fix(release): restore prerelease and release validation startup#103834
Conversation
openclaw-barnacle
Bot
added
docs
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc1f84fe49
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| description: Shared Docker image transport | ||
| required: true | ||
| default: allow-push | ||
| default: no-push-artifact |
There was a problem hiding this comment.
When this reusable workflow is manually dispatched with a branch or tag in ref (the input still advertises “Ref, tag, or SHA”), the new default sends the run down shared_image_policy=no-push-artifact; validate_selected_ref then rejects anything except a lowercase 40-character SHA before any validation job can run. Since the only other choice, existing-only, also requires explicit Docker image refs, manual branch/tag live-only or Docker reruns that previously worked under the old default now fail at validation; keep a branch/tag-compatible default or resolve/pass the selected SHA when using no-push artifacts.
Useful? React with 👍 / 👎.
|
Codex review: stale review; fresh review needed. Summary Next step |
|
Land-ready proof for exact head
Review iterations fixed runner-local image reuse, reusable caller-event handling, undeclared manual inputs, workflow-head versus artifact-target confusion, deleted temporary workflow refs, cleanup-only local artifacts, non-exact explicit refs, and stale GHCR reuse after a target override. No known pre-merge proof gap remains. Post-merge exact-main Plugin Prerelease and affected Release Checks/full release validation reruns remain the final release proof. |
|
Merged via squash.
|
…claw#103834) * fix(release): split image publication from validation * fix(ci): honor install smoke caller input * fix(ci): harden Docker rerun targeting
* fix(release): restore frozen validation startup Adapt the no-write validation portion of b597a8d (#103834) for the 6.x extended-stable workflow set. Remove validation-owned image publisher jobs instead of granting write permissions; Docker publication remains out of scope. * fix(release): allow canonical extended-stable checks Restore the openclaw-release-checks.yml portion of c7810fc (#99352) that authorizes the canonical extended-stable/YYYY.M.33 workflow branch.
1 participant
Fixes #103774
What Problem This Solves
Fixes an issue where Plugin Prerelease and Release Checks dispatches could fail during workflow graph validation before any job started. Read-only callers reached reusable workflows that still declared conditional package-write jobs, and GitHub validates those permissions even when the writer job would be skipped.
Why This Change Was Made
Release validation is now a canonical read-only, artifact-backed graph. Install smoke has a small schedule/manual wrapper over a reusable artifact-only core, and Docker/live image publication is isolated in an explicit publisher called only by the scheduled workflow with package-write permission. Package acceptance and update migration no longer contain hidden writer paths.
Targeted Docker reruns now use the exact selected SHA recorded in the failure artifact, not the workflow-definition head. Generated manual dispatches omit reusable-only package artifact inputs and deleted temporary workflow refs, reuse only GHCR-backed images, and drop those image refs when an explicit target override does not match the artifact SHA. Runner-local artifact tags are omitted so a fresh runner rebuilds them instead of trying to pull an inaccessible local tag.
User Impact
Plugin prerelease, package acceptance, install smoke, live/E2E, and release validation can start from read-only callers again. Scheduled live validation still publishes exact tested shared images after the validation graph succeeds. No version, tag, package, or release publication is included.
Evidence