chore: refresh development dependencies and workflow tools - #1318
Draft
steipete wants to merge 3 commits into
Draft
chore: refresh development dependencies and workflow tools#1318steipete wants to merge 3 commits into
steipete wants to merge 3 commits into
Conversation
Contributor
|
🦞👀 Pull request received. I will update this pull request when review starts. |
clawsweeper
Bot
added
merge-risk: 🚨 automation
Contributor
|
Codex review: needs real behavior proof before merge. Reviewed September 1, 2026, 6:58 AM ET / 10:58 UTC. ClawSweeper reviewWhat this changesRefreshes development dependencies, Node/pnpm/Codex pins, GitHub Action versions, lockfile entries, documentation, and version-guard tests. Merge readiness⛔ Blocked until stronger real behavior proof is added - 4 items remain Keep open: this is a coherent dependency and workflow-tool refresh that current main has not absorbed, but the draft is dirty against main and still lacks the repository-required shared-workflow container proof. Priority: P2 Review scores
Verification
How this fits togetherShared setup actions select Node and pnpm for ClawSweeper’s CI, review, repair, and publishing workflows. The refreshed pins feed those workflows and their validation guards, which then run repository automation. flowchart LR
A[Development dependency pins] --> B[Lockfile and package manager]
B --> C[Shared setup actions]
C --> D[GitHub Actions workflows]
D --> E[Review and repair automation]
F[Version guard tests] --> C
Before merge
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Rebase the focused refresh onto current main, resolve its workflow conflicts, and attach a redacted successful local-container trace for a representative shared workflow before landing. Do we have a high-confidence way to reproduce the issue? Not applicable: this is a tooling-maintenance PR rather than a report of broken product behavior. The remaining validation question is whether the rebased shared workflow runs successfully in its required container environment. Is this the best way to solve the issue? Unclear: the version updates and retained guards are coherent, but the branch must first be reconciled with current main and proven through the shared workflow path. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against b445c64591bc. LabelsLabel justifications:
EvidenceWhat I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (8 earlier review cycles)
|
clawsweeper
Bot
added
P2
Contributor
Author
|
Provenance note: this draft came out of an automated dependency/CI sweep across the org, from a State, for whoever picks it up: hosted CI is green at the current head, and two stale checkout-SHA Treat as unverified until the full local gate is rerun on a healthy host. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Problem This Solves
Refreshes ClawSweeper's development dependencies and pinned workflow tools while retaining the Node 24 support contract and existing validation gates.
Why This Change Was Made
The setup-node v7 release migrates the action to ESM and removes dummy NODE_AUTH_TOKEN export; these workflows do not rely on that dummy value. upload-artifact v7 keeps the existing archive behavior by default.
Deferred or intentionally retained:
Wrangler remains 4.107.0. The attempted 4.127.1 upgrade terminated with
Network connection lostin ProxyController during the local Durable Object/R2 round trip on both Node 26 and Node 24. The same round trip passed on 4.107.0 (207 bytes stored/restored, equal digest/content, mismatched revision rejected). The upgrade was reverted before publication. Recommend a separate upgrade after reproducing on a healthy Linux local container; this macOS evidence is a compatibility blocker, not definitive upstream regression attribution.@types/node stays at the latest 24.x, 24.13.3. Moving to 26.x would admit APIs outside the supported Node 24 runtime; recommend retaining the baseline.
OpenClaw 2026.8.1 contains breaking provider-route and plugin migrations. Leave its workflow-tool pin for an owner-reviewed compatibility migration; recommend a separate change with notification and browser-tool integration proof. See release notes.
Codex 0.151.0 was published 2026-08-29 around 09:59 UTC and was less than 48 hours old at selection on 2026-08-31 around 07:20 UTC. Use the latest aged pair, 0.150.1; reconsider 0.151.0 after the cooldown with the same transport/sandbox proof.
config/openclaw-knip-6.8.0.pnpm-lock.yaml is an exact compatibility cache for the foreign OpenClaw script that requests Knip 6.8.0, not ClawSweeper's package manifest. Advancing it independently would break its matching/offline cache contract.
TypeScript 7.0.2, yaml 2.9.0, playwright-core 1.62.1, actionlint 1.7.12, and remaining action-major refs were already current.
User Impact
No intended product behavior change. This is development and workflow tooling maintenance; no changelog entry is needed.
OpenClaw Bay Impact
No Bay code or data-contract change is needed. Dependency and action versions change; queue ownership, status projections, observer routes, and mutation controls remain unchanged.
