Skip to content

docs(skills): add backporting to release maintainer#99266

Merged
RomneyDa merged 6 commits into
mainfrom
security-backport-tagging
Jul 9, 2026
Merged

docs(skills): add backporting to release maintainer#99266
RomneyDa merged 6 commits into
mainfrom
security-backport-tagging

Conversation

@RomneyDa

@RomneyDa RomneyDa commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What Problem This Solves

OpenClaw's npm extended-stable maintenance process needs a repeatable way to discover and prepare the complete security and reliability backport set for the trailing completed month's release line. That capability belongs with the existing release-maintainer skill rather than a separate skill with overlapping release policy.

Why This Change Was Made

Extends $release-openclaw-maintainer with an additional extended-stable backport ability and moves the detailed workflow into that skill's references/extended-stable-backports.md.

The integrated workflow:

  • resolves bootstrap .33 and later maintenance-patch modes;
  • inventories the complete mainline delta, including direct commits without public PRs;
  • reconciles private advisory work without exposing confidential details;
  • classifies and carries forward every plausible candidate;
  • prepares one approved coordinated PR against extended-stable/YYYY.M.33;
  • includes core plus every npm-publishable official plugin in the canonical all-publishable inventory;
  • hands off to an explicit npm-only extended-stable publication sequence with exact branch/tag/run identity, plugin publication first, core publish with referenced run IDs, registry readback, and selector repair.

This replaces the standalone $openclaw-extended-stable-backport skill. It also aligns the release skill with merged #99811: extended-stable is now a supported package update channel backed by the npm selector, while stable continues to resolve npm latest.

User Impact

No product runtime behavior changes. Maintainers use one release skill for extended-stable backport discovery, staging, validation, publication, and recovery instead of switching between overlapping skills.

Evidence

  • Current head: 795427e99828b636872f96de81ca383b5be5e2d2.
  • python3 /Users/dallin/.codex/skills/.system/skill-creator/scripts/quick_validate.py .agents/skills/release-openclaw-maintainer: passed.
  • pnpm docs:list: passed.
  • git diff --cached --check: passed before commit; the committed tree is clean.
  • Fresh $autoreview against the current extended-stable source, CLI, docs, release helper, and plugin-inclusive workflows: clean, with no accepted/actionable findings.
  • Contract proof checked on current main:
    • merged feat(update): support extended-stable package updates #99811 is an ancestor of origin/main;
    • src/config/types.openclaw.ts and src/cli/update-cli.ts expose extended-stable as an update channel;
    • docs/cli/update.md documents exact-selector package updates and exact-version official-plugin convergence;
    • docs/reference/RELEASING.md, scripts/openclaw-npm-extended-stable-release.mjs, openclaw-npm-release.yml, and plugin-npm-release.yml define the .33+ branch, exact-SHA, plugin-first, npm-only publication contract.

@RomneyDa
RomneyDa requested a review from a team as a code owner July 3, 2026 00:09
@github-actions

github-actions Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Security-sensitive guard cleared

This PR no longer has blocked security-sensitive file changes. A future security-sensitive change requires a fresh /allow-security-sensitive-change comment after the guard blocks that new head SHA.

  • Current SHA: 795427e99828b636872f96de81ca383b5be5e2d2

@openclaw-barnacle openclaw-barnacle Bot added the maintainer Maintainer-authored PR label Jul 3, 2026
@clawsweeper

clawsweeper Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 3:07 PM ET / 19:07 UTC.

Summary
The PR extends the release-openclaw-maintainer skill with extended-stable backport discovery and npm-only publication guidance, plus a new detailed backport reference.

PR surface: Docs +329. Total +329 across 2 files.

Reproducibility: not applicable. this is a maintainer skill PR, not a runtime bug report. The relevant behavior is source-verifiable from the PR head text and current release workflow contracts.

Review metrics: 1 noteworthy metric.

  • Current security-sensitive diff: 0 current .gitignore, lockfile, workflow, executable, or package files changed. The security-sensitive label was triggered by superseded .gitignore churn, while the current head changes only release skill instruction files.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Get release and security owner approval for the integrated workflow before marking the draft ready.
  • Refresh the branch and run final exact-head validation before landing.

Risk before merge

  • [P1] Release and security owners still need to accept this skill as the durable home for extended-stable backport discovery, private advisory reconciliation, and npm-only publication.
  • [P1] The PR is still draft and behind current main, so it needs maintainer-ready transition plus final exact-head validation before landing.

Maintainer options:

  1. Approve after owner review (recommended)
    Release and security owners can accept the corrected workflow text and own the remaining operator-process risk.
  2. Keep draft for policy edits
    Keep the PR open as a draft until owners refine the extended-stable publication and advisory handoff language.

Next step before merge

  • No automated repair remains; the PR needs release/security owner approval, draft readiness, and final exact-head validation.

Maintainer decision needed

  • Question: Should release-openclaw-maintainer permanently own extended-stable backport discovery and npm-only publication, including the private-advisory reconciliation handoff?
  • Rationale: Source review can verify that the current wording matches the checked release workflow contracts, but accepting this as the durable operator workflow is a release/security ownership decision.
  • Likely owner: openclaw/openclaw-release-managers — The primary unresolved choice is release workflow ownership; secops is adjacent for the advisory-handling portion.
  • Options:
    • Approve integrated release skill (recommended): Release and security owners accept this PR's integrated skill shape and keep extended-stable backporting inside release-openclaw-maintainer.
    • Keep draft for owner edits: Leave the PR open while owners refine the release or advisory-handoff language before marking it ready.
    • Split the workflow back out: Reject the integrated skill shape and keep extended-stable backporting in a separate skill or runbook.

