ci: port openclaw publish, deploy, and tlonbot-smoke workflows#5931
ci: port openclaw publish, deploy, and tlonbot-smoke workflows#5931patosullivan wants to merge 5 commits into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3a77a05f9c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…h dry-run exercise staging
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ae4c31b350
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…odel in deploy trigger Publish: verify openclaw-v* tags match packages/openclaw's package.json version before building (same guard as tlon-skill-publish.yml), so a mistagged commit can't publish a mislabeled artifact. Deploy: record why packages/api and packages/tlon-skill are deliberately not in the path filter — ships install published npm versions of the workspace deps (resolve-workspace-deps.mjs --registry), so develop merges to those packages change nothing on restart; dep changes reach production via npm publish + restart.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6d1608f1e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…freshness The publish job previously staged .publish/ from a fresh checkout, so a commit whose checked-in openclaw.plugin.json lagged src/config-schema.ts could publish a stale manifest even though the build regenerated the right one (codex finding). Stage .publish/ in the build job next to the build outputs and ship it as the artifact; the publish job now has no checkout at all — it verifies and publishes the staged package verbatim. Also fail openclaw CI when the checked-in openclaw.plugin.json doesn't match what the build regenerates, so manifest drift can't land on develop in the first place.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc5ded5951
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…load actions/upload-artifact treats everything under a dot-directory as hidden and excludes it by default, so uploading .publish/ produced an empty artifact and the publish job had nothing to verify or publish (codex finding). Safe to include: .publish/ is exactly the public npm package contents. Also set if-no-files-found: error so an empty staging dir fails the build job instead of surfacing downstream.
latter-bolden
left a comment
latter-bolden
left a comment
There was a problem hiding this comment.
Lgtm, @yapishu might want to take a look
2 participants
Summary
Stacked on #5930. Ports the remaining three CI/CD workflows from
tloncorp/openclaw-tlonso the old repo's automation can be switched off at the end of the transition window: npm publish, ship-restart deploy, and the tlonbot smoke dispatch. Companion PR intloncorp/tlonbot(linked below) teaches the smoke harness to check out the plugin from this monorepo.All three workflows are inert or fail-safe until ops steps land (see the secrets table): publish needs the npm Trusted Publisher flip, deploy warn-skips without its GCP secrets, and the smoke dispatch warn-skips without its token.
Changes
.github/workflows/openclaw-publish.yml(port of publish.yml): tag schemeopenclaw-v*(precedent:desktop-v*), orworkflow_dispatchwithdry_run/npm_taginputs. Build job runs root install + plugin test/build and uploadspackages/openclaw/dist; publish job stages.publish/viaprepare-publish-package.js(which resolvesworkspace:^deps — added in move openclaw tlon plugin to the monorepo #5930), hard-fails on any leftoverworkspace:spec, thennpm publish --provenance..nvmrc) instead of the old repo's Node 24 — the monorepo install rebuildsbetter-sqlite3, which has no Node 24 prebuilds. The publish job keeps Node 24 for npm ≥ 11.5 (OIDC trusted publishing); it does no installs..github/workflows/openclaw-deploy.yml(port of deploy.yml): pushes todeveloptouchingpackages/openclaw/src/**restart internal ships; tlawn (prod) isworkflow_dispatch-only — the oldstable → tlawnauto-trigger is intentionally dropped so prod restarts stay a deliberate action, decoupled from the develop→master release sync. Restart job body is otherwise verbatim (GKE + OVH contexts, jq ship filters).GCP_SA_KEYis unset, so develop pushes stay green until secrets are provisioned..github/workflows/openclaw-dispatch-tlonbot-smoke.yml(port of dispatch-tlonbot-smoke.yml): on develop pushes touchingpackages/openclaw/**, dispatchestlonbot-smoke-testwith the commit SHA, now also sendingrepo: tloncorp/tlon-appsandpath: packages/openclawso tlonbot checks out the monorepo. Keeps the warn-skip when the token secret is unset.Companion PR: tloncorp/tlonbot#97 — both plugin consumers (smoke harness and production
tlawn.py) accept the monorepo layout via env vars (TLON_PLUGIN_REPO/TLON_PLUGIN_SUBPATH): sparse blobless checkout, workspace-dep resolution before install, repo-aware ref defaults (develop/masterfor tlon-apps). Legacy defaults everywhere, so merging changes nothing until the deployment env is flipped.How did I test?
actionlint(viarhysd/actionlintDocker image) passes on all three workflows.if:gates diffed against the old repo's workflows; deviations are only the ones listed above.workflow_dispatchonly appears once the workflow exists on the default branch, and push triggers only fire on develop. Post-merge runbook below covers the first live exercises (publish dry-run, manual internal restart).Risks and impact
Secrets / ops checklist (none block merging; workflows skip gracefully)
GCP_SA_EMAIL,GCP_SA_KEYprod-f0181862); mint a fresh key via IAM. The existingGCP_SERVICE_KEYsecret is a different SA (glob uploads) — don't reuse.KUBECONFIG_B64admin@ovh-oregon-{1,2}contexts).TLONBOT_DISPATCH_TOKENtloncorp/tlonbotwith Contents: read & write (repository_dispatch needs write; the read-onlyTLONBOT_TOKENPAT won't work). Add only after the companion tlonbot PR lands.@tloncorp/openclawfromtloncorp/openclaw-tlon/publish.ymltotloncorp/tlon-apps/openclaw-publish.yml. Until flipped, only dry-runs succeed. Never both repos publishable at once.Transition note: production still deploys old-repo code until the env flip
tlonbot's production
tlawn.pyre-fetches the plugin from openclaw-tlon git (masterfor internal,stablefor tlawn) on every pod restart. The companion tlonbot PR adds env-gated monorepo support; untilTLON_PLUGIN_REPO/TLON_PLUGIN_SUBPATHare set on the ship deployments, restarts — from either repo's deploy workflow — keep deploying openclaw-tlon code, so plugin changes landing only in this monorepo do not reach ships. Do the env flip early in the transition (one internal ship first), not at freeze.First-release runbook (post-merge)
TLONBOT_DISPATCH_TOKEN.workflow_dispatch mode=internal, observe pod restarts, before trusting the push trigger.openclaw-publish.ymldispatch withdry_run=true; verify.publishcontents in logs.openclaw-v0.4.4, publish to a test dist-tag first (npm_tag: dist-test), smoke-install, then promote tolatest.TLON_PLUGIN_REPO=tloncorp/tlon-apps+TLON_PLUGIN_SUBPATH=packages/openclawon one internal ship's deployment, verify clone/build/start, then roll out; disable the old repo's deploy.yml once proven (avoid double restarts).Rollback plan
Revert