Documentation Impact
Reviewed CONTRIBUTING.md, docs/README.md, docs/scheduler.md, docs/public-api.md, and docs/live-proof.md. Updated the active pnpm-version statements in CONTRIBUTING.md and docs/scheduler.md; historical proof artifacts keep their recorded versions.
Evidence
Default-branch CI was already successful at the starting head 1b90866: https://github.com/openclaw/clawsweeper/actions/runs/33366416658. CI (
ci.yml) is the build/test gate;dashboard-ci.ymlrefreshes production PR telemetry and is an operations workflow, not a build/test check. No production operation, deploy, apply, close, or merge was run.pnpm run build:all,pnpm run check:static, andpnpm run lintpassed on Node 24.20.0/pnpm 11.24.0.actionlint -shellcheck= -ignore 'unexpected key "queue" for "concurrency" section' .github/workflows/*.yml: exit 0.pnpm check, Windows launcher, and sparse builds. Current-head CodeQL, containment, and automerge E2E checks also passed.uv_fs_fsync → fcntl/__fcntlon the active test stack. No remaining local assertion failure was observed before cancellation; this is still not a passing full local suite.Draft blocker: the complete local suite has not passed.
PATH="/opt/homebrew/opt/bash/bin:$PATH" pnpm run checkpassed static/build/lint and the focused coverage target, then hit the existing five-second dead-lock reclamation assertion on this busy macOS host. An isolated Node 24 retry eventually passed without any assertion/code change (1 passed, 0 failed). The Node 26 broad run and Node 24 four-process full-suite retry were stopped; their cancellation output is not a complete test result. All tests and coverage thresholds remain unchanged.Two local Docker-backed Crabbox attempts (
cbx_0b48f97eeb23,cbx_54f22625cae6, providerlocal-container, imagenode:24.20.0-bookworm, digestsha256:be23f54a88d34e8824c741b19b91064094f92c1c97b194144bfc8b50d67258e2) stalled during container creation before lease admission or test execution. A separate network-disabled Docker echo probe also stalled. No remote provider was substituted and the shared Docker engine was not restarted. Repeat the full local gate on a healthy local container before marking ready.Real Behavior Proof
Claim: the refreshed dependency graph builds the existing CLI; updated workflow tools preserve cached Node selection, read-only execution, and proxy transport. Wrangler was retained after the failed upgrade proof.
Environment: task-owned macOS arm64 worktree, pnpm 11.24.0. Native host proof; the repository's Windows-specific Docker requirement does not apply to this host. All service inputs are synthetic and all exercised endpoints are loopback. The Worker uses Wrangler's local workerd/Durable Object/R2 storage, with no production credentials.
Built CLI, real synthetic input:
The generated index was served through a real loopback HTTP server and fetched successfully:
PASS built docs HTTP GET /: 200, ClawSweeper title, 44700 bytes.Codex binary and sandbox:
The proxy harness starts the actual 0.150.1 binary with
--http-shutdown --server-info <file> --upstream-url http://127.0.0.1:<port>/v1/responses, feeds a synthetic value through stdin, POSTs JSON to its emitted port, verifies the upstream received the same JSON and expected authorization header, verifies the returned JSON, and requests/shutdownwith an observed zero exit. It uses no real provider credential or inference.For actions/setup-node v7, downloaded the action at
820762786026740c76f36085b0efc47a31fe5020and executed its realdist/setup/index.jswithINPUT_NODE-VERSION=24, isolatedGITHUB_PATH/GITHUB_ENV/GITHUB_OUTPUTfiles, and an isolated tool-cache entry pointing to the installed Node 24.20.0 distribution. Result, exit 0:The action's cold download matched Node 24.20.0 but extraction was interrupted during host I/O contention; only its real cached-selection path is claimed as passed. The actual action run reported that GitHub cache services were unavailable locally.
Artifacts retained for the orchestrator in
.artifacts/deps-refresh-20260830/: build/static/lint/focused logs, Codex review results, proxy harness/output, setup-node output, local Worker logs and normalized retained-version storage receipt, and both failed container startup logs.Limits: local macOS behavior and synthetic inputs do not prove production credential availability, deployment, external model inference, Linux sandboxing, Windows runtime behavior, or GitHub artifact upload. Hosted CI will provide separate Linux/Windows build/test evidence and will not be presented as a passing full local run. No production workflow was dispatched to manufacture proof.