`OpenClaw Release Publish`, reusing the successful preflight artifact via

`preflight_run_id`; stable macOS release readiness also requires the

packaged `.zip`, `.dmg`, `.dSYM.zip`, and updated `appcast.xml` on `main`.

The private macOS publish workflow publishes the signed appcast to public

`main` automatically after release assets verify; if branch protection blocks

the direct push, it opens or updates an appcast PR.

The macOS publish workflow publishes the signed appcast to public `main`

automatically after release assets verify; if branch protection blocks the

direct push, it opens or updates an appcast PR.

11. After publish, run the npm post-publish verifier, optional standalone

published-npm Telegram E2E when you need post-publish channel proof,

dist-tag promotion when needed, verify the generated GitHub release page,

published package from the rest of release validation. Provide

`package_acceptance_package_spec` when Package Acceptance should use a

different published package from the release package spec. Provide

`evidence_package_spec` when the private evidence report should prove that the

`evidence_package_spec` when the release evidence report should prove that the

validation matches a published npm package without forcing Telegram E2E.

Example:

`gh workflow run full-release-validation.yml --ref main -f ref=release/YYYY.M.D`

- stable npm releases default to `beta`

- stable npm publish can target `latest` explicitly via workflow input

- token-based npm dist-tag mutation now lives in

`openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml`

for security, because `npm dist-tag add` still needs `NPM_TOKEN` while the

public repo keeps OIDC-only publish

`openclaw/releases/.github/workflows/openclaw-npm-dist-tags.yml` because

`npm dist-tag add` still needs `NPM_TOKEN` while the source repo keeps

OIDC-only publish

- public `macOS Release` is validation-only; when a tag lives only on a

release branch but the workflow is dispatched from `main`, set

`public_release_branch=release/YYYY.M.D`

- real private mac publish must pass successful private mac

`preflight_run_id` and `validate_run_id`

- real macOS publish must pass successful macOS `preflight_run_id` and

`validate_run_id`

- the real publish paths promote prepared artifacts instead of rebuilding

them again

- For stable correction releases like `YYYY.M.D-N`, the post-publish verifier

- Stable macOS release readiness also includes the updater surfaces:

- the GitHub release must end up with the packaged `.zip`, `.dmg`, and `.dSYM.zip`

- `appcast.xml` on `main` must point at the new stable zip after publish; the

private macOS publish workflow commits it automatically, or opens an appcast

macOS publish workflow commits it automatically, or opens an appcast

PR when direct push is blocked

- the packaged app must keep a non-debug bundle id, a non-empty Sparkle feed

URL, and a `CFBundleVersion` at or above the canonical Sparkle build floor

6. Run `OpenClaw Release Publish` with the same `tag`, the same `npm_dist_tag`,

and the saved `preflight_run_id`; it publishes externalized plugins to npm

and ClawHub before promoting the OpenClaw npm package

7. If the release landed on `beta`, use the private

`openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml`

7. If the release landed on `beta`, use the

`openclaw/releases/.github/workflows/openclaw-npm-dist-tags.yml`

workflow to promote that stable version from `beta` to `latest`

8. If the release intentionally published directly to `latest` and `beta`

should follow the same stable build immediately, use that same private

should follow the same stable build immediately, use that same release

workflow to point both dist-tags at the stable version, or let its scheduled

self-healing sync move `beta` later

The dist-tag mutation lives in the private repo for security because it still

requires `NPM_TOKEN`, while the public repo keeps OIDC-only publish.

The dist-tag mutation lives in the release ledger repo because it still requires

`NPM_TOKEN`, while the source repo keeps OIDC-only publish.

That keeps the direct publish path and the beta-first promotion path both

documented and operator-visible.