openclaw
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/ci.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.github/workflows/openclaw-release-telegram-qa.yml‎
Lines changed: 30 additions & 12 deletions b/‎.github/workflows/openclaw-release-telegram-qa.yml‎
Lines changed: 30 additions & 12 deletions
diff --git a/‎CHANGELOG.md‎
Lines changed: 1 addition & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 1 addition & 0 deletions
@@ -1202,7 +1202,7 @@ jobs:
             for scenario_id in "${scenario_ids[@]}"; do
               scenario_args+=(--scenario "$scenario_id")
             done
-            node openclaw.mjs qa run \
+            timeout --signal=TERM --kill-after=15s 10m node openclaw.mjs qa run \
               --repo-root . \
               --qa-profile smoke-ci \
               --concurrency 10 \
 
@@ -320,7 +320,7 @@ jobs:
                     trusted_reason="release-tag"
                     break
                   fi
-                done < <(git -C .candidate for-each-ref --format='%(refname)' refs/tags/v)
+                done < <(git -C .candidate for-each-ref --format='%(refname)' 'refs/tags/v*')
               fi
             fi
           fi
@@ -339,18 +339,27 @@ jobs:
                 -f name="$repository_name" \
                 -f oid="$candidate_sha"
             )"
-            signer="$(
+            signature_status="$(
               jq -er \
                 --arg sha "$candidate_sha" \
                 '.data.repository.object |
-                 select(.oid == $sha and .signature.isValid == true and .signature.state == "VALID") |
-                 .signature.signer.login' \
+                 select(.oid == $sha) |
+                 if .signature == null then "missing"
+                 elif .signature.isValid == true and .signature.state == "VALID" and
+                   (.signature.signer.login // "") != "" then "valid"
+                 else "invalid"
+                 end' \
                 <<<"$signature_json"
             )"
+            if [[ "$signature_status" == "invalid" ]]; then
+              echo "Release candidate ${candidate_sha} has an invalid commit signature." >&2
+              exit 1
+            fi
+            signer="$(jq -r '.data.repository.object.signature.signer.login // ""' <<<"$signature_json")"
             permission_actor="$signer"
-            if [[ "$signer" == "web-flow" ]]; then
+            if [[ "$signature_status" == "missing" || "$signer" == "web-flow" ]]; then
               if [[ "$trusted_reason" != "release-branch-head" || -z "$trusted_release_branch" ]]; then
-                echo "GitHub web-flow candidates require an exact release branch head." >&2
+                echo "Unsigned or GitHub web-flow candidates require an exact release branch head." >&2
                 exit 1
               fi
               permission_actor="$(
@@ -1002,7 +1011,7 @@ jobs:
                     trusted_reason="release-tag"
                     break
                   fi
-                done < <(git for-each-ref --format='%(refname)' refs/tags/v)
+                done < <(git for-each-ref --format='%(refname)' 'refs/tags/v*')
               fi
             fi
           fi
@@ -1018,18 +1027,27 @@ jobs:
                 -f name="$repository_name" \
                 -f oid="$candidate_sha"
             )"
-            signer="$(
+            signature_status="$(
               jq -er \
                 --arg sha "$candidate_sha" \
                 '.data.repository.object |
-                 select(.oid == $sha and .signature.isValid == true and .signature.state == "VALID") |
-                 .signature.signer.login' \
+                 select(.oid == $sha) |
+                 if .signature == null then "missing"
+                 elif .signature.isValid == true and .signature.state == "VALID" and
+                   (.signature.signer.login // "") != "" then "valid"
+                 else "invalid"
+                 end' \
                 <<<"$signature_json"
             )"
+            if [[ "$signature_status" == "invalid" ]]; then
+              echo "Release candidate ${candidate_sha} has an invalid commit signature." >&2
+              exit 1
+            fi
+            signer="$(jq -r '.data.repository.object.signature.signer.login // ""' <<<"$signature_json")"
             permission_actor="$signer"
-            if [[ "$signer" == "web-flow" ]]; then
+            if [[ "$signature_status" == "missing" || "$signer" == "web-flow" ]]; then
               if [[ "$trusted_reason" != "release-branch-head" || -z "$trusted_release_branch" ]]; then
-                echo "GitHub web-flow candidates require an exact release branch head." >&2
+                echo "Unsigned or GitHub web-flow candidates require an exact release branch head." >&2
                 exit 1
               fi
               permission_actor="$(
 
@@ -30,6 +30,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- **Plugin SDK API baseline:** cover every public entrypoint, preserve complete declaration shapes without source-line churn, and run baseline and export-surface guards from changed-file validation.
 - **SQLite terminal session recovery:** track physical transcript mutation time in the agent database so killed or timed-out main sessions rotate when transcript writes outlive the registry update, while preserving legacy transcript mtimes during doctor import.
 - **Gateway chat typecheck:** import chat event types from their owning protocol schema after the retired aggregate type module was removed, restoring full project typechecks.
 - **Packaged Crabbox commands:** include the lease-freshness helper imported by the published wrapper so `crabbox:*` commands do not fail with `ERR_MODULE_NOT_FOUND` in npm installs.