query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { autoMergeAllowed } }' \
111+
-f owner="${REPOSITORY_OWNER}" \
112+
-f name="${REPOSITORY_NAME}" \
113+
--jq '.data.repository.autoMergeAllowed'
114+
)"
115+
if [[ "${auto_merge_allowed}" != "true" ]]; then
116+
echo "Repository auto-merge must be enabled before generated locale publication." >&2
117+
exit 1
118+
fi
98119
99120
refresh:
100121
needs: [resolve-base, publisher-preflight]
@@ -290,7 +311,7 @@ jobs:
290311
with:
291312
contents-client-id: Iv23liOECG0slfuhz093
292313
contents-private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }}
293-
pull-request-app-id: ${{ secrets.MANTIS_GITHUB_APP_ID }}
314+
pull-request-client-id: Iv23liPJCozR0uHm6P7G
294315
pull-request-private-key: ${{ secrets.MANTIS_GITHUB_APP_PRIVATE_KEY }}
295316
base-branch: ${{ github.event.repository.default_branch }}
296317
head-branch: automation/control-ui-locale-refresh

‎.github/workflows/maturity-scorecard.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,9 +50,6 @@ on:
5050
CLAWSWEEPER_APP_PRIVATE_KEY:
5151
description: Optional contents-write App key used only by canonical direct dispatches
5252
required: false
53-
MANTIS_GITHUB_APP_ID:
54-
description: Optional pull-request-write App id used only by canonical direct dispatches
55-
required: false
5653
MANTIS_GITHUB_APP_PRIVATE_KEY:
5754
description: Optional pull-request-write App key used only by canonical direct dispatches
5855
required: false
@@ -292,7 +289,7 @@ jobs:
292289
with:
293290
contents-client-id: Iv23liOECG0slfuhz093
294291
contents-private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }}
295-
pull-request-app-id: ${{ secrets.MANTIS_GITHUB_APP_ID }}
292+
pull-request-client-id: Iv23liPJCozR0uHm6P7G
296293
pull-request-private-key: ${{ secrets.MANTIS_GITHUB_APP_PRIVATE_KEY }}
297294

298295
generate_qa_evidence:
@@ -682,7 +679,7 @@ jobs:
682679
with:
683680
contents-client-id: Iv23liOECG0slfuhz093
684681
contents-private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }}
685-
pull-request-app-id: ${{ secrets.MANTIS_GITHUB_APP_ID }}
682+
pull-request-client-id: Iv23liPJCozR0uHm6P7G
686683
pull-request-private-key: ${{ secrets.MANTIS_GITHUB_APP_PRIVATE_KEY }}
687684
base-branch: ${{ needs.validate_selected_ref.outputs.publication_base }}
688685
head-branch: ${{ needs.validate_selected_ref.outputs.publication_head }}

‎.github/workflows/native-app-locale-refresh.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ jobs:
7676
with:
7777
contents-client-id: Iv23liOECG0slfuhz093
7878
contents-private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }}
79-
pull-request-app-id: ${{ secrets.MANTIS_GITHUB_APP_ID }}
79+
pull-request-client-id: Iv23liPJCozR0uHm6P7G
8080
pull-request-private-key: ${{ secrets.MANTIS_GITHUB_APP_PRIVATE_KEY }}
8181

8282
refresh:
@@ -283,7 +283,7 @@ jobs:
283283
with:
284284
contents-client-id: Iv23liOECG0slfuhz093
285285
contents-private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }}
286-
pull-request-app-id: ${{ secrets.MANTIS_GITHUB_APP_ID }}
286+
pull-request-client-id: Iv23liPJCozR0uHm6P7G
287287
pull-request-private-key: ${{ secrets.MANTIS_GITHUB_APP_PRIVATE_KEY }}
288288
base-branch: ${{ github.event.repository.default_branch }}
289289
head-branch: automation/native-app-locale-refresh

