admin/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-08-14 08:52:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: keep external skill rollouts production-dark (#3236)

Browse Source 
* feat: add fail-closed skill rollout gates

* fix: preserve scan queue pagination semantics
This commit is contained in:
Patrick Erichsen
2026-07-23 08:36:41 -07:00
committed by GitHub
parent 688329b343
commit fe8eff20ee
37 changed files with 1584 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/deploy-test.yml
+26
View File
@@ -95,6 +95,14 @@ jobs:
- uses: ./.github/actions/setup-bun
- name: Enable Test rollout modes
env:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
run: |
set -euo pipefail
bunx convex env set CLAWHUB_SKILLS_SH_ROLLOUT_MODE test --prod
bunx convex env set CLAWHUB_GITHUB_SKILL_SYNC_ROLLOUT_MODE test --prod
- name: Stamp Convex build SHA
env:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
@@ -115,6 +123,20 @@ jobs:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
run: bun run verify:convex-contract -- --prod
- name: Verify Test rollout capabilities
env:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
run: |
set -euo pipefail
capabilities="$(bunx convex run rolloutCapabilities:getPublicCapabilities --prod)"
jq -e '
.environment == "test" and
.skillsSh.mode == "test" and
.skillsSh.runtimeEnabled == true and
.githubSkillSync.mode == "test" and
.githubSkillSync.selfServiceEnabled == true
' <<< "$capabilities"
- name: Apply additive Test fixtures
env:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
@@ -145,6 +167,8 @@ jobs:
--build-env VERCEL_ENV=test \
--build-env VERCEL_TARGET_ENV=test \
--build-env CLAWHUB_ENV=test \
--build-env CLAWHUB_SKILLS_SH_ROLLOUT_MODE=test \
--build-env CLAWHUB_GITHUB_SKILL_SYNC_ROLLOUT_MODE=test \
--build-env SITE_URL="$TEST_SITE_URL" \
--build-env VITE_CLAWHUB_DEPLOY_ENV=test \
--build-env VITE_CONVEX_URL="$VITE_CONVEX_URL" \
@@ -152,6 +176,8 @@ jobs:
--build-env VITE_SITE_URL="$TEST_SITE_URL" \
--env CONVEX_DEPLOY_KEY= \
--env CLAWHUB_ENV=test \
--env CLAWHUB_SKILLS_SH_ROLLOUT_MODE=test \
--env CLAWHUB_GITHUB_SKILL_SYNC_ROLLOUT_MODE=test \
--env SITE_URL="$TEST_SITE_URL" \
--env VITE_CLAWHUB_DEPLOY_ENV=test \
--env VITE_CONVEX_URL="$VITE_CONVEX_URL" \
.github/workflows/deploy.yml
+38
View File
@@ -113,6 +113,26 @@ jobs:
- name: Install
run: bun install --frozen-lockfile
- name: Require dark rollout modes
if: needs.validate-deploy-request.outputs.deploy_backend == 'true'
env:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
run: |
set -euo pipefail
for name in \
CLAWHUB_SKILLS_SH_ROLLOUT_MODE \
CLAWHUB_GITHUB_SKILL_SYNC_ROLLOUT_MODE
do
value="$(bunx convex env get "$name" --prod 2>/dev/null || true)"
case "$value" in
""|off) ;;
*)
echo "::error::$name must be missing or off before an ordinary production deploy"
exit 1
;;
esac
done
- name: Stamp Convex build SHA
if: needs.validate-deploy-request.outputs.deploy_backend == 'true'
env:
@@ -149,6 +169,24 @@ jobs:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
run: bun run verify:convex-contract -- --prod
- name: Verify dark rollout capabilities
if: needs.validate-deploy-request.outputs.deploy_backend == 'true'
env:
CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
run: |
set -euo pipefail
capabilities="$(bunx convex run rolloutCapabilities:getPublicCapabilities --prod)"
jq -e '
.environment == "production" and
.skillsSh.mode == "off" and
.skillsSh.runtimeEnabled == false and
.skillsSh.publicCatalogEnabled == false and
.skillsSh.scanPlanningEnabled == false and
.skillsSh.scanAdmissionEnabled == false and
.githubSkillSync.mode == "off" and
.githubSkillSync.selfServiceEnabled == false
' <<< "$capabilities"
- name: Wait for Vercel production deployment
id: vercel
if: needs.validate-deploy-request.outputs.deploy_frontend == 'true'