Bug type
Regression (worked before, now fails)
Beta release blocker
No
Summary
Control UI and Native App locale refresh workflows finish generation and validation, then fail because their finalizers push generated commits directly to protected main without the required clownfish/exact-merge check.
Steps to reproduce
- Trigger either locale refresh workflow with source changes that produce generated locale updates.
- Wait for every locale matrix job and the aggregate validation to pass.
- Observe the finalizer run
git push origin HEAD:main five times.
- Each push is rejected with GH013 because
clownfish/exact-merge is required.
Expected behavior
Generated locale updates should be proposed through the normal reviewed pull-request path and land only after the exact-merge check passes.
Actual behavior
The generated commit remains local to the runner. The finalizer retries the same policy-rejected direct push five times and the workflow ends red.
OpenClaw version
main at 4a4a32a5de1553c66bcf0e7a97c7ab4c85ad5c95
Operating system
GitHub-hosted Ubuntu 24.04 runner
Install method
GitHub Actions source checkout
Model
N/A
Provider / routing chain
N/A
Logs
remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Required status check "clownfish/exact-merge" is expected.
! [remote rejected] HEAD -> main (push declined due to repository rule violations)
Screenshots, recordings, and evidence
The Control UI run passed all 19 locale jobs and aggregate validation before the sole finalizer failure. The Native App run passed all 21 locale jobs and aggregate validation before the same failure.
Impact and severity
- Affected: maintainers, release CI, and both generated locale update pipelines
- Severity: high operational impact; generated locale updates cannot land and the workflows remain red
- Frequency: deterministic for every non-noop finalizer; ten consecutive Control UI runs and at least six Native App runs reached this failure
- Consequence: locale updates are discarded with the runner and release readiness cannot be fully green
Additional information
Ruleset 18588237 (Clownfish exact merge binding) has protected the default branch since July 6, 2026, requires strict clownfish/exact-merge, and has no bypass actors. Successful recent locale runs were no-op runs where the finalizer was skipped. The fix should use the repository's existing GitHub App automation-branch and pull-request pattern; it must not weaken or bypass the ruleset.
Bug type
Regression (worked before, now fails)
Beta release blocker
No
Summary
Control UI and Native App locale refresh workflows finish generation and validation, then fail because their finalizers push generated commits directly to protected
mainwithout the requiredclownfish/exact-mergecheck.Steps to reproduce
git push origin HEAD:mainfive times.clownfish/exact-mergeis required.Expected behavior
Generated locale updates should be proposed through the normal reviewed pull-request path and land only after the exact-merge check passes.
Actual behavior
The generated commit remains local to the runner. The finalizer retries the same policy-rejected direct push five times and the workflow ends red.
OpenClaw version
mainat4a4a32a5de1553c66bcf0e7a97c7ab4c85ad5c95Operating system
GitHub-hosted Ubuntu 24.04 runner
Install method
GitHub Actions source checkout
Model
N/A
Provider / routing chain
N/A
Logs
Screenshots, recordings, and evidence
The Control UI run passed all 19 locale jobs and aggregate validation before the sole finalizer failure. The Native App run passed all 21 locale jobs and aggregate validation before the same failure.
Impact and severity
Additional information
Ruleset
18588237(Clownfish exact merge binding) has protected the default branch since July 6, 2026, requires strictclownfish/exact-merge, and has no bypass actors. Successful recent locale runs were no-op runs where the finalizer was skipped. The fix should use the repository's existing GitHub App automation-branch and pull-request pattern; it must not weaken or bypass the ruleset.