‎.github/workflows/pr-ci-sweeper.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: PR CI Sweeper
2+
3+
# Re-fires pull_request CI runs that GitHub dropped at PR open (merge-ref
4+
# race: no CI run attaches, or an un-rerunnable startup_failure is created).
5+
# Close/reopen with an app token re-fires the event; GITHUB_TOKEN events
6+
# would not trigger workflows.
7+
8+
on:
9+
schedule:
10+
- cron: "7 * * * *"
11+
workflow_dispatch:
12+
inputs:
13+
dry_run:
14+
description: Log intended re-fires without closing/reopening.
15+
required: false
16+
default: false
17+
type: boolean
18+
19+
env:
20+
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
21+
22+
concurrency:
23+
group: pr-ci-sweeper
24+
cancel-in-progress: false
25+
26+
permissions: {}
27+
28+
jobs:
29+
sweep:
30+
permissions:
31+
contents: read
32+
runs-on: ubuntu-24.04
33+
steps:
34+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
35+
with:
36+
ref: ${{ github.sha }}
37+
persist-credentials: false
38+
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
39+
id: app-token
40+
continue-on-error: true
41+
with:
42+
app-id: "2729701"
43+
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
44+
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
45+
id: app-token-fallback
46+
if: steps.app-token.outcome == 'failure'
47+
with:
48+
app-id: "2971289"
49+
private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
50+
- name: Sweep dropped PR CI runs
51+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
52+
with:
53+
github-token: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }}
54+
script: |
55+
const { pathToFileURL } = require("node:url");
56+
const moduleUrl = pathToFileURL(
57+
`${process.env.GITHUB_WORKSPACE}/scripts/github/pr-ci-sweeper.mjs`,
58+
);
59+
const { runPrCiSweeper } = await import(moduleUrl.href);
60+
61+
await runPrCiSweeper({
62+
github,
63+
context,
64+
core,
65+
dryRun: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }},
66+
appSlug: ${{ toJSON(steps.app-token.outputs.app-slug || steps.app-token-fallback.outputs.app-slug || '') }},
67+
});

‎.github/workflows/qa-profile-evidence.yml‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@ on:
3939
OPENAI_API_KEY:
4040
description: OpenAI API key used by live QA profile scenarios
4141
required: true
42+
OPENCLAW_QA_CONVEX_SITE_URL:
43+
description: Optional Convex credential broker URL supplied by qa-live-shared
44+
required: false
45+
OPENCLAW_QA_CONVEX_SECRET_CI:
46+
description: Optional Convex CI credential supplied by qa-live-shared
47+
required: false
4248
outputs:
4349
artifact_name:
4450
description: Uploaded QA profile evidence artifact name
@@ -191,7 +197,7 @@ jobs:
191197
name: Generate QA profile evidence
192198
needs: validate_selected_ref
193199
runs-on: blacksmith-8vcpu-ubuntu-2404
194-
timeout-minutes: 60
200+
timeout-minutes: ${{ inputs.qa_profile == 'all' && 240 || 60 }}
195201
permissions:
196202
contents: read
197203
outputs:
@@ -240,11 +246,34 @@ jobs:
240246
throw new Error(`Unknown QA profile ${requested}. Available profiles: ${available}`);
241247
}
242248
243-
fs.appendFileSync(process.env.GITHUB_OUTPUT, `profile=${profile.id}\n`);
249+
fs.appendFileSync(
250+
process.env.GITHUB_OUTPUT,
251+
`profile=${profile.id}\nchannel_driver=${profile.channelDriver}\n`,
252+
);
244253
NODE
245254
246255
echo "QA profile: \`${QA_PROFILE}\`" >> "$GITHUB_STEP_SUMMARY"
247256
257+
- name: Require live profile credentials
258+
if: steps.profile.outputs.channel_driver == 'live'
259+
env:
260+
OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
261+
OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
262+
shell: bash
263+
run: |
264+
set -euo pipefail
265+
266+
require_var() {
267+
local name="$1"
268+
if [[ -z "${!name:-}" ]]; then
269+
echo "Missing required qa-live-shared secret: ${name}" >&2
270+
exit 1
271+
fi
272+
}
273+
274+
require_var OPENCLAW_QA_CONVEX_SITE_URL
275+
require_var OPENCLAW_QA_CONVEX_SECRET_CI
276+
248277
- name: Build private QA runtime
249278
env:
250279
NODE_OPTIONS: --max-old-space-size=8192
@@ -258,6 +287,11 @@ jobs:
258287
env:
259288
QA_PROFILE: ${{ steps.profile.outputs.profile }}
260289
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
290+
OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
291+
OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
292+
OPENCLAW_QA_CREDENTIAL_ACQUIRE_TIMEOUT_MS: "1800000"
293+
OPENCLAW_QA_CREDENTIAL_ROLE: ci
294+
OPENCLAW_QA_CREDENTIAL_SOURCE: convex
261295
shell: bash
262296
run: |
263297
set -euo pipefail

‎AGENTS.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ Skills own workflows; root owns hard policy and routing.
7777
- State/storage migrations are database-first. Runtime reads/writes the canonical store only. Old file stores, sidecars, aliases, and fallback readers belong in `openclaw doctor --fix` migration code only, never steady-state runtime.
7878
- Storage default: SQLite only. Do not add JSON/JSONL/TXT/sidecar files for OpenClaw-owned runtime state, caches, queues, registries, indexes, cursors, checkpoints, or plugin scratch data.
7979
- Any SQLite change requiring a schema-version bump needs explicit user discussion and acceptance before implementation. Agents must not advance SQLite schema versions autonomously.
80+
- Purely additive SQLite surface (new tables; downgraded builds keep working, just without the new feature): do not bump the schema version. Declare in the canonical schema file plus a one-time idempotent lazy ensure on first feature use; fold into the migration path at the next natural bump. Bumps are reserved for changes older readers cannot tolerate.
8081
- SQLite runtime access uses Kysely helpers, not raw SQL statement strings, except schema DDL, migrations, low-level DB bootstrap, or narrowly justified SQLite primitives.
8182
- SQLite write transactions are synchronous commit sections only. Finish async planning, filesystem access, plugin hooks, and predicates before `BEGIN`; then reread and validate authoritative rows before writing. Never return a Promise or execute `await` from a transaction callback.
8283
- Use the shared state DB (`state/openclaw.sqlite`) for global runtime state and plugin KV data. Use the per-agent DB (`agents/<agentId>/agent/openclaw-agent.sqlite`) for agent-scoped state/cache. Use a dedicated SQLite DB only when schema, volume, or lifecycle clearly does not fit those stores.
@@ -232,6 +233,7 @@ Skills own workflows; root owns hard policy and routing.
232233
- No surprise GH writes: chat must mention every posted/updated public comment with URL.
233234
- GH comments with backticks, `$`, or shell snippets: use heredoc/body file, not inline double-quoted `--body`.
234235
- PR create: real body required. Use the current template: `What Problem This Solves`, `Why This Change Was Made`, `User Impact`, and `Evidence`; include visible refs, behavior, and validation.
236+
- PR create races GitHub's merge-ref computation: the pull_request-open CI run can drop entirely or die as `startup_failure`/`BuildFailed` (`(Unknown event)`, not rerunnable). After opening, verify the CI workflow attached to the head SHA; if missing, close/reopen the PR to re-fire the event.
235237
- PR create/refresh: keep PR branches takeover-ready. Use a branch maintainers can push to, or for fork PRs ensure `maintainer_can_modify` / GitHub's `Allow edits by maintainers` is enabled unless explicitly told otherwise or GitHub's Actions/secrets warning makes that unsafe.
236238
- GitHub issue/PR create: read `$agent-transcript`; ask about sanitized transcript logs when available.
237239
- Contributor PRs: parsed context requires authored `What Problem This Solves` and `Evidence` sections. Do not require field-level proof forms; reviewers inspect code, tests, and CI for correctness.

0 commit comments

Comments
 (0)