fix(mantis): stop git-backed evidence publishing

steipete · steipete · commit c9b6b0be0e36 · 2026-05-14T18:34:31.000+01:00
diff --git a/.gitignore b/.gitignore
@@ -41,6 +41,7 @@ apps/macos/.build/
 apps/macos-mlx-tts/.build/
 apps/shared/MoltbotKit/.build/
 apps/shared/OpenClawKit/.build/
+apps/shared/*/.build/
 apps/shared/OpenClawKit/Package.resolved
 **/ModuleCache/
 bin/
@@ -50,6 +51,7 @@ apps/macos/.build-local/
 apps/macos/.swiftpm/
 apps/shared/MoltbotKit/.swiftpm/
 apps/shared/OpenClawKit/.swiftpm/
+apps/shared/*/.swiftpm/
 Core/
 apps/ios/*.xcodeproj/
 apps/ios/*.xcworkspace/
@@ -108,6 +110,9 @@ USER.md
 # local tooling
 .serena/
 
+# local QA evidence mirrors; CI publishes canonical Mantis files as Actions artifacts
+mantis/
+
 # Local project-agent skill installs. Only repo-owned skills are visible by
 # default; promoting a new repo skill should require an intentional `git add -f`.
 .agents/skills/*
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -24,6 +24,7 @@ Docs: https://docs.openclaw.ai
 - Doctor/Codex: stop warning that the message tool is unavailable for source-reply paths where OpenClaw grants `message` at runtime, keeping update and doctor output aligned with the OpenAI happy path. Thanks @pashpashpash.
 - Build: keep externalized Slack, OpenShell sandbox, and Anthropic Vertex runtime dependency declarations out of the root dist artifact build.
 - Auto-reply/Claude CLI: bridge CLI-runtime assistant text-delta agent events into the chat reasoning preview through `onReasoningStream`, mirroring the existing assistant-text (#76914) and tool-event (#80046) bridges and adding gating so non-CLI runtimes are unaffected. Thanks @anagnorisis2peripeteia and @pashpashpash.
+- Mantis: keep QA evidence in Actions artifacts only and stop publishing evidence files to Git-backed artifact branches.
 - CLI/migrate: handle delayed Codex plugin marketplace responses so warnings, next-steps, and conflict states render with ⚠️ glyphs and post-install migration retries the marketplace fetch instead of silently skipping plugin items. (#81625) Thanks @sjf.
 - Channels/Weixin: bump the bundled `@tencent-weixin/openclaw-weixin` external entry to `2.4.3` (from `2.4.1`) so onboarding and `openclaw channels add` install the current Tencent Weixin (personal WeChat) plugin release. (#81730) Thanks @scotthuang.
 - CLI: lazy-load model, plugin, and device runtime helpers and keep channel option help on generated startup metadata or generic fallback text so parent/help output renders without importing those runtime paths.
diff --git a/docs/concepts/mantis.md b/docs/concepts/mantis.md
@@ -318,7 +318,8 @@ This schema is the handoff between scenario code and GitHub comments:
 ```
 
 Artifact `path` values are relative to the manifest directory. `targetPath`
-values are relative paths under the `qa-artifacts` branch publish directory.
+values are relative paths inside the uploaded Actions artifact bundle. Mantis
+must not publish evidence to Git branches; Git history is not artifact storage.
 The publisher rejects path traversal and skips entries marked
 `"required": false` when optional previews or videos are unavailable.
 
@@ -333,11 +334,11 @@ Supported artifact kinds:
 - `report`: Markdown report.
 
 The reusable publisher is `scripts/mantis/publish-pr-evidence.mjs`. Workflows
-call it with the manifest, target PR, `qa-artifacts` target root, comment marker,
-Actions artifact URL, run URL, and request source. It copies declared artifacts
-to the `qa-artifacts` branch, builds a summary-first PR comment with inline
-images/previews and linked videos, then updates the existing marker comment or
-creates one.
