Skip to content

Commit b581ef7

Browse files
edenfunfedenfunf
authored
Merge branch 'main' into fix/line-inbound-media-202
2 parents 89f60f8 + 23d2f66 commit b581ef7

786 files changed

Lines changed: 39170 additions & 19231 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1693,7 +1693,10 @@ jobs:
16931693
run: echo "OPENCLAW_VITEST_MAX_WORKERS=2" >> "$GITHUB_ENV"
16941694

16951695
- name: Run Node test shard
1696+
# actionlint 1.7.11 lacks GitHub's current job.workflow_* fields. Serialize the
1697+
# non-secret job context, then validate the defining workflow identity below.
16961698
env:
1699+
JOB_CONTEXT_JSON: ${{ toJSON(job) }}
16971700
NODE_OPTIONS: --max-old-space-size=8192
16981701
OPENCLAW_NODE_TEST_GROUPS_JSON: ${{ toJson(matrix.groups || null) }}
16991702
OPENCLAW_NODE_TEST_CONFIGS_JSON: ${{ toJson(matrix.configs) }}
@@ -1712,14 +1715,25 @@ jobs:
17121715
# Frozen release targets can predate the workflow-owned shard runner.
17131716
# Load only that runner from the exact trusted workflow commit while
17141717
# keeping its child tests rooted in the checked-out candidate.
1718+
job_workflow_repository=$(jq -r '.workflow_repository // empty' <<<"$JOB_CONTEXT_JSON")
1719+
job_workflow_sha=$(jq -r '.workflow_sha // empty' <<<"$JOB_CONTEXT_JSON")
1720+
if [[ ! "$job_workflow_repository" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
1721+
echo "invalid job workflow repository: $job_workflow_repository" >&2
1722+
exit 1
1723+
fi
1724+
if [[ ! "$job_workflow_sha" =~ ^[0-9a-f]{40}$ ]]; then
1725+
echo "invalid job workflow SHA: $job_workflow_sha" >&2
1726+
exit 1
1727+
fi
17151728
harness_root="${RUNNER_TEMP}/openclaw-ci-shard-runner"
1716-
git fetch --no-tags --depth=1 origin "$GITHUB_SHA"
1729+
workflow_remote="https://github.com/${job_workflow_repository}.git"
1730+
git fetch --no-tags --depth=1 "$workflow_remote" "$job_workflow_sha"
17171731
for file in \
17181732
scripts/ci-run-node-test-shard.mjs \
17191733
scripts/lib/direct-run.mjs \
17201734
scripts/lib/local-heavy-check-runtime.mjs; do
17211735
mkdir -p "${harness_root}/$(dirname "$file")"
1722-
git show "${GITHUB_SHA}:${file}" > "${harness_root}/${file}"
1736+
git show "${job_workflow_sha}:${file}" > "${harness_root}/${file}"
17231737
done
17241738
runner="${harness_root}/${runner}"
17251739
fi

‎.github/workflows/full-release-validation.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1053,6 +1053,9 @@ jobs:
10531053
-f allow_unreleased_changelog="$ALLOW_UNRELEASED_CHANGELOG"
10541054
-f rerun_group="$child_rerun_group"
10551055
)
1056+
if [[ -n "${TARGET_CONTEXT_REF// }" ]]; then
1057+
args+=(-f allow_frozen_target_scenario_omissions=true)
1058+
fi
10561059
if [[ -n "${LIVE_SUITE_FILTER// }" ]]; then
10571060
args+=(-f live_suite_filter="$LIVE_SUITE_FILTER")
10581061
fi

