Skip to content

Commit df3d033

Browse files
丁宇婷0668001435claude
丁宇婷0668001435
and
claude
committed
chore: resolve merge conflict in chat.test.ts
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
2 parents 32b6662 + a202dd0 commit df3d033

1,045 files changed

Lines changed: 68076 additions & 5709 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/openclaw-ci-limits/SKILL.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,13 @@ registration edge limit.
1313

1414
- The scarce resource is Blacksmith runner registrations, not Blacksmith vCPU
1515
capacity.
16-
- GitHub runner registrations are capped at 1,500 per 5 minutes per repository,
17-
organization, or enterprise. The `openclaw` organization shares one bucket.
16+
- GitHub runner registrations for `openclaw` are currently capped at 3,000 per
17+
5 minutes per repository, organization, or enterprise. The `openclaw`
18+
organization shares one bucket.
1819
- Core REST quota does not draw down this bucket. Check
1920
`actions_runner_registration` separately; core quota can be healthy while
2021
runner registration is throttled.
21-
- Use 1,000 registrations per 5 minutes as the operating target. Leave the last
22+
- Use 2,000 registrations per 5 minutes as the operating target. Leave the last
2223
third for other repos, retries, and burst overlap.
2324
- Jobs that route, notify, summarize, choose shards, or run short CodeQL quality
2425
scans should stay on GitHub-hosted runners unless measured evidence says
@@ -87,7 +88,7 @@ admission. The debounce only suppresses pushes that arrive while
8788
registrations are spent even if a later push cancels the run. If timing is
8889
uncertain, count every sequential push in the window.
8990

90-
Reject a change unless the org-level worst case stays below 1,000 registrations
91+
Reject a change unless the org-level worst case stays below 2,000 registrations
9192
per 5 minutes with headroom for ClawSweeper, ClawHub, Clownfish, OpenClaw RTT,
9293
and Clawbench.
9394

@@ -127,8 +128,8 @@ These are intentionally guarded by `test/scripts/ci-workflow-guards.test.ts`:
127128
- `runner-admission` on `ubuntu-24.04` with
128129
`OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS=90`.
129130
- `preflight` and `security-fast` needing `runner-admission`.
130-
- CI matrix caps: fast/check lanes at 8, compact Node PR plan at current caps,
131-
Windows and Android at 2.
131+
- CI matrix caps: fast/check lanes at 12, Node test shards at 24, Windows and
132+
Android at 2.
132133
- `build-artifacts` on `blacksmith-16vcpu-ubuntu-2404`.
133134
- lower-weight Node/check shards on `blacksmith-4vcpu-ubuntu-2404`.
134135
- heavy retained Linux/Android shards on `blacksmith-8vcpu-ubuntu-2404`.

‎.agents/skills/release-openclaw-mac/SKILL.md‎

Lines changed: 51 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: "Run or recover OpenClaw macOS release signing, notarization, appca
55

66
# OpenClaw Mac Release
77

8-
Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`, and `$release-private` if it exists when stable macOS assets, private mac preflight, notarization, appcast promotion, or mac release recovery is involved.
8+
Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`, and `$release-private` if it exists when stable macOS assets, release-ops mac preflight, notarization, appcast promotion, or mac release recovery is involved.
99

1010
## Credentials
1111

@@ -23,7 +23,7 @@ Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`
2323

2424
## GitHub Secrets
2525

26-
Target private repo environment: `openclaw/releases-private`, env `mac-release`.
26+
Target release-ops repo environment: `openclaw/releases`, env `mac-release`.
2727

2828
Set only after local notary auth validation:
2929

@@ -35,12 +35,24 @@ Do not update these from mixed sources. All three ASC fields must come from the
3535

