Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Plugin Prerelease cannot start after its artifact-only caller dropped packages: write, because the called reusable workflow still declares conditional registry-push jobs with packages: write.

Steps to reproduce

1. On main at 9b4c7c0991dddb77295453259b433122e705bfb4, dispatch .github/workflows/plugin-prerelease.yml with full_release_validation=true and an exact target SHA.
2. Observe the workflow terminate before creating any jobs.
3. The caller grants packages: read to openclaw-live-and-e2e-checks-reusable.yml, while that reusable graph still contains push_docker_e2e_images and push_live_test_image jobs declaring packages: write.

Expected behavior

Artifact-only validation should invoke a reusable graph that has no write-declaring jobs and should complete the plugin prerelease static, extension, and Docker lanes without registry mutation authority.

Actual behavior

GitHub rejects the workflow graph at startup. Run 29103858985 has conclusion startup_failure, zero jobs, and the correct exact target SHA.

OpenClaw version

main at 9b4c7c0991dddb77295453259b433122e705bfb4

Operating system

GitHub Actions workflow graph validation (no runner allocated)

Install method

Source checkout through Plugin Prerelease workflow dispatch

Model

Not applicable

Provider / routing chain

Not applicable

Logs

Failed startup run: https://github.com/openclaw/openclaw/actions/runs/29103858985

The run has check suite conclusion startup_failure and latest_check_runs_count=0, so no job log exists.

Impact and severity

Affected: all exact-SHA Plugin Prerelease and Full Release Validation runs that enable the plugin Docker suite. Severity: release blocker. Frequency: deterministic. Consequence: extension, package-boundary, and plugin Docker validation cannot start.

Additional information

Regression provenance: cbe3731f77238053396771529881cf659e9e592b / #103737 changed the plugin prerelease caller from packages: write to packages: read for no-write validation and selected shared_image_policy=no-push-artifact, but the reusable workflow's conditional registry-push jobs remained in the called graph. Restoring broad write permission would weaken the intended validation trust boundary; the artifact-only invocation needs a graph that does not declare write jobs.