‎.github/workflows/openclaw-live-and-e2e-checks-reusable.yml‎

Lines changed: 40 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,11 @@ on:
4747
required: false
4848
default: ""
4949
type: string
50+
allow_frozen_target_scenario_omissions:
51+
description: Trusted opt-in to omit survivor scenarios absent from a canonical frozen target
52+
required: false
53+
default: false
54+
type: boolean
5055
shared_image_policy:
5156
description: Shared Docker image transport
5257
required: true
@@ -185,6 +190,11 @@ on:
185190
required: false
186191
default: ""
187192
type: string
193+
allow_frozen_target_scenario_omissions:
194+
description: Trusted opt-in to omit survivor scenarios absent from a canonical frozen target
195+
required: false
196+
default: false
197+
type: boolean
188198
package_artifact_name:
189199
description: Existing workflow artifact containing openclaw-current.tgz; blank packs the selected ref
190200
required: false
@@ -389,6 +399,7 @@ env:
389399
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
390400
NODE_VERSION: "24.15.0"
391401
OPENCLAW_DOCKER_E2E_ALLOW_UNRELEASED_CHANGELOG: ${{ inputs.allow_unreleased_changelog }}
402+
OPENCLAW_ALLOW_FROZEN_TARGET_SCENARIO_OMISSIONS: ${{ inputs.allow_frozen_target_scenario_omissions && '1' || '0' }}
392403
OPENCLAW_UPGRADE_SURVIVOR_TARGET_ROOT: ${{ github.workspace }}
393404

394405
jobs:
@@ -2263,15 +2274,6 @@ jobs:
22632274
fetch-depth: 1
22642275
persist-credentials: false
22652276

2266-
- name: Checkout trusted release harness
2267-
if: inputs.shared_image_policy == 'no-push-artifact'
2268-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2269-
with:
2270-
repository: ${{ needs.validate_selected_ref.outputs.workflow_repository }}
2271-
ref: ${{ needs.validate_selected_ref.outputs.workflow_sha }}
2272-
path: .release-harness
2273-
persist-credentials: false
2274-
22752277
- name: Resolve shared live-test image tag
22762278
id: image
22772279
shell: bash
@@ -2341,6 +2343,17 @@ jobs:
23412343
load: true
23422344
push: false
23432345

2346+
# Keep trusted tooling outside the target's Docker build context. A frozen
2347+
# target must not accidentally package the current checkout into its image.
2348+
- name: Checkout trusted release harness
2349+
if: inputs.shared_image_policy == 'no-push-artifact'
2350+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2351+
with:
2352+
repository: ${{ needs.validate_selected_ref.outputs.workflow_repository }}
2353+
ref: ${{ needs.validate_selected_ref.outputs.workflow_sha }}
2354+
path: .release-harness
2355+
persist-credentials: false
2356+
23442357
- name: Pack live-test image artifact
23452358
id: image_artifact
23462359
if: inputs.shared_image_policy == 'no-push-artifact'
@@ -3332,8 +3345,18 @@ jobs:
33323345
path: .release-harness
33333346
persist-credentials: false
33343347

3348+
- name: Resolve frozen Codex live compatibility
3349+
id: codex_compat
3350+
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
3351+
env:
3352+
OPENCLAW_FROZEN_CODEX_SUITE_ID: ${{ matrix.suite_id }}
3353+
OPENCLAW_FROZEN_TARGET_ROOT: ${{ github.workspace }}
3354+
OPENCLAW_SELECTED_SHA: ${{ needs.validate_selected_ref.outputs.selected_sha }}
3355+
OPENCLAW_WORKFLOW_SHA: ${{ needs.validate_selected_ref.outputs.workflow_sha }}
3356+
run: node .release-harness/scripts/resolve-frozen-codex-live-suite.mjs
3357+
33353358
- name: Validate live-test image artifact binding
3336-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy == 'no-push-artifact'
3359+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy == 'no-push-artifact'
33373360
env:
33383361
ARTIFACT_DIGEST: ${{ needs.prepare_live_test_image.outputs.image_artifact_digest }}
33393362
ARTIFACT_ID: ${{ needs.prepare_live_test_image.outputs.image_artifact_id }}
@@ -3350,7 +3373,7 @@ jobs:
33503373
"$ARTIFACT_RUN_ID" "$ARTIFACT_RUN_ATTEMPT"
33513374
33523375
- name: Download live-test image artifact
3353-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy == 'no-push-artifact'
3376+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy == 'no-push-artifact'
33543377
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
33553378
with:
33563379
artifact-ids: ${{ needs.prepare_live_test_image.outputs.image_artifact_id }}
@@ -3359,7 +3382,7 @@ jobs:
33593382
github-token: ${{ github.token }}
33603383