3636
## Workflow Shape
3737

38+
- `openclaw/openclaw` is the public product repo. Its GitHub Releases page is
39+
where macOS assets are ultimately attached.
40+
- `openclaw/openclaw` `macos-release.yml` is public handoff validation only.
41+
It never signs, notarizes, or uploads macOS assets, regardless of
42+
`preflight_only`.
43+
- `openclaw/releases` is the restricted release-ops repo. Its macOS workflows
44+
sign, notarize, validate, and promote assets onto the
45+
`openclaw/openclaw` GitHub release.
3846
- Public release branch may carry mac-only packaging fixes after the stable tag/npm are already live.
39-
- Use `source_ref=release/YYYY.M.PATCH` for private mac preflight/validation when building that branch variation.
47+
- Use `source_ref=release/YYYY.M.PATCH` for release-ops mac preflight/validation when building that branch variation.
4048
- Keep `tag=vYYYY.M.PATCH` pointing at the original stable release commit.
4149
- Real mac publish must reuse:
42-
- a successful private mac preflight run for the same tag/source SHA
43-
- a successful private mac validation run for the same tag/source SHA
50+
- a successful release-ops mac preflight run for the same tag/source SHA
51+
- a successful release-ops mac validation run for the same tag/source SHA
52+
- Release-ops preflight and real publish enter the protected `mac-release`
53+
environment in the `build_sign_and_package` job. Operators may be able to
54+
trigger the workflow while Vincent or another environment reviewer approves
55+
the paused deployment before signing/notarization/promotion proceeds.
4456
- If preflight source SHA differs from tag SHA, validation must also use the same `source_ref`; promotion rejects mismatched proof.
4557

4658
## Notarization
@@ -52,10 +64,25 @@ Do not update these from mixed sources. All three ASC fields must come from the
5264

5365
## Dispatch
5466

55-
Private preflight:
67+
Public handoff validation:
5668

5769
```bash
58-
gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
70+
gh workflow run macos-release.yml --repo openclaw/openclaw \
71+
--ref release/YYYY.M.PATCH \
72+
-f tag=vYYYY.M.PATCH \
73+
-f preflight_only=true \
74+
-f public_release_branch=release/YYYY.M.PATCH
75+
```
76+
77+
- Use the public release branch as the workflow ref so the Actions list displays
78+
`release/YYYY.M.PATCH`, matching prior stable macOS handoff runs.
79+
- Do not use `--ref main` or `--ref vYYYY.M.PATCH` for this public handoff
80+
validation. The workflow checks out the tag from the `tag` input internally.
81+
82+
Release-ops preflight:
83+
84+
```bash
85+
gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
5986
-f tag=vYYYY.M.PATCH \
6087
-f source_ref=release/YYYY.M.PATCH \
6188
-f preflight_only=true \
@@ -64,18 +91,24 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --re
6491
-f public_release_branch=release/YYYY.M.PATCH
6592
```
6693

67-
Private validation for a branch-variation preflight:
94+
Wait for the run to reach the `mac-release` environment approval if GitHub
95+
pauses it, then get approval from Vincent or another configured environment
96+
reviewer. Record the successful preflight run id.
97+
98+
Release-ops validation for a branch-variation preflight:
6899

69100
```bash
70-
gh workflow run openclaw-macos-validate.yml --repo openclaw/releases-private --ref main \
101+
gh workflow run openclaw-macos-validate.yml --repo openclaw/releases --ref main \
71102
-f tag=vYYYY.M.PATCH \
72103
-f source_ref=release/YYYY.M.PATCH
73104
```
74105

106+
Record the successful validation run id.
107+
75108
Real publish:
76109

77110
```bash
78-
gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
111+
gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
79112
-f tag=vYYYY.M.PATCH \
80113
-f preflight_only=false \
81114
-f smoke_test_only=false \
@@ -85,6 +118,14 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --re
85118
-f public_release_branch=release/YYYY.M.PATCH
86119
```
87120

121+
Wait for the `mac-release` environment approval again if GitHub pauses the real
122+
publish run before it promotes assets.
123+
124+
- Release-ops `openclaw/releases` publish/validate workflows run from their own
125+
trusted `main` workflow ref. Real publish has a guard that rejects any other
126+
workflow ref. That displayed `main` ref is expected; the public OpenClaw
127+
source is selected by `tag` and optional `source_ref`.
128+
88129
## Verify
89130

90131
- `gh release view vYYYY.M.PATCH --repo openclaw/openclaw` shows zip, dmg, dSYM zip, not draft, not prerelease.

0 commit comments

Comments
 (0)