Repository navigation
ci: build once, gate the digest, promote what was tested (RT#1550) - #40
Conversation
Replace build.yml (dual Quay/GHCR push, scan-by-rebuild) and the dispatch-only weekly-rebuild.yml with one container.yml calling constitution container-release.yml v1.39.1. Gate: boot=healthcheck (the Containerfile HEALTHCHECK, openclaw health, with a minimal gateway config mounted at ~/.openclaw from tests/image/home) plus the existing RT#1534 OpenRouter private-network smoke test as contract-test, both run against the pushed digest. Proven locally: passes on the built image, REFUSED without the config. Drops GHCR everywhere; Quay only. Moves Inherits and all constitution workflow pins from v1.31.0 to v1.39.1. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| push: | ||
| branches: [main] | ||
| tags: ["v*"] | ||
| schedule: |
There was a problem hiding this comment.
CRITICAL (Constitution): The constitution explicitly requires the weekly rebuild to be triggered by workflow_dispatch pulsed by Hermes, not by a schedule: trigger. This adds a scheduled weekly trigger.
Suggestion: Remove the schedule: trigger and have Hermes invoke the workflow through workflow_dispatch.
Evidence:
schedule:
- cron: "17 5 * * 1"
There was a problem hiding this comment.
fixed: the schedule: trigger is gone. The weekly rebuild stays a workflow_dispatch pulsed by Hermes, as the constitution says.
There was a problem hiding this comment.
fixed in 381bb58: the schedule trigger is removed; the weekly rebuild stays a Hermes-pulsed workflow_dispatch, which the release workflow gates like any build.
The repo's constitution says the weekly rebuild is a workflow_dispatch pulsed by Hermes, not a schedule: trigger. The conversion had added one. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h
There was a problem hiding this comment.
Gatehouse found no issues.
Reviewed 1 commit since 72c6712 (incremental).
2 finding(s) dropped: their evidence is not in the diff.
Summary
boot: healthcheck(the Containerfile HEALTHCHECK,openclaw health) with a minimal gateway config fromtests/image/homemounted at~/.openclawas production does (overlay mount), plus the existing RT#1534 OpenRouter private-network smoke test ascontract-test. Both run against the pushed digest. Locally the healthcheck passes on the built image and is REFUSED without the config; the smoke test passes.build.yml(dual Quay/GHCR push, scan-by-rebuild) and the dispatch-onlyweekly-rebuild.yml; replaced by onecontainer.ymlwith a Monday weekly schedule.security.yml(scans the published:latest, no rebuild) is kept..specify/memory/constitution.mdno longer mention it;.gemini/styleguide.mdhad no such lines.Inherits:and the validate and dependabot-automerge pins); validator PASS.:latestalready moved only onv*tags since constitution 1.33.0).Test plan
python3 container_release.py boot --image localhost/openclaw:gate --profile healthcheck --run-args '-v ./tests/image/home:/app/.openclaw:O'->healthy; smoke testPASS: private baseUrl blocked without opt-in🤖 Generated with Claude Code
https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h