33613384
- name: Verify and load live-test image artifact
3362-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy == 'no-push-artifact'
3385+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy == 'no-push-artifact'
33633386
env:
33643387
ARCHIVE_SHA256: ${{ needs.prepare_live_test_image.outputs.image_archive_sha256 }}
33653388
LIVE_IMAGE: ${{ needs.prepare_live_test_image.outputs.live_image }}
@@ -3375,25 +3398,25 @@ jobs:
33753398
load .artifacts/live-test-image live-test "$TARGET_SHA" "$WORKFLOW_SHA" "$LIVE_IMAGE"
33763399
33773400
- name: Setup Node environment
3378-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
3401+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
33793402
uses: ./.github/actions/setup-node-env
33803403
with:
33813404
node-version: ${{ env.NODE_VERSION }}
33823405
install-bun: "true"
33833406

33843407
- name: Hydrate live auth/profile inputs
3385-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
3408+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
33863409
run: bash scripts/ci-hydrate-live-auth.sh
33873410

33883411
- name: Log in to GHCR
3389-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy != 'no-push-artifact'
3412+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group) && inputs.shared_image_policy != 'no-push-artifact'
33903413
run: bash .release-harness/scripts/ci-docker-login-ghcr.sh
33913414
env:
33923415
GHCR_USERNAME: ${{ github.actor }}
33933416
GITHUB_TOKEN: ${{ github.token }}
33943417

33953418
- name: Configure suite-specific env
3396-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
3419+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
33973420
shell: bash
33983421
run: |
33993422
set -euo pipefail
@@ -3433,7 +3456,7 @@ jobs:
34333456
esac
34343457
34353458
- name: Run ${{ matrix.label }}
3436-
if: contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
3459+
if: steps.codex_compat.outputs.run_lane != 'false' && contains(matrix.profiles, inputs.release_test_profile) && (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id || inputs.live_suite_filter == matrix.suite_group)
34373460
env:
34383461
OPENCLAW_LIVE_COMMAND: ${{ matrix.command }}
34393462
OPENCLAW_LIVE_SUITE_ADVISORY: ${{ matrix.advisory }}

‎.github/workflows/openclaw-release-checks.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,11 @@ on:
5656
required: false
5757
default: false
5858
type: boolean
59+
allow_frozen_target_scenario_omissions:
60+
description: Allow trusted compatibility filtering for a canonical frozen release target
61+
required: false
62+
default: false
63+
type: boolean
5964
rerun_group:
6065
description: Release check group to run
6166
required: false
@@ -722,6 +727,7 @@ jobs:
722727
uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
723728
with:
724729
advisory: ${{ startsWith(github.ref, 'refs/heads/tideclaw/alpha/') }}
730+
allow_frozen_target_scenario_omissions: ${{ inputs.allow_frozen_target_scenario_omissions }}
725731
allow_unreleased_changelog: ${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}
726732
# Live-provider suites depend on third-party model deployments; beta
727733
# treats only those as advisory while repo E2E stays blocking and
@@ -796,6 +802,7 @@ jobs:
796802
uses: ./.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
797803
with:
798804
advisory: ${{ startsWith(github.ref, 'refs/heads/tideclaw/alpha/') }}
805+
allow_frozen_target_scenario_omissions: ${{ inputs.allow_frozen_target_scenario_omissions }}
799806
allow_unreleased_changelog: ${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}
800807
ref: ${{ needs.resolve_target.outputs.revision }}
801808
include_repo_e2e: false

0 commit comments

Comments
 (0)