Security
Cleared: The current diff is instruction-only and routes private advisory work through SECURITY.md and GHSA workflows; no executable, dependency, lockfile, secret, or current .gitignore change remains.

Review details

Best possible solution:

Merge the integrated workflow only after release and security owners approve it, preserving the corrected core-vs-plugin selector repair distinction and the npm-only extended-stable boundary.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a maintainer skill PR, not a runtime bug report. The relevant behavior is source-verifiable from the PR head text and current release workflow contracts.

Is this the best way to solve the issue?

Yes for the patch shape: folding the workflow into the existing release-maintainer skill avoids overlapping release policy, and the remaining blocker is owner approval rather than a code defect.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8656c3b357f6.

Label changes

Label justifications:

  • P2: This is a bounded maintainer workflow improvement with no runtime product change, but it affects release operations.
  • merge-risk: 🚨 security-boundary: The skill governs private advisory reconciliation and backport routing, so incorrect acceptance could affect security-release handling.
  • merge-risk: 🚨 other: The added extended-stable release runbook changes operator publication and recovery guidance that ordinary CI cannot fully validate.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for this maintainer-authored, instruction-only skill PR with no runtime product behavior change.
Evidence reviewed

PR surface:

Docs +329. Total +329 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 0 0 0 0
Docs 2 332 3 +329
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 332 3 +329

What I checked:

Likely related people:

  • openclaw/openclaw-release-managers: CODEOWNERS assigns the npm release workflow and release policy docs to this team, and the PR changes release-operator workflow ownership. (role: release workflow owner boundary; confidence: high; files: .github/CODEOWNERS, docs/reference/RELEASING.md, .github/workflows/openclaw-npm-release.yml)
  • kevinslin: Live GitHub metadata shows kevinslin authored the merged extended-stable package update PR that this skill change builds on. (role: recent extended-stable contributor; confidence: high; commits: d2146223205e; files: src/config/types.openclaw.ts, src/cli/update-cli.ts, docs/cli/update.md)
  • steipete: CODEOWNERS names steipete for CODEOWNERS itself, and current blame in this shallow checkout attributes the release skill and release docs snapshot to Peter Steinberger. (role: release process owner and recent area contributor; confidence: medium; commits: aaf5af2fbc87; files: .agents/skills/release-openclaw-maintainer/SKILL.md, docs/reference/RELEASING.md, .github/CODEOWNERS)
  • openclaw/openclaw-secops: CODEOWNERS assigns SECURITY.md and security-sensitive policy surfaces to this team, and the new workflow includes private advisory reconciliation. (role: adjacent security workflow owner; confidence: medium; files: SECURITY.md, .github/CODEOWNERS, .agents/skills/release-openclaw-maintainer/references/extended-stable-backports.md)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (5 earlier review cycles)
  • reviewed 2026-07-03T01:21:58.611Z sha fec33cb :: needs maintainer review before merge. :: none
  • reviewed 2026-07-04T17:56:41.037Z sha 96b7161 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-09T00:40:17.423Z sha d75591c :: needs changes before merge. :: [P2] Clarify plugin selector repair
  • reviewed 2026-07-09T00:47:03.507Z sha d75591c :: needs changes before merge. :: [P2] Clarify selector repair wording
  • reviewed 2026-07-09T19:00:22.197Z sha 795427e :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. merge-risk: 🚨 other 🚨 Merging this PR has meaningful risk outside the owned taxonomy. labels Jul 3, 2026
@RomneyDa RomneyDa changed the title docs(skills): add stable backport release workflow add stable backport release workflow skill Jul 3, 2026
@RomneyDa
RomneyDa force-pushed the security-backport-tagging branch from ced98c2 to fec33cb Compare July 3, 2026 00:50
@clawsweeper clawsweeper Bot added status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 3, 2026
@RomneyDa
RomneyDa marked this pull request as draft July 3, 2026 01:07
@clawsweeper clawsweeper Bot added status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. labels Jul 3, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jul 3, 2026
Open
7 tasks
@RomneyDa RomneyDa self-assigned this Jul 4, 2026
@RomneyDa RomneyDa changed the title add stable backport release workflow skill docs(skills): add extended-stable backport workflow Jul 4, 2026
@RomneyDa RomneyDa changed the title docs(skills): add extended-stable backport workflow docs(skills): add backporting to release maintainer Jul 9, 2026
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jul 9, 2026
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 9, 2026
@RomneyDa
RomneyDa marked this pull request as ready for review July 9, 2026 23:26
@RomneyDa
RomneyDa merged commit ff0a3f2 into main Jul 9, 2026
94 of 103 checks passed
@RomneyDa
RomneyDa deleted the security-backport-tagging branch July 9, 2026 23:50
@github-actions github-actions Bot mentioned this pull request Jul 10, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 10, 2026
@RomneyDa
docs(skills): add backporting to release maintainer (openclaw#99266)
4f74c47 
* docs(skills): add stable backport workflow

* docs(skills): prepare complete stable patch sets

* docs(skills): align backports with extended stable

* docs(skills): fold backports into release maintainer

* docs(release): clarify plugin selector repair
wheakerd pushed a commit to wheakerd/clawdbot that referenced this pull request Jul 15, 2026
@RomneyDa
docs(skills): add backporting to release maintainer (openclaw#99266)
2c876fa 
* docs(skills): add stable backport workflow

* docs(skills): prepare complete stable patch sets

* docs(skills): align backports with extended stable

* docs(skills): fold backports into release maintainer

* docs(release): clarify plugin selector repair

(cherry picked from commit ff0a3f2)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@RomneyDa RomneyDa

Labels

maintainer Maintainer-authored PR merge-risk: 🚨 other 🚨 Merging this PR has meaningful risk outside the owned taxonomy. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: M status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RomneyDa