mirror of
https://github.com/openclaw/clawhub.git
synced 2026-08-14 00:47:57 +00:00
Patrick Erichsen
0da4aa718b
* fix: preserve prepublication judge errors * fix: pass codex credential to prepublication scans * fix: keep node tests out of vitest
100 lines
3.6 KiB
YAML
100 lines
3.6 KiB
YAML
name: Pre-publication Publish Checks
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
batch-limit:
|
|
description: "Maximum staged publish attempts to check per worker shard"
|
|
required: true
|
|
default: "2"
|
|
max-jobs:
|
|
description: "Optional total attempts cap per worker shard"
|
|
required: false
|
|
default: ""
|
|
max-runtime-minutes:
|
|
description: "Stop claiming new attempts after this many minutes"
|
|
required: true
|
|
default: "8"
|
|
attempt-id:
|
|
description: "Optional exact publish attempt ID for targeted recovery"
|
|
required: false
|
|
default: ""
|
|
kind:
|
|
description: "Optional targeted recovery kind: skill or package"
|
|
required: false
|
|
default: ""
|
|
slug:
|
|
description: "Optional targeted recovery slug"
|
|
required: false
|
|
default: ""
|
|
version:
|
|
description: "Optional targeted recovery version"
|
|
required: false
|
|
default: ""
|
|
runner:
|
|
description: "Runner label for manual recovery dispatches"
|
|
required: true
|
|
default: "blacksmith-8vcpu-ubuntu-2404"
|
|
type: choice
|
|
options:
|
|
- "blacksmith-8vcpu-ubuntu-2404"
|
|
- "ubuntu-latest"
|
|
schedule:
|
|
- cron: "*/5 * * * *"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: clawhub-prepublication-publish-checks
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
prepublication-publish-checks:
|
|
name: Pre-publication publish checks shard ${{ matrix.shard }}
|
|
runs-on: ${{ inputs.runner || 'blacksmith-8vcpu-ubuntu-2404' }}
|
|
timeout-minutes: 20
|
|
environment: Production
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 2
|
|
matrix:
|
|
shard: ${{ fromJSON(github.event_name == 'workflow_dispatch' && inputs['attempt-id'] != '' && '[0]' || '[0,1]') }}
|
|
env:
|
|
CONVEX_URL: ${{ vars.CONVEX_URL || vars.VITE_CONVEX_URL || 'https://wry-manatee-359.convex.cloud' }}
|
|
PREPUBLICATION_CHECK_LIMIT: ${{ inputs['batch-limit'] || '2' }}
|
|
PREPUBLICATION_CHECK_MAX_JOBS: ${{ inputs['max-jobs'] || '' }}
|
|
PREPUBLICATION_CHECK_MAX_RUNTIME_MINUTES: ${{ inputs['max-runtime-minutes'] || '8' }}
|
|
PREPUBLICATION_CHECK_ATTEMPT_ID: ${{ inputs['attempt-id'] || '' }}
|
|
PREPUBLICATION_CHECK_KIND: ${{ inputs.kind || '' }}
|
|
PREPUBLICATION_CHECK_SLUG: ${{ inputs.slug || '' }}
|
|
PREPUBLICATION_CHECK_VERSION: ${{ inputs.version || '' }}
|
|
PREPUBLICATION_CLAWSCAN_TIMEOUT_MS: ${{ vars.PREPUBLICATION_CLAWSCAN_TIMEOUT_MS || '240000' }}
|
|
PREPUBLICATION_TRUFFLEHOG_IMAGE: ${{ vars.PREPUBLICATION_TRUFFLEHOG_IMAGE || 'ghcr.io/trufflesecurity/trufflehog:3.95.6@sha256:96f8429082cb2d4ae73b1096dcdb2f5aa139881d97042b0c5e5fa226a392e056' }}
|
|
PREPUBLICATION_WORKER_ID: "github-actions:${{ github.run_id }}:${{ github.run_attempt }}:${{ matrix.shard }}"
|
|
steps:
|
|
- uses: actions/checkout@v7.0.0
|
|
|
|
- uses: ./.github/actions/setup-bun
|
|
|
|
- name: Install Codex CLI
|
|
run: |
|
|
set -euo pipefail
|
|
npm install -g @openai/codex@0.142.3
|
|
codex --version
|
|
|
|
- name: Install ClawScan CLI
|
|
run: |
|
|
set -euo pipefail
|
|
npm install -g @openclaw/clawscan@0.1.4
|
|
clawscan --version
|
|
|
|
- name: Run pre-publication publish worker
|
|
env:
|
|
CODEX_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
SECURITY_SCAN_WORKER_TOKEN: ${{ secrets.SECURITY_SCAN_WORKER_TOKEN }}
|
|
VIRUSTOTAL_API_KEY: ${{ secrets.VT_API_KEY }}
|
|
run: |
|
|
bun run publish:prepublication-worker
|