Skip to content

fix: restore release validation on main#102516

Merged
steipete merged 4 commits into
mainfrom
codex/release-prep-main
Jul 9, 2026
Merged

fix: restore release validation on main#102516
steipete merged 4 commits into
mainfrom
codex/release-prep-main

Conversation

@steipete

@steipete steipete commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Resolves release-validation failures where ClawHub publish retries could lose their temporary log before it was consumed, Bun could not install the candidate package because its bundled workspace runtime was unavailable through local-tarball resolution, the QQBot approval-fence test parsed the closing fence incorrectly, and the Slack event-scope fixture used an event-envelope field for an auth.test response.

Why This Change Was Made

ClawHub logging is now synchronous under the existing pipefail contract. The Bun smoke builds the canonical root package, extracts and version-checks its exact bundled AI package, repacks that candidate, and pins only that package through Bun's global override while leaving public registry resolution unchanged. QQBot now asserts the complete fenced block. Slack's fixture now uses the documented auth.test field app_id while continuing to validate incoming api_app_id scoping.

User Impact

No product behavior changes. Maintainers get deterministic release checks for ClawHub publishing, Bun global installation, prebuilt package reuse, and messaging-extension tests.

Evidence

  • Focused touched-surface tests: 125/125 passed on Blacksmith Testbox tbx_01kx2wsgyzahgrand4dh6sfqr9 (delegated run).
  • Exact Docker/Bun 1.3.14 replay: package integrity passed, 296 packages installed, OpenClaw 2026.6.11 booted, and all 11 image providers loaded on Testbox tbx_01kx2w8s62p7kwsy405j3w0s22 (delegated run).
  • Full messaging shard: 162 files and 1,684 tests passed on Testbox tbx_01kx2smdhxvt1mjjzrn9kz75m7.
  • Full verify: checks passed and 256/257 Vitest configs passed, isolating the stale Slack fixture; the corrected full Slack config then passed 110 files and 1,570 tests on AWS Crabbox cbx_f3d007d2cc89 / run_b3583b7368ff.
  • Live prompt-cache credential and floor validation passed at exact SHA 245b91b83de0f5cdc2b9447422caf9ad0a4acbef (run).
  • Exact-head CI: 44 jobs passed, 11 intentionally skipped, zero failures; build artifacts passed (run). Workflow Sanity also passed (run).
  • Fresh autoreview: no actionable findings.
  • Repo-native OPENCLAW_TESTBOX=1 scripts/pr prepare-run 102516: passed on exact-head hosted evidence.

@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts channel: qqbot size: M maintainer Maintainer-authored PR labels Jul 9, 2026
@steipete steipete self-assigned this Jul 9, 2026
@steipete
steipete marked this pull request as ready for review July 9, 2026 07:38
@clawsweeper

clawsweeper Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 4:04 AM ET / 08:04 UTC.

Summary
The PR changes release-validation scripts and tests for ClawHub publish retry logging, Bun global install smoke packaging, and QQBot approval-fence assertions.

PR surface: Tests +74, Other +98. Total +172 across 5 files.

Reproducibility: yes. from source inspection and the focused tests in the PR, but I did not execute the failing release checks locally. Current main uses the async ClawHub log capture and raw Bun smoke package path that this PR changes.

Review metrics: 1 noteworthy metric.

  • Release validation paths: 3 paths changed. The patch affects ClawHub publish retry logging, Bun global-install package validation, and the QQBot approval-fence test that contributed to release validation failures.

Stored data model
Persistent data-model change detected: serialized state: scripts/e2e/lib/bun-global-install/assertions.mjs, serialized state: test/scripts/test-install-sh-docker.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit ✨ media proof bonus
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Refresh exact-head release-validation proof before merge if maintainers want fully auditable wrapper logs.

Risk before merge

  • [P1] This PR changes release/package validation automation; if the Bun override, candidate extraction, or dist swap assumptions drift, release checks could fail or miss an install regression.
  • [P1] Some delegated Testbox wrapper runs linked from the PR body are cancelled at the GitHub workflow level even though the PR body reports successful Testbox-session output; exact-head refresh would make the proof easier to audit before merge.

Maintainer options:

  1. Refresh exact-head release proof (recommended)
    Rebase or otherwise validate the merge head and require package/install-smoke/ClawHub evidence before merge.
  2. Accept existing Testbox-session evidence
    Maintainers can land using the existing PR-body proof if they judge the cancelled wrapper logs and behind-main drift irrelevant to these scripts.

Next step before merge

  • [P2] Maintainer review remains appropriate because the protected label and release-automation risk need proof-sufficiency judgment rather than a narrow automated repair.

Maintainer decision needed

  • Question: Should maintainers require a fresh exact-head release-validation/Testbox run before merging this automation change, or accept the existing PR-body Testbox-session evidence?
  • Rationale: The code shape looks correct, but the affected surface is release automation and the most relevant external proof is partly represented by PR-body copied output rather than fully successful GitHub wrapper runs.
  • Likely owner: Peter Steinberger — He is assigned, authored the PR, and current-main blame ties the central release-validation script paths to his recent area work.
  • Options:
    • Refresh exact-head proof (recommended): Rebase or otherwise validate the merge head and require package/install-smoke/ClawHub evidence before merge.
    • Accept existing proof: Land using the existing PR-body Testbox evidence if maintainers judge the cancelled wrapper logs and behind-main drift non-blocking.

Security
Cleared: The diff changes release/test automation and local candidate package handling without adding third-party actions, dependency sources, secret access, or broader package-resolution trust.

Review details

Best possible solution:

Land the focused release-validation repair after maintainer review accepts or refreshes exact-head package, install-smoke, and ClawHub validation while keeping runtime product behavior unchanged.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection and the focused tests in the PR, but I did not execute the failing release checks locally. Current main uses the async ClawHub log capture and raw Bun smoke package path that this PR changes.

Is this the best way to solve the issue?

Yes, this looks like the right fix shape: it reuses the existing package-openclaw-for-docker contract, pins only the candidate @openclaw/ai package, and keeps product runtime behavior unchanged. The remaining condition is exact-head release-validation proof before merge.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ea8076a091b4.

Label changes

Label justifications:

  • P2: The PR repairs maintainer release-validation automation with limited product-runtime blast radius.
  • merge-risk: 🚨 automation: The diff changes release/package validation automation where ordinary green CI may not fully prove the next release-run behavior.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The PR body provides detailed after-fix Testbox IDs and copied validation output, and the PR has a passing real-behavior-proof check; exact-head proof is still a maintainer merge-risk decision for release automation.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides detailed after-fix Testbox IDs and copied validation output, and the PR has a passing real-behavior-proof check; exact-head proof is still a maintainer merge-risk decision for release automation.
Evidence reviewed

PR surface:

Tests +74, Other +98. Total +172 across 5 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 2 137 63 +74
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 3 138 40 +98
Total 5 275 103 +172

What I checked:

  • Repository policy read: Root and scoped AGENTS.md files were read; their PR review guidance applies because this touches release-validation automation, scripts, tests, and a bundled plugin test. (AGENTS.md:1)
  • Live PR state: Live PR is open, ready for review, assigned to steipete, and labeled maintainer, proof: sufficient, P2, and merge-risk: 🚨 automation; no reviews are present. (32d25a48bec1)
  • Bun smoke package path: The PR head uses package-openclaw-for-docker.mjs --skip-build, extracts candidate @openclaw/ai, asserts matching root/AI versions, and writes a Bun global override only for that local AI tarball. (scripts/e2e/bun-global-install-smoke.sh:214, 32d25a48bec1)
  • Bun override contract: Official Bun docs state that top-level overrides in package.json are supported for dependency/metadependency resolution, which matches the PR's global package override shape. (bun.sh)
  • Regression coverage: The PR head adds focused tests for canonical package-builder use, candidate AI override behavior, version mismatch rejection, and the prebuilt-tarball Bun smoke path. (test/scripts/test-install-sh-docker.test.ts:930, 32d25a48bec1)
  • Current-main release caller: Current main's install-smoke workflow runs scripts/e2e/bun-global-install-smoke.sh with OPENCLAW_BUN_GLOBAL_SMOKE_DIST_IMAGE and HOST_BUILD=0, so the changed Docker-image restore and package path are on release validation. (.github/workflows/install-smoke.yml:525, ea8076a091b4)

Likely related people:

  • Peter Steinberger: Current-main blame shows commit 5533d97 added the relevant Bun smoke and ClawHub publish script paths, and the same person authored this PR head. (role: recent area contributor and current PR author with prior current-main ownership; confidence: high; commits: 5533d979d433, 2ba97b5542c0, dd1119bd40a1; files: scripts/e2e/bun-global-install-smoke.sh, scripts/plugin-clawhub-publish.sh, scripts/package-openclaw-for-docker.mjs)
  • Vincent Koc: Shallow local history shows recent release-validation work touching the Bun smoke/package area, making this a plausible adjacent review owner for release-check behavior. (role: recent adjacent release-validation contributor; confidence: medium; commits: e085fa1a3ffd; files: scripts/e2e/bun-global-install-smoke.sh, scripts/package-openclaw-for-docker.mjs, test/scripts/test-install-sh-docker.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (1 earlier review cycle)
  • reviewed 2026-07-09T07:50:27.987Z sha 32d25a4 :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. labels Jul 9, 2026
@steipete steipete closed this Jul 9, 2026
@steipete steipete reopened this Jul 9, 2026
@openclaw-barnacle openclaw-barnacle Bot added the channel: slack Channel integration: slack label Jul 9, 2026
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Land-ready verification complete.

Commands and proof:

  • corepack pnpm test test/scripts/test-install-sh-docker.test.ts test/e2e/qa-lab/runtime/package-openclaw-for-docker.e2e.test.ts test/plugin-clawhub-release.test.ts extensions/qqbot/src/engine/approval/index.test.ts — 125/125 passed on Blacksmith Testbox tbx_01kx2wsgyzahgrand4dh6sfqr9 (run 29001961002).
  • OPENCLAW_BUN_GLOBAL_SMOKE_DIST_IMAGE=ghcr.io/openclaw/openclaw-dockerfile-smoke:e2a4973edf3b1684624bc9df29a2239c72abda30 OPENCLAW_BUN_GLOBAL_SMOKE_HOST_BUILD=0 bash scripts/e2e/bun-global-install-smoke.sh — Bun 1.3.14 installed 296 packages; candidate integrity, CLI boot, and 11 providers passed on tbx_01kx2w8s62p7kwsy405j3w0s22 (run 29001488671).
  • Full messaging shard — 162 files / 1,684 tests passed on tbx_01kx2smdhxvt1mjjzrn9kz75m7.
  • corepack pnpm verify — checks passed and 256/257 Vitest configs passed; the only failure was the stale Slack auth.test fixture.
  • node scripts/run-vitest.mjs run --config test/vitest/vitest.extension-slack.config.ts --reporter=verbose after the fixture correction — 110 files / 1,570 tests passed on AWS Crabbox cbx_f3d007d2cc89, run run_b3583b7368ff.
  • Exact-head CI for a40ce2e02897d614d752ffbd950a252ddadb5171 — 44 jobs passed, 11 intentionally skipped, zero failures; build artifacts passed (run 29004851038). Workflow Sanity passed (run 29004851108).
  • Live OpenAI, Anthropic, and Fireworks credential preflight passed; exact prompt-cache floors passed (run 28999940391).
  • .agents/skills/autoreview/scripts/autoreview --mode local --stream-engine-output — clean, no actionable findings.
  • OPENCLAW_TESTBOX=1 scripts/pr prepare-run 102516 — passed exact-head hosted gates; changelog not required for this release-tooling/test-only change.

Known proof gap: the monolithic pnpm verify command was not repeated after the one-field Slack fixture correction. Equivalent changed-state coverage is the 256 already-green configs plus the complete corrected Slack config, exact-head CI/build, and focused Docker/live proof above. Full release validation will run against the landed main SHA.

@steipete
steipete merged commit 42a8679 into main Jul 9, 2026
163 of 209 checks passed
@steipete
steipete deleted the codex/release-prep-main branch July 9, 2026 08:39
@steipete

steipete commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

@clawsweeper clawsweeper Bot mentioned this pull request Jul 9, 2026
Merged
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 10, 2026
@steipete
fix: restore release validation on main (openclaw#102516)
aab1f46 
* test(qqbot): assert approval fence exactly

* fix(release): wait for ClawHub publish logging

* fix(ci): repair Bun global install smoke

* test(slack): fix app identity fixture
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@steipete steipete

Labels

channel: qqbot channel: slack Channel integration: slack maintainer Maintainer-authored PR merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. scripts Repository scripts size: M status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete