Skip to content

ci: adopt shared Swift release workflow - #205

Merged
steipete merged 1 commit into
mainfrom
feat/shared-swift-release
Aug 2, 2026
Merged

ci: adopt shared Swift release workflow#205
steipete merged 1 commit into
mainfrom
feat/shared-swift-release

Conversation

@steipete

@steipete steipete commented Aug 2, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • replace the local split release process with the fleet Swift CLI workflow
  • preserve imsg's personal Developer ID identifiers, macOS ZIP, Linux archive, helper slices, resource bundles, and Homebrew tap
  • remove the obsolete local signer/notary and manual Homebrew dispatch scripts
  • update packaging tests and release documentation around the thin caller contract

Proof

  • actionlint
  • make lint
  • all 510 Swift tests
  • real universal build: CLI x86_64/arm64, helper x86_64/arm64/arm64e, both resource bundles, version 0.13.5
  • autoreview clean with no accepted/actionable findings

@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Aug 2, 2026
@clawsweeper

clawsweeper Bot commented Aug 2, 2026

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 3:31 PM ET / 19:31 UTC.

ClawSweeper review

What this changes

This PR replaces imsg’s repository-owned signing, notarization, artifact publishing, and Homebrew-dispatch scripts with a shared reusable Swift CLI release workflow while retaining imsg-specific artifact names, identifiers, and secret mappings.

Merge readiness

⚠️ Ready for maintainer review - 5 items remain

Keep this collaborator-authored PR open for explicit release-boundary review. It is a focused replacement of imsg’s local release orchestration, but it newly grants a reusable workflow write permissions and signing, notarization, and Homebrew secrets through a mutable @v1 reference; current main still uses the local workflow and does not already contain this migration.

Priority: P2
Reviewed head: e76e515f56efc64afcd11e5d92e705d821f89891
Owner decision: Required. See Decision needed.

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) The patch is focused and preserves documented imsg-specific release inputs, but the central reusable workflow and its credential boundary were not independently verifiable in this review.
Proof confidence 🌊 off-meta tidepool Not applicable: This collaborator-authored CI migration is outside the external-contributor proof gate; the claimed universal build and still-running macOS check remain release validation that should be reviewed before merge.
Patch quality 🦐 gold shrimp (3/6) Security review found an item that needs attention.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: This collaborator-authored CI migration is outside the external-contributor proof gate; the claimed universal build and still-running macOS check remain release validation that should be reviewed before merge.
Evidence reviewed 6 items Current main has not adopted this workflow: The proposed commit is directly based on current main and replaces the local 211-line release workflow; no repository tag contains the proposed commit, while the latest visible release tag is v0.13.4 on an earlier commit.
Focused release migration: The branch changes six release-related files, adding 77 lines and removing 426: it replaces local workflow orchestration and removes the local signer/notary and Homebrew dispatch scripts.
Credential-bearing reusable call: The caller grants the reusable job read access to Actions/checks/statuses plus write access to repository contents and pull requests, and forwards six signing, notarization, and Homebrew secrets to openclaw/release-workflows/...@v1.
Findings None None.
Security Needs attention Pin or govern the reusable release workflow: This caller grants the reusable workflow write access and forwards signing, notarization, and Homebrew secrets, but references it as @v1; verify protected-tag governance or use an immutable reviewed revision before relying on it for releases.

How this fits together

The release workflow turns a requested version and imsg’s platform build scripts into signed macOS and Linux artifacts, a GitHub release, and a Homebrew update. This PR moves orchestration into a reusable fleet workflow while scripts/build-universal.sh remains responsible for the imsg CLI, bridge helper, and resource-bundle payload.

flowchart LR
  A[Release version] --> B[imsg workflow caller]
  B --> C[Shared release workflow]
  C --> D[Universal build script]
  D --> E[Signed macOS and Linux artifacts]
  C --> F[GitHub release]
  C --> G[Homebrew tap update]
Loading

Decision needed

Question Recommendation
Is the organization-approved @v1 reusable-workflow reference an acceptable trust boundary for a caller that grants release write permissions and forwards signing, notarization, and Homebrew secrets? Use approved fleet tag policy: Accept @v1 if the central workflow repository has protected-tag and reviewer controls, then confirm the completed release-like artifact checks.

Why: The answer depends on central-workflow governance and protected-tag policy, neither of which can be established from this repository checkout or the unavailable remote workflow source.

Before merge

  • Resolve security concern: Pin or govern the reusable release workflow - This caller grants the reusable workflow write access and forwards signing, notarization, and Homebrew secrets, but references it as @v1; verify protected-tag governance or use an immutable reviewed revision before relying on it for releases.
  • Resolve merge risk (P1) - The new reusable workflow is referenced through mutable @v1 while receiving repository write permissions plus signing, notarization, and Homebrew credentials; a changed or incompatible central workflow could affect release publication or credential handling.
  • Resolve merge risk (P1) - The supplied PR context claims a real universal build, but no inspectable build transcript or artifact manifest was available and the macOS check was still in progress.
  • Complete next step (P2) - A maintainer must validate the approved shared-workflow trust boundary and completed release artifact proof; this is not a safe mechanical repair task.

Findings

  • [medium] Pin or govern the reusable release workflow — .github/workflows/release.yml:21
Agent review details

Security

Needs attention: The new reusable workflow receives sensitive release credentials and write permissions through a tag-based dependency reference, so its trust and pinning policy require maintainer verification before merge.