+call it with the manifest, target PR, artifact root, comment marker, Actions
+artifact URL, run URL, and request source. The workflow uploads the declared
+files through `actions/upload-artifact`; the publisher builds a summary-first PR
+comment that links to that artifact and lists the bundled file names. It never
+commits or pushes evidence files.
 
 You can also trigger the status-reactions run directly from a PR comment:
 
@@ -627,10 +628,11 @@ after the new secret has been stored.
 
 Mantis workflows should upload the full evidence bundle as a short-lived Actions
 artifact. When the workflow is run for a bug report or fix PR, it should also
-publish the redacted PNG screenshots to the `qa-artifacts` branch and upsert a
-comment on that bug or fix PR with inline before/after screenshots. Do not post
-the primary proof only on a generic QA automation PR. Raw logs, observed
-messages, and other bulky evidence stay in the Actions artifact.
+upsert a comment on that bug or fix PR with a short summary and a link to the
+Actions artifact. Do not post the primary proof only on a generic QA automation
+PR. Do not use Git branches, tags, or commits as Mantis artifact storage. Raw
+logs, screenshots, recordings, observed messages, and other bulky evidence stay
+in the Actions artifact.
 
 Production workflows should post those comments with the Mantis GitHub App, not
 with `github-actions[bot]`. Store the app id and private key as
diff --git a/scripts/mantis/publish-pr-evidence.mjs b/scripts/mantis/publish-pr-evidence.mjs
@@ -1,9 +1,7 @@
 #!/usr/bin/env node
-import { execFileSync, spawnSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import {
-  copyFileSync,
   existsSync,
-  mkdirSync,
   mkdtempSync,
   readFileSync,
   rmSync,
@@ -121,86 +119,12 @@ export function loadEvidenceManifest(manifestPath) {
   };
 }
 
-function encodePathForUrl(input) {
-  return input
-    .split("/")
-    .filter(Boolean)
-    .map((part) => encodeURIComponent(part))
-    .join("/");
-}
-
-function artifactUrl(rawBase, artifact) {
-  return `${rawBase}/${encodePathForUrl(artifact.targetPath)}`;
-}
-
-function byLane(artifacts, kind) {
-  const lanes = new Map();
-  for (const artifact of artifacts) {
-    if (artifact.kind !== kind) {
-      continue;
-    }
-    lanes.set(artifact.lane, artifact);
-  }
-  return lanes;
-}
-
-function findPair(artifacts, kind, leftLane, rightLane) {
-  const lanes = byLane(artifacts, kind);
-  const left = lanes.get(leftLane);
-  const right = lanes.get(rightLane);
-  return left && right ? { left, right } : null;
-}
-
-function renderPairTable({ pair, rawBase }) {
-  const { left, right } = pair;
-  if (!left || !right) {
-    return "";
-  }
-  return [
-    '<table width="100%">',
-    "  <thead>",
-    "    <tr>",
-    `      <th width="50%">${left.label}</th>`,
-    `      <th width="50%">${right.label}</th>`,
-    "    </tr>",
-    "  </thead>",
-    "  <tbody>",
-    "    <tr>",
-    `      <td width="50%" align="center"><img src="${artifactUrl(rawBase, left)}" width="100%" alt="${left.alt ?? left.label}"></td>`,
-    `      <td width="50%" align="center"><img src="${artifactUrl(rawBase, right)}" width="100%" alt="${right.alt ?? right.label}"></td>`,
-    "    </tr>",
-    "  </tbody>",
-    "</table>",
-    "",
-  ].join("\n");
-}
-
-function renderSingleImageTables({ artifacts, rawBase, pairedKeys }) {
-  const renderedPairs = new Set(pairedKeys);
-  return artifacts
-    .filter(
-      (artifact) => artifact.inline && !renderedPairs.has(`${artifact.kind}:${artifact.lane}`),
-    )
-    .map((artifact) => {
-      const width = Math.min(Number(artifact.width ?? 720) || 720, 900);
-      return [
-        `**${artifact.label}**`,
-        "",
-        `<img src="${artifactUrl(rawBase, artifact)}" width="${width}" alt="${artifact.alt ?? artifact.label}">`,
-        "",
-      ].join("\n");
-    })
-    .join("\n");
-}
-
-function renderLinkList({ artifacts, kind, rawBase, title }) {
-  const links = artifacts
-    .filter((artifact) => artifact.kind === kind)
-    .map((artifact) => `- [${artifact.label}](${artifactUrl(rawBase, artifact)})`);
+function renderArtifactFileList(artifacts) {
+  const links = artifacts.map((artifact) => `- ${artifact.label}: \`${artifact.targetPath}\``);
   if (links.length === 0) {
     return "";
   }
-  return [`${title}:`, ...links, ""].join("\n");
+  return ["Artifact files:", ...links, ""].join("\n");
 }
 
 function laneLine(label, lane) {
@@ -220,27 +144,15 @@ function laneLine(label, lane) {
 }
 
 export function renderEvidenceComment({
-  artifactRoot,
   artifactUrl: actionsArtifactUrl,
   manifest,
   marker,
-  rawBase,
   requestSource,
   runUrl,
-  treeUrl,
 }) {
   const comparison = manifest.comparison ?? {};
   const baseline = comparison.baseline;
   const candidate = comparison.candidate;
-  const pairs = [
-    findPair(manifest.artifacts, "timeline", "baseline", "candidate"),
-    findPair(manifest.artifacts, "desktopScreenshot", "baseline", "candidate"),
-    findPair(manifest.artifacts, "motionPreview", "baseline", "candidate"),
-  ].filter(Boolean);
-  const pairedKeys = pairs.flatMap((pair) => [
-    `${pair.left.kind}:${pair.left.lane}`,
-    `${pair.right.kind}:${pair.right.lane}`,
-  ]);
   const lines = [
     marker,
     `## ${manifest.title}`,
@@ -270,39 +182,8 @@ export function renderEvidenceComment({
     lines.push(`- Overall: \`${comparison.pass}\``);
   }
   lines.push("");
-
-  const pairedSections = pairs.map((pair) => renderPairTable({ pair, rawBase }));
-
-  lines.push(...pairedSections);
-  const singleTables = renderSingleImageTables({
-    artifacts: manifest.artifacts,
-    pairedKeys,
-    rawBase,
-  });
-  if (singleTables) {
-    lines.push(singleTables);
-  }
-  const motionClips = renderLinkList({
-    artifacts: manifest.artifacts,
-    kind: "motionClip",
-    rawBase,
-    title: "Motion-trimmed clips",
-  });
-  if (motionClips) {
-    lines.push(motionClips);
-  }
-  const fullVideos = renderLinkList({
-    artifacts: manifest.artifacts,
-    kind: "fullVideo",
-    rawBase,
-    title: "Full videos",
-  });
-  if (fullVideos) {
-    lines.push(fullVideos);
-  }
-  lines.push(
-    `Raw QA files: ${treeUrl ?? `https://github.com/${process.env.GITHUB_REPOSITORY}/tree/qa-artifacts/${artifactRoot}`}`,
-  );
+  lines.push(renderArtifactFileList(manifest.artifacts));
+  lines.push(`Raw QA files: ${actionsArtifactUrl}`);
   return `${lines.join("\n").replace(/\n{3,}/gu, "\n\n")}\n`;
 }
 
@@ -314,77 +195,6 @@ function run(command, args, options = {}) {
   });
 }
 
-function runStatus(command, args, options = {}) {
-  const result = spawnSync(command, args, {
-    stdio: "ignore",
-    ...options,
-  });
-  if (result.error) {
-    throw result.error;
-  }
-  return result.status ?? 1;
-}
-
-function publishArtifactFiles({ artifactRoot, ghToken, manifest, repo }) {
-  const worktree = mkdtempSync(path.join(tmpdir(), "mantis-qa-artifacts-"));
-  const safeArtifactRoot = normalizeTargetPath(artifactRoot);
-  try {
-    run("git", ["init", "--quiet", worktree]);
-    run("git", ["-C", worktree, "config", "user.name", "github-actions[bot]"]);
-    run("git", [
-      "-C",
-      worktree,
-      "config",
-      "user.email",
-      "41898282+github-actions[bot]@users.noreply.github.com",
-    ]);
-    run("git", [
-      "-C",
-      worktree,
-      "remote",
-      "add",
-      "origin",
-      `https://x-access-token:${ghToken}@github.com/${repo}.git`,
-    ]);
-    try {
-      run("git", ["-C", worktree, "fetch", "--quiet", "origin", "qa-artifacts"]);
-      run("git", ["-C", worktree, "checkout", "--quiet", "-B", "qa-artifacts", "FETCH_HEAD"]);
-    } catch {
-      run("git", ["-C", worktree, "checkout", "--quiet", "--orphan", "qa-artifacts"]);
-    }
-
-    const destinationRoot = path.join(worktree, safeArtifactRoot);
-    for (const artifact of manifest.artifacts) {
-      const destination = assertInside(
-        destinationRoot,
-        path.resolve(destinationRoot, artifact.targetPath),
-        `Artifact target ${artifact.targetPath}`,
-      );
-      mkdirSync(path.dirname(destination), { recursive: true });
-      copyFileSync(artifact.source, destination);
-    }
-
-    run("git", ["-C", worktree, "add", safeArtifactRoot]);
-    const hasChanges = runStatus("git", ["-C", worktree, "diff", "--cached", "--quiet"]) !== 0;
-    if (hasChanges) {
-      run("git", [
-        "-C",
-        worktree,
-        "commit",
-        "--quiet",
-        "-m",
-        `qa: publish Mantis evidence for ${manifest.id}`,
-      ]);
-      run("git", ["-C", worktree, "push", "--quiet", "origin", "HEAD:qa-artifacts"]);
-    } else {
-      console.log("No QA evidence artifact changes to publish.");
-    }
-  } finally {
-    rmSync(worktree, { force: true, recursive: true });
-  }
-  return safeArtifactRoot;
-}
-
 function upsertPrComment({ body, marker, prNumber, repo }) {
   run("gh", ["api", `repos/${repo}/pulls/${prNumber}`, "--jq", ".number"]);
   const commentId = run("gh", [
@@ -446,25 +256,18 @@ export function publishEvidence(rawArgs = process.argv.slice(2)) {
   if (!ghToken) {
     throw new Error("Missing GH_TOKEN or GITHUB_TOKEN.");
   }
+  if (!args.artifact_url) {
+    throw new Error("Missing --artifact-url. Mantis evidence must use Actions artifacts, not Git.");
+  }
 
   const manifest = loadEvidenceManifest(args.manifest);
-  const artifactRoot = publishArtifactFiles({
-    artifactRoot: args.artifact_root,
-    ghToken,
-    manifest,
-    repo,
-  });
-  const rawBase = `https://raw.githubusercontent.com/${repo}/qa-artifacts/${encodePathForUrl(artifactRoot)}`;
-  const treeUrl = `https://github.com/${repo}/tree/qa-artifacts/${encodePathForUrl(artifactRoot)}`;
+  normalizeTargetPath(args.artifact_root);
   const body = renderEvidenceComment({
-    artifactRoot,
     artifactUrl: args.artifact_url,
     manifest,
     marker: args.marker,
-    rawBase,
     requestSource: args.request_source,
     runUrl: args.run_url,
-    treeUrl,
   });
   upsertPrComment({
     body,
diff --git a/test/scripts/mantis-publish-pr-evidence.test.ts b/test/scripts/mantis-publish-pr-evidence.test.ts
