required: false

default: ""

type: string

package_acceptance_package_spec:

description: Optional published package spec for Package Acceptance; blank uses the SHA-built release artifact

required: false

default: ""

type: string

npm_telegram_provider_mode:

description: Provider mode for the package Telegram E2E lane

required: false

CHILD_WORKFLOW_REF: ${{ github.ref_name }}

NPM_TELEGRAM_PACKAGE_SPEC: ${{ inputs.npm_telegram_package_spec }}

EVIDENCE_PACKAGE_SPEC: ${{ inputs.evidence_package_spec }}

PACKAGE_ACCEPTANCE_PACKAGE_SPEC: ${{ inputs.package_acceptance_package_spec }}

RELEASE_PROFILE: ${{ inputs.release_profile }}

RERUN_GROUP: ${{ inputs.rerun_group }}

LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}

if [[ -n "${EVIDENCE_PACKAGE_SPEC// }" ]]; then

echo "- Private evidence package proof: \`${EVIDENCE_PACKAGE_SPEC}\`"

fi

if [[ -n "${PACKAGE_ACCEPTANCE_PACKAGE_SPEC// }" ]]; then

echo "- Package Acceptance package spec: \`${PACKAGE_ACCEPTANCE_PACKAGE_SPEC}\`"

else

echo "- Package Acceptance package spec: SHA-built release artifact"

fi

} >> "$GITHUB_STEP_SUMMARY"

normal_ci:

RELEASE_PROFILE: ${{ inputs.release_profile }}

RERUN_GROUP: ${{ inputs.rerun_group }}

LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}

PACKAGE_ACCEPTANCE_PACKAGE_SPEC: ${{ inputs.package_acceptance_package_spec }}

run: |

set -euo pipefail

if [[ -n "${LIVE_SUITE_FILTER// }" ]]; then

echo "- Live suite filter: \`${LIVE_SUITE_FILTER}\`"

fi

if [[ -n "${PACKAGE_ACCEPTANCE_PACKAGE_SPEC// }" ]]; then

echo "- Package Acceptance package spec: \`${PACKAGE_ACCEPTANCE_PACKAGE_SPEC}\`"

fi

} >> "$GITHUB_STEP_SUMMARY"

child_rerun_group="$RERUN_GROUP"

if [[ -n "${LIVE_SUITE_FILTER// }" ]]; then

args+=(-f live_suite_filter="$LIVE_SUITE_FILTER")

fi

if [[ -n "${PACKAGE_ACCEPTANCE_PACKAGE_SPEC// }" ]]; then

args+=(-f package_acceptance_package_spec="$PACKAGE_ACCEPTANCE_PACKAGE_SPEC")

fi

dispatch_and_wait openclaw-release-checks.yml "${args[@]}"

required: false

default: ""

type: string

package_acceptance_package_spec:

description: Optional published package spec for Package Acceptance; blank uses the prepared release artifact

required: false

default: ""

type: string

concurrency:

group: openclaw-release-checks-${{ inputs.expected_sha || inputs.ref }}-${{ inputs.rerun_group }}

release_profile: ${{ steps.inputs.outputs.release_profile }}

rerun_group: ${{ steps.inputs.outputs.rerun_group }}

live_suite_filter: ${{ steps.inputs.outputs.live_suite_filter }}

package_acceptance_package_spec: ${{ steps.inputs.outputs.package_acceptance_package_spec }}

steps:

- name: Require main or release workflow ref for release checks

env:

RELEASE_PROFILE_INPUT: ${{ inputs.release_profile }}

RELEASE_RERUN_GROUP_INPUT: ${{ inputs.rerun_group }}

RELEASE_LIVE_SUITE_FILTER_INPUT: ${{ inputs.live_suite_filter }}

RELEASE_PACKAGE_ACCEPTANCE_PACKAGE_SPEC_INPUT: ${{ inputs.package_acceptance_package_spec }}

run: |

set -euo pipefail

{

printf 'release_profile=%s\n' "$RELEASE_PROFILE_INPUT"

printf 'rerun_group=%s\n' "$RELEASE_RERUN_GROUP_INPUT"

printf 'live_suite_filter=%s\n' "$RELEASE_LIVE_SUITE_FILTER_INPUT"

printf 'package_acceptance_package_spec=%s\n' "$RELEASE_PACKAGE_ACCEPTANCE_PACKAGE_SPEC_INPUT"

} >> "$GITHUB_OUTPUT"