Review metrics

Metric Value Why it matters
Release automation surface 6 files affected; 77 added, 426 removed The PR removes repository-owned signing and Homebrew scripts, so the shared workflow must preserve the entire release contract.
Credential forwarding 6 secrets forwarded The reusable workflow receives signing, notarization, and Homebrew credentials alongside release write permissions.

Merge-risk options

Maintainer options:

  1. Verify central workflow governance (recommended)
    Before merge, confirm that v1 is protected and review the exact reusable-workflow revision, secret handling, and imsg artifact contract.
  2. Adopt immutable workflow pinning
    Replace the mutable tag with a reviewed immutable reference if protected-tag governance cannot provide the intended supply-chain boundary.
  3. Pause the migration
    Retain the local workflow until the shared workflow’s credential and artifact contract has been independently validated.

Technical review

Best possible solution:

Adopt the shared workflow only after confirming its protected-reference policy and exact release contract, then retain a redacted release-like verification showing the imsg helper slices, bundles, signing, Linux archive, and Homebrew handoff remain correct.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a CI and release-orchestration migration, not a user-reported runtime bug. The branch’s claimed universal build is useful validation, but its output was not available to inspect and the macOS check was still running.

Is this the best way to solve the issue?

Unclear; centralizing the workflow is a coherent way to remove duplication, but the referenced workflow source, protected-tag policy, and exact secret/input contract could not be independently verified in this review.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 15d4a7b664c3.

Labels

Label changes:

  • add P2: This is a bounded release-automation migration with significant release-path impact but no demonstrated active user outage.
  • add merge-risk: 🚨 security-boundary: The new reusable workflow receives signing, notarization, and Homebrew secrets through a mutable @v1 reference.
  • add merge-risk: 🚨 automation: The PR replaces the repository’s full release orchestration and publication path with reusable external automation.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
  • add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This collaborator-authored CI migration is outside the external-contributor proof gate; the claimed universal build and still-running macOS check remain release validation that should be reviewed before merge.

Label justifications:

  • P2: This is a bounded release-automation migration with significant release-path impact but no demonstrated active user outage.
  • merge-risk: 🚨 security-boundary: The new reusable workflow receives signing, notarization, and Homebrew secrets through a mutable @v1 reference.
  • merge-risk: 🚨 automation: The PR replaces the repository’s full release orchestration and publication path with reusable external automation.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This collaborator-authored CI migration is outside the external-contributor proof gate; the claimed universal build and still-running macOS check remain release validation that should be reviewed before merge.

Evidence

Security concerns:

  • [medium] Pin or govern the reusable release workflow — .github/workflows/release.yml:21
    This caller grants the reusable workflow write access and forwards signing, notarization, and Homebrew secrets, but references it as @v1; verify protected-tag governance or use an immutable reviewed revision before relying on it for releases.
    Confidence: 0.94

What I checked:

  • Current main has not adopted this workflow: The proposed commit is directly based on current main and replaces the local 211-line release workflow; no repository tag contains the proposed commit, while the latest visible release tag is v0.13.4 on an earlier commit. (.github/workflows/release.yml:1, e76e515f56ef)
  • Focused release migration: The branch changes six release-related files, adding 77 lines and removing 426: it replaces local workflow orchestration and removes the local signer/notary and Homebrew dispatch scripts. (.github/workflows/release.yml:1, e76e515f56ef)
  • Credential-bearing reusable call: The caller grants the reusable job read access to Actions/checks/statuses plus write access to repository contents and pull requests, and forwards six signing, notarization, and Homebrew secrets to openclaw/release-workflows/...@v1. (.github/workflows/release.yml:15, e76e515f56ef)
  • Existing payload safeguard remains: The universal build script still validates the bridge helper’s required arm64e, arm64, and x86_64 slices before release output is copied; this branch only updates the shipping-path comment. (scripts/build-universal.sh:53, 15d4a7b664c3)
  • Release-owner provenance: Peter Steinberger authored the recent workflow refresh on 2026-08-01 and the v0.13.4 release preparation that introduced the current local release scripts on 2026-07-27, then authored this proposed migration on 2026-08-02. (.github/workflows/release.yml:1, 4e8bf88632d5)
  • Reusable workflow source could not be independently inspected: A read-only GitHub API request for the referenced reusable workflow failed because github.com could not resolve in the review environment; its exact input, secret-handling, and tag-governance contract therefore remains unverified here. (.github/workflows/release.yml:21, e76e515f56ef)

Likely related people:

  • Peter Steinberger: He authored the existing workflow refresh and local release-script history as well as this shared-workflow migration. (role: release-automation owner by history; confidence: high; commits: 1d8b679cc3a3, 4e8bf88632d5, e76e515f56ef; files: .github/workflows/release.yml, scripts/sign-and-notarize.sh, scripts/update-homebrew.sh)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Confirm the @v1 tag’s protection and review the reusable workflow’s exact secret/input handling.
  • Wait for the macOS check and retain a redacted release-like artifact verification transcript in the PR body.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@steipete
steipete merged commit 4605e7c into main Aug 2, 2026
9 checks passed
@steipete
steipete deleted the feat/shared-swift-release branch August 2, 2026 20:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. P2 Normal priority bug or improvement with limited blast radius. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete