@@ -5,7 +5,7 @@ description: "Run or recover OpenClaw macOS release signing, notarization, appca
55
66# OpenClaw Mac Release
77
8- Use with ` $release-openclaw-maintainer ` , ` $release-openclaw-ci ` , ` $one-password ` , and ` $release-private ` if it exists when stable macOS assets, private mac preflight, notarization, appcast promotion, or mac release recovery is involved.
8+ Use with ` $release-openclaw-maintainer ` , ` $release-openclaw-ci ` , ` $one-password ` , and ` $release-private ` if it exists when stable macOS assets, release-ops mac preflight, notarization, appcast promotion, or mac release recovery is involved.
99
1010## Credentials
1111
@@ -23,7 +23,7 @@ Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`
2323
2424## GitHub Secrets
2525
26- Target private repo environment: ` openclaw/releases-private ` , env ` mac-release ` .
26+ Target release-ops repo environment: ` openclaw/releases ` , env ` mac-release ` .
2727
2828Set only after local notary auth validation:
2929
@@ -35,12 +35,24 @@ Do not update these from mixed sources. All three ASC fields must come from the
3535
3636## Workflow Shape
3737
38+ - ` openclaw/openclaw ` is the public product repo. Its GitHub Releases page is
39+ where macOS assets are ultimately attached.
40+ - ` openclaw/openclaw ` ` macos-release.yml ` is public handoff validation only.
41+ It never signs, notarizes, or uploads macOS assets, regardless of
42+ ` preflight_only ` .
43+ - ` openclaw/releases ` is the restricted release-ops repo. Its macOS workflows
44+ sign, notarize, validate, and promote assets onto the
45+ ` openclaw/openclaw ` GitHub release.
3846- Public release branch may carry mac-only packaging fixes after the stable tag/npm are already live.
39- - Use ` source_ref=release/YYYY.M.PATCH ` for private mac preflight/validation when building that branch variation.
47+ - Use ` source_ref=release/YYYY.M.PATCH ` for release-ops mac preflight/validation when building that branch variation.
4048- Keep ` tag=vYYYY.M.PATCH ` pointing at the original stable release commit.
4149- Real mac publish must reuse:
42- - a successful private mac preflight run for the same tag/source SHA
43- - a successful private mac validation run for the same tag/source SHA
50+ - a successful release-ops mac preflight run for the same tag/source SHA
51+ - a successful release-ops mac validation run for the same tag/source SHA
52+ - Release-ops preflight and real publish enter the protected ` mac-release `
53+ environment in the ` build_sign_and_package ` job. Operators may be able to
54+ trigger the workflow while Vincent or another environment reviewer approves
55+ the paused deployment before signing/notarization/promotion proceeds.
4456- If preflight source SHA differs from tag SHA, validation must also use the same ` source_ref ` ; promotion rejects mismatched proof.
4557
4658## Notarization
@@ -52,10 +64,25 @@ Do not update these from mixed sources. All three ASC fields must come from the
5264
5365## Dispatch
5466
55- Private preflight :
67+ Public handoff validation :
5668
5769``` bash
58- gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
70+ gh workflow run macos-release.yml --repo openclaw/openclaw \
71+ --ref release/YYYY.M.PATCH \
72+ -f tag=vYYYY.M.PATCH \
73+ -f preflight_only=true \
74+ -f public_release_branch=release/YYYY.M.PATCH
75+ ```
76+
77+ - Use the public release branch as the workflow ref so the Actions list displays
78+ ` release/YYYY.M.PATCH ` , matching prior stable macOS handoff runs.
79+ - Do not use ` --ref main ` or ` --ref vYYYY.M.PATCH ` for this public handoff
80+ validation. The workflow checks out the tag from the ` tag ` input internally.
81+
82+ Release-ops preflight:
83+
84+ ``` bash
85+ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
5986 -f tag=vYYYY.M.PATCH \
6087 -f source_ref=release/YYYY.M.PATCH \
6188 -f preflight_only=true \
@@ -64,18 +91,24 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --re
6491 -f public_release_branch=release/YYYY.M.PATCH
6592```
6693
67- Private validation for a branch-variation preflight:
94+ Wait for the run to reach the ` mac-release ` environment approval if GitHub
95+ pauses it, then get approval from Vincent or another configured environment
96+ reviewer. Record the successful preflight run id.
97+
98+ Release-ops validation for a branch-variation preflight:
6899
69100``` bash
70- gh workflow run openclaw-macos-validate.yml --repo openclaw/releases-private --ref main \
101+ gh workflow run openclaw-macos-validate.yml --repo openclaw/releases --ref main \
71102 -f tag=vYYYY.M.PATCH \
72103 -f source_ref=release/YYYY.M.PATCH
73104```
74105
106+ Record the successful validation run id.
107+
75108Real publish:
76109
77110``` bash
78- gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
111+ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
79112 -f tag=vYYYY.M.PATCH \
80113 -f preflight_only=false \
81114 -f smoke_test_only=false \
@@ -85,6 +118,14 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --re
85118 -f public_release_branch=release/YYYY.M.PATCH
86119```
87120
121+ Wait for the ` mac-release ` environment approval again if GitHub pauses the real
122+ publish run before it promotes assets.
123+
124+ - Release-ops ` openclaw/releases ` publish/validate workflows run from their own
125+ trusted ` main ` workflow ref. Real publish has a guard that rejects any other
126+ workflow ref. That displayed ` main ` ref is expected; the public OpenClaw
127+ source is selected by ` tag ` and optional ` source_ref ` .
128+
88129## Verify
89130
90131- ` gh release view vYYYY.M.PATCH --repo openclaw/openclaw ` shows zip, dmg, dSYM zip, not draft, not prerelease.
0 commit comments