- name: Summarize validated ref

RELEASE_PROFILE: ${{ inputs.release_profile }}

RELEASE_RERUN_GROUP: ${{ inputs.rerun_group }}

RELEASE_LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}

PACKAGE_ACCEPTANCE_PACKAGE_SPEC: ${{ inputs.package_acceptance_package_spec }}

run: |

{

echo "## Release checks"

if [[ -n "${RELEASE_LIVE_SUITE_FILTER// }" ]]; then

echo "- Live suite filter: \`${RELEASE_LIVE_SUITE_FILTER}\`"

fi

if [[ -n "${PACKAGE_ACCEPTANCE_PACKAGE_SPEC// }" ]]; then

echo "- Package Acceptance package spec: \`${PACKAGE_ACCEPTANCE_PACKAGE_SPEC}\`"

else

echo "- Package Acceptance package spec: prepared release artifact"

fi

echo "- This run will execute cross-OS release validation, install smoke, QA Lab parity, Matrix, and Telegram lanes, and the non-Parallels Docker/live/openwebui coverage from the CI migration plan."

} >> "$GITHUB_STEP_SUMMARY"

uses: ./.github/workflows/package-acceptance.yml

with:

workflow_ref: ${{ github.ref_name }}

source: artifact

source: ${{ needs.resolve_target.outputs.package_acceptance_package_spec != '' && 'npm' || 'artifact' }}

package_spec: ${{ needs.resolve_target.outputs.package_acceptance_package_spec || 'openclaw@beta' }}

artifact_name: ${{ needs.prepare_release_package.outputs.artifact_name }}

package_sha256: ${{ needs.prepare_release_package.outputs.package_sha256 }}

suite_profile: custom

docker_lanes: doctor-switch update-channel-switch upgrade-survivor published-upgrade-survivor plugins-offline plugin-update

published_upgrade_survivor_baselines: release-history

published_upgrade_survivor_baselines: all-since-2026.4.23

published_upgrade_survivor_scenarios: reported-issues

telegram_mode: mock-openai

telegram_scenarios: telegram-help-command,telegram-commands-command,telegram-tools-compact-command,telegram-whoami-command,telegram-context-command,telegram-mention-gating

default: openclaw@latest

type: string

published_upgrade_survivor_baselines:

description: Optional baseline list for published-upgrade-survivor/update-migration; use release-history or all-since-2026.4.23

description: Optional baseline list for published-upgrade-survivor/update-migration; use all-since-2026.4.23, release-history, or exact versions

required: false

default: ""

type: string

default: openclaw@latest

type: string

published_upgrade_survivor_baselines:

description: Optional baseline list for published-upgrade-survivor/update-migration; use release-history or all-since-2026.4.23

description: Optional baseline list for published-upgrade-survivor/update-migration; use all-since-2026.4.23, release-history, or exact versions

required: false

default: ""

type: string

Docker lanes, Package Acceptance inputs, release defaults, and failure triage,

see [Testing updates and plugins](/help/testing-updates-plugins).

Release checks call Package Acceptance with `source=artifact`, the prepared release package artifact, `suite_profile=custom`, `docker_lanes='doctor-switch update-channel-switch upgrade-survivor published-upgrade-survivor plugins-offline plugin-update'`, `published_upgrade_survivor_baselines=release-history`, `published_upgrade_survivor_scenarios=reported-issues`, and `telegram_mode=mock-openai`. This keeps package migration, update, stale-plugin-dependency cleanup, configured-plugin install repair, offline plugin, plugin-update, and Telegram proof on the same resolved package tarball. Cross-OS release checks still cover OS-specific onboarding, installer, and platform behavior; package/update product validation should start with Package Acceptance. The `published-upgrade-survivor` Docker lane validates one published package baseline per run. In Package Acceptance, the resolved `package-under-test` tarball is always the candidate and `published_upgrade_survivor_baseline` selects the fallback published baseline, defaulting to `openclaw@latest`; failed-lane rerun commands preserve that baseline. Set `published_upgrade_survivor_baselines=release-history` to expand the lane across a deduped history matrix: the latest six stable releases, `2026.4.23`, and the latest stable release before `2026-03-15`. Set `published_upgrade_survivor_scenarios=reported-issues` to expand the same baselines across issue-shaped fixtures for Feishu config, preserved bootstrap/persona files, configured OpenClaw plugin installs, tilde log paths, and stale legacy plugin dependency roots. The separate `Update Migration` workflow uses the `update-migration` Docker lane with `all-since-2026.4.23` and `plugin-deps-cleanup` when the question is exhaustive published update cleanup, not normal Full Release CI breadth. Local aggregate runs can pass exact package specs with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS`, keep a single lane with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC` such as `openclaw@2026.4.15`, or set `OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS` for the scenario matrix. The published lane configures the baseline with a baked `openclaw config set` command recipe, records recipe steps in `summary.json`, and probes `/healthz`, `/readyz`, plus RPC status after Gateway start. The Windows packaged and installer fresh lanes also verify that an installed package can import a browser-control override from a raw absolute Windows path. The OpenAI cross-OS agent-turn smoke defaults to `OPENCLAW_CROSS_OS_OPENAI_MODEL` when set, otherwise `openai/gpt-5.4`, so the install and gateway proof stays on a GPT-5 test model while avoiding GPT-4.x defaults.

