fix(ci): validate older release targets#103975
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5abb9f3d55
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
clawsweeper
Bot
added
proof: sufficient
|
Codex review: found issues before merge. Reviewed July 10, 2026, 9:11 PM ET / July 11, 2026, 01:11 UTC. Summary Reproducibility: yes. Dispatching the current trusted Full Release Validation workflow for target Review metrics: 1 noteworthy metric.
Stored data model Root-cause cluster Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Security Review findings
Review detailsBest possible solution: Limit capability-based lane suppression to older Full Release Validation dispatch targets, preserve fail-closed behavior for ordinary pull request and push runs, and add fixtures covering both modes before merge. Do we have a high-confidence way to reproduce the issue? Yes. Dispatching the current trusted Full Release Validation workflow for target Is this the best way to solve the issue? No, not yet. Adapting trusted CI to the target checkout is the correct boundary, but the compatibility suppression currently applies too broadly and must preserve fail-closed ordinary CI. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 57a3b1e99dba. Label changesLabel changes:
Label justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (1 earlier review cycle)
|
openclaw-barnacle
Bot
added
docs
github-actions
Bot
added
the
dependencies-changed
Dependency graph guard clearedThis PR no longer has blocked dependency graph changes. A future dependency graph change requires a fresh
|
openclaw-barnacle
Bot
removed
app: web-ui
github-actions
Bot
removed
the
dependencies-changed
steipete
removed
proof: sufficient
|
Merged via squash.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4af4568023
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| parseBoolean(process.env.OPENCLAW_CI_RUN_IOS_BUILD) && | ||
| !docsOnly && | ||
| isCanonicalRepository && | ||
| (!historicalTarget || supportsCurrentIosCi); |
There was a problem hiding this comment.
For historical release targets that still have ios:build but predate one of the Swift wrapper scripts, this gate sets run_ios_build=false and skips the entire ios-build job, so pnpm ios:build is never run. Fresh evidence in this final revision is that the iOS job still has target-compatible fallbacks for missing install-swift-tools.sh/lint wrappers, but requiring those wrappers here makes those fallbacks unreachable for historical targets and drops iOS build coverage instead of only relaxing the wrapper-specific steps.
Useful? React with 👍 / 👎.
…04475) * chore(types): add declaration files for scripts/lib and scripts/e2e modules * chore(types): add declaration files for top-level script modules (a-m) * chore(types): add declaration files for top-level script modules (n-z) * test: use a non-secret-shaped gateway token fixture * test: type ci workflow guard helpers for the root test lane * chore(tooling): typecheck root test/** with a dedicated tsgo lane - test/tsconfig/tsconfig.test.root.json: root-test program (strict unused checks, fixtures excluded; two Docker E2E clients that import built dist/** stay out, same rationale as the scripts/e2e exclusion in tsconfig.scripts.json) - tsgo:test:root wired into tsgo:test, check:test-types, scripts/check.mjs, and the ci.yml test-types shard, mirroring the tsgo:scripts lane (#104348) - changed-lane routing: test/**/*.ts (excluding fixtures) and the lane tsconfig now trigger 'typecheck test root' in check:changed; previously test/ paths ran lint only, so harness type errors surfaced first in CI (#104287 envDir case) - burn down all 1071 latent type errors in the program: precise param/local types across test/scripts, test/vitest, test/e2e, and transitive scripts/e2e program members; 205 sibling .d.mts declaration files for imported .mjs modules (committed separately); zero any, zero ts-expect-error - resolve the pre-existing testing star-export ambiguity in scripts/e2e/parallels/common.ts with an explicit re-export Closes #104388 * chore(types): correct declaration fidelity per structured review - re-derive 51 .d.mts files from implementation data flow instead of initializers: fix a wrong never return (runTestProjectsDelegation returns the child), add encoding-sensitive exec/spawn overloads (plain-gh), restore the full release profile union, make parsed paths string | null, add missing parseArgs fields via help/non-help unions, add a missing sibling declaration (budget-number-args), drop 15 unused lint directives - precise install-record/tuple typing removes the type-aware oxlint regressions the first declarations caused in scripts/e2e implementations - route .mts declaration edits under test/ to the testRoot lane and reference the test-root project from tsconfig.projects.json so tsgo:all covers it (closes both review findings against the lane wiring) * chore(scripts): keep telegram runner dist typing structural for the boundary guard * chore(types): declare runtime pack and gateway readiness exports added on main * test: pin the importTargetPlan form of the plugin-contract plan import The guard expectation still referenced the raw await import( form that 7ae5996 (#103975) replaced with the importTargetPlan fallback helper; the assertion fails on current main.
