Repository navigation
ci: adopt shared Swift CLI release workflow - #103
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:feature
|
Codex review: needs real behavior proof before merge. What this changesThis PR replaces the local release pipeline with the shared Swift CLI workflow and adds metadata and universal-build adapters. Example: Rehearse remindctl 0.3.8 with dry_run=true.
Review scores
ProductKind: Refactor · Worth it: Yes · Fix scope: Complete Merge readiness⛔ Blocked before merge - 4 items remain Keep open: this maintainer-authored consolidation is useful, but the referenced shared workflow does not yet support the caller’s inputs, so landing it now would break release runs. Priority: P2 Before merge
Findings
Tests
Agent review detailsHow this fits togetherGitHub tag pushes and manual dispatches enter the release caller, which passes source metadata, build adapters, and credentials to jobs producing signed archives, GitHub Releases, and Homebrew updates. flowchart TD
A[Tag push or dispatch] --> B[Caller policy]
B --> C[Shared source validation]
C --> D[Universal build adapter]
D --> E[Signing and notarization]
E --> F[Independent verifiers]
F --> G[Release and Homebrew publication]
Technical reviewBest possible solution: Retain the thin caller after the compatible shared workflow is published and its authorization boundary is proven. Do we have a high-confidence way to reproduce the issue? The caller and the resolved @v1 workflow interface establish the unsupported-input failure directly; no workflow dispatch was performed. Is this the best way to solve the issue? Consolidation addresses the documented reason for local duplication once the supporting shared release reaches @v1. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: not found in the target repository. Codex review notes: model internal, reasoning medium; reviewed against 453d181d10ed. Merge-risk optionsMaintainer options:
Provenance checked
TestingProof path: unit tests only. SecurityNeeds attention: No concrete authorization bypass was established, but the transfer of signing and publication authority requires final-effect evidence. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 17, 2026, 2:28 AM ET / 06:28 UTC. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0905dbe130
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [[ -n "$candidate" ]] || { echo 'Xcode 26 is required' >&2; exit 1; } | ||
| export DEVELOPER_DIR="$candidate/Contents/Developer" | ||
| mkdir -p "$OUTPUT_DIR" | ||
| "$ROOT/scripts/build-macos-universal.sh" "$OUTPUT_DIR/remindctl" |
There was a problem hiding this comment.
When Package.swift and Package.resolved drift, this adapter invokes build-macos-universal.sh, whose swift build automatically resolves dependencies and may rewrite the lockfile, allowing a release to compile a dependency revision not recorded in the frozen commit. The removed workflow explicitly ran swift package resolve followed by git diff --exit-code -- Package.resolved; swift build --help likewise documents --force-resolved-versions as making the build “fail resolution if it is out-of-date.” Restore the resolve/diff check or use that fail-closed option before producing the artifact.
Useful? React with 👍 / 👎.
1 participant
Replace the self-contained Swift release workflow with the shared Swift CLI archetype at
@v1(1.11.6). Disable the helper dylib, Linux archive, and resource-bundle requirement; retain the universal macOS ZIP,checksums.txt, OpenClaw signing identity, stable binary identifier, signed-tag release gate, and default no-publish dispatch. Keep the existing Homebrew tap and explicit token mapping.Add a small
OUTPUT_DIRadapter around the existing universal builder and a cross-platform validator for version.env, package.json, generated Swift metadata, and the embedded plist. Remove the duplicated source-resolution, CI-verification, keychain, and workflow-architecture code/tests now owned by the archetype. Document the shared inventory and checksum assets and preserve local historical-release readers.Focused validation covers caller policy, correct and incorrect versions, and the builder adapter with paths containing spaces. The repository's macOS PR CI remains the full gate. After merge and green push CI, dispatch the current version with
dry_run=trueto prove signing/notarization and both native verifier jobs on merged main. No remindctl version bump, tag, release, or tap update is included.