Release checks call Package Acceptance with `source=artifact`, the prepared release package artifact, `suite_profile=custom`, `docker_lanes='doctor-switch update-channel-switch upgrade-survivor published-upgrade-survivor plugins-offline plugin-update'`, `published_upgrade_survivor_baselines=all-since-2026.4.23`, `published_upgrade_survivor_scenarios=reported-issues`, and `telegram_mode=mock-openai`. This keeps package migration, update, stale-plugin-dependency cleanup, configured-plugin install repair, offline plugin, plugin-update, and Telegram proof on the same resolved package tarball. Set `package_acceptance_package_spec` on Full Release Validation or OpenClaw Release Checks to run that same matrix against a shipped npm package instead of the SHA-built artifact. Cross-OS release checks still cover OS-specific onboarding, installer, and platform behavior; package/update product validation should start with Package Acceptance. The `published-upgrade-survivor` Docker lane validates one published package baseline per run. In Package Acceptance, the resolved `package-under-test` tarball is always the candidate and `published_upgrade_survivor_baseline` selects the fallback published baseline, defaulting to `openclaw@latest`; failed-lane rerun commands preserve that baseline. Set `published_upgrade_survivor_baselines=all-since-2026.4.23` to expand Full Release CI across every stable npm release from `2026.4.23` through `latest`; `release-history` remains available for manual wider sampling with the older pre-date anchor. Set `published_upgrade_survivor_scenarios=reported-issues` to expand the same baselines across issue-shaped fixtures for Feishu config, preserved bootstrap/persona files, configured OpenClaw plugin installs, tilde log paths, and stale legacy plugin dependency roots. The separate `Update Migration` workflow uses the `update-migration` Docker lane with `all-since-2026.4.23` and `plugin-deps-cleanup` when the question is exhaustive published update cleanup, not normal Full Release CI breadth. Local aggregate runs can pass exact package specs with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS`, keep a single lane with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC` such as `openclaw@2026.4.15`, or set `OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS` for the scenario matrix. The published lane configures the baseline with a baked `openclaw config set` command recipe, records recipe steps in `summary.json`, and probes `/healthz`, `/readyz`, plus RPC status after Gateway start. The Windows packaged and installer fresh lanes also verify that an installed package can import a browser-control override from a raw absolute Windows path. The OpenAI cross-OS agent-turn smoke defaults to `OPENCLAW_CROSS_OS_OPENAI_MODEL` when set, otherwise `openai/gpt-5.4`, so the install and gateway proof stays on a GPT-5 test model while avoiding GPT-4.x defaults.

### Legacy compatibility windows

- `source=url`: validate an HTTPS tarball with required `package_sha256`.

- `source=artifact`: reuse a tarball uploaded by another Actions run.

Full Release Validation uses `source=artifact` by default, built from the

resolved release SHA. For post-publish proof, pass

`package_acceptance_package_spec=openclaw@YYYY.M.D` so the same upgrade matrix

targets the shipped npm package instead.

Release checks call Package Acceptance with the package/update/plugin set:

```text

They also pass:

```text

published_upgrade_survivor_baselines=release-history

published_upgrade_survivor_baselines=all-since-2026.4.23

published_upgrade_survivor_scenarios=reported-issues

telegram_mode=mock-openai

```

cleanup, offline plugin coverage, plugin update behavior, and Telegram package

QA on the same resolved artifact.

`release-history` is a bounded release-check sample: latest six stable releases,

`2026.4.23`, and one older pre-date anchor. For exhaustive published update

migration coverage, use `all-since-2026.4.23` in the separate Update Migration

workflow instead of Full Release CI.

`all-since-2026.4.23` is the Full Release CI upgrade sample: every stable npm-published release from `2026.4.23` through `latest`. For exhaustive published

update migration coverage, use `all-since-2026.4.23` in the separate Update

Migration workflow instead of Full Release CI. `release-history` remains

available for manual wider sampling when you also want the legacy pre-date

anchor.

Run a package profile manually when validating a candidate before release:

-f source=npm \

-f package_spec=openclaw@beta \

-f suite_profile=package \

-f published_upgrade_survivor_baselines=release-history \

-f published_upgrade_survivor_baselines=all-since-2026.4.23 \

-f published_upgrade_survivor_scenarios=reported-issues \

-f telegram_mode=mock-openai

```

- Npm tarball onboarding/channel/agent smoke: `pnpm test:docker:npm-onboard-channel-agent` installs the packed OpenClaw tarball globally in Docker, configures OpenAI via env-ref onboarding plus Telegram by default, runs doctor, and runs one mocked OpenAI agent turn. Reuse a prebuilt tarball with `OPENCLAW_CURRENT_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host rebuild with `OPENCLAW_NPM_ONBOARD_HOST_BUILD=0`, or switch channel with `OPENCLAW_NPM_ONBOARD_CHANNEL=discord`.

- Update channel switch smoke: `pnpm test:docker:update-channel-switch` installs the packed OpenClaw tarball globally in Docker, switches from package `stable` to git `dev`, verifies the persisted channel and plugin post-update work, then switches back to package `stable` and checks update status.

- Upgrade survivor smoke: `pnpm test:docker:upgrade-survivor` installs the packed OpenClaw tarball over a dirty old-user fixture with agents, channel config, plugin allowlists, stale plugin dependency state, and existing workspace/session files. It runs package update plus non-interactive doctor without live provider or channel keys, then starts a loopback Gateway and checks config/state preservation plus startup/status budgets.

- Published upgrade survivor smoke: `pnpm test:docker:published-upgrade-survivor` installs `openclaw@latest` by default, seeds realistic existing-user files, configures that baseline with a baked command recipe, validates the resulting config, updates that published install to the candidate tarball, runs non-interactive doctor, writes `.artifacts/upgrade-survivor/summary.json`, then starts a loopback Gateway and checks configured intents, state preservation, startup, `/healthz`, `/readyz`, and RPC status budgets. Override one baseline with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC`, ask the aggregate scheduler to expand exact baselines with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS`, and expand issue-shaped fixtures with `OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS` such as `reported-issues`; the reported-issues set includes `configured-plugin-installs` for automatic external OpenClaw plugin install repair. Package Acceptance exposes those as `published_upgrade_survivor_baseline`, `published_upgrade_survivor_baselines`, and `published_upgrade_survivor_scenarios`.

- Published upgrade survivor smoke: `pnpm test:docker:published-upgrade-survivor` installs `openclaw@latest` by default, seeds realistic existing-user files, configures that baseline with a baked command recipe, validates the resulting config, updates that published install to the candidate tarball, runs non-interactive doctor, writes `.artifacts/upgrade-survivor/summary.json`, then starts a loopback Gateway and checks configured intents, state preservation, startup, `/healthz`, `/readyz`, and RPC status budgets. Override one baseline with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC`, ask the aggregate scheduler to expand exact baselines with `OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS` such as `all-since-2026.4.23`, and expand issue-shaped fixtures with `OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS` such as `reported-issues`; the reported-issues set includes `configured-plugin-installs` for automatic external OpenClaw plugin install repair. Package Acceptance exposes those as `published_upgrade_survivor_baseline`, `published_upgrade_survivor_baselines`, and `published_upgrade_survivor_scenarios`.

- Session runtime context smoke: `pnpm test:docker:session-runtime-context` verifies hidden runtime context transcript persistence plus doctor repair of affected duplicated prompt-rewrite branches.

- Bun global install smoke: `bash scripts/e2e/bun-global-install-smoke.sh` packs the current tree, installs it with `bun install -g` in an isolated home, and verifies `openclaw infer image providers --json` returns bundled image providers instead of hanging. Reuse a prebuilt tarball with `OPENCLAW_BUN_GLOBAL_SMOKE_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host build with `OPENCLAW_BUN_GLOBAL_SMOKE_HOST_BUILD=0`, or copy `dist/` from a built Docker image with `OPENCLAW_BUN_GLOBAL_SMOKE_DIST_IMAGE=openclaw-dockerfile-smoke:local`.

- Installer Docker smoke: `bash scripts/test-install-sh-docker.sh` shares one npm cache across its root, update, and direct-npm containers. Update smoke defaults to npm `latest` as the stable baseline before upgrading to the candidate tarball. Override with `OPENCLAW_INSTALL_SMOKE_UPDATE_BASELINE=2026.4.22` locally, or with the Install Smoke workflow's `update_baseline_version` input on GitHub. Non-root installer checks keep an isolated npm cache so root-owned cache entries do not mask user-local