* fix(ci): support older release targets * fix(ci): guard optional channel contracts * fix(ci): scope legacy release compatibility
…enclaw#104475) * chore(types): add declaration files for scripts/lib and scripts/e2e modules * chore(types): add declaration files for top-level script modules (a-m) * chore(types): add declaration files for top-level script modules (n-z) * test: use a non-secret-shaped gateway token fixture * test: type ci workflow guard helpers for the root test lane * chore(tooling): typecheck root test/** with a dedicated tsgo lane - test/tsconfig/tsconfig.test.root.json: root-test program (strict unused checks, fixtures excluded; two Docker E2E clients that import built dist/** stay out, same rationale as the scripts/e2e exclusion in tsconfig.scripts.json) - tsgo:test:root wired into tsgo:test, check:test-types, scripts/check.mjs, and the ci.yml test-types shard, mirroring the tsgo:scripts lane (openclaw#104348) - changed-lane routing: test/**/*.ts (excluding fixtures) and the lane tsconfig now trigger 'typecheck test root' in check:changed; previously test/ paths ran lint only, so harness type errors surfaced first in CI (openclaw#104287 envDir case) - burn down all 1071 latent type errors in the program: precise param/local types across test/scripts, test/vitest, test/e2e, and transitive scripts/e2e program members; 205 sibling .d.mts declaration files for imported .mjs modules (committed separately); zero any, zero ts-expect-error - resolve the pre-existing testing star-export ambiguity in scripts/e2e/parallels/common.ts with an explicit re-export Closes openclaw#104388 * chore(types): correct declaration fidelity per structured review - re-derive 51 .d.mts files from implementation data flow instead of initializers: fix a wrong never return (runTestProjectsDelegation returns the child), add encoding-sensitive exec/spawn overloads (plain-gh), restore the full release profile union, make parsed paths string | null, add missing parseArgs fields via help/non-help unions, add a missing sibling declaration (budget-number-args), drop 15 unused lint directives - precise install-record/tuple typing removes the type-aware oxlint regressions the first declarations caused in scripts/e2e implementations - route .mts declaration edits under test/ to the testRoot lane and reference the test-root project from tsconfig.projects.json so tsgo:all covers it (closes both review findings against the lane wiring) * chore(scripts): keep telegram runner dist typing structural for the boundary guard * chore(types): declare runtime pack and gateway readiness exports added on main * test: pin the importTargetPlan form of the plugin-contract plan import The guard expectation still referenced the raw await import( form that 7250680 (openclaw#103975) replaced with the importTargetPlan fallback helper; the assertion fails on current main.
1 participant
Closes #103973
What Problem This Solves
Fixes an issue where release managers validating an older immutable release tag through Full Release Validation would see the trusted current CI workflow fail before producing target-appropriate evidence when the tag predates current CI planner exports or optional tooling.
Why This Change Was Made
The current trusted workflow can now use target-owned legacy planners and omit absent current-only lanes only after Full Release Validation supplies a canonical semver release tag and CI proves that tag resolves to the exact checkout SHA. Normal PRs, pushes, arbitrary manual targets, and current release targets remain fail-closed. Current-only
tsgo:scriptsand Swift helpers follow the same bounded compatibility contract.User Impact
Release managers can validate older tagged candidates without moving their tags or creating testing-only branches. Current CI continues to surface missing planners, scripts, and lane tooling as failures.
Evidence
pnpm test test/scripts/ci-workflow-guards.test.ts test/scripts/plugin-prerelease-test-plan.test.ts— 61 tests passed.pnpm check:workflows— passed, including actionlint/zizmor coverage.oxfmt --check— passed.git diff --check— passed.The older exact-target proof from the prior branch head is intentionally not reused because the branch was rewritten and the compatibility authorization contract changed. Exact tagged-target validation will run after landing.
AI-assisted implementation and review; maintainer-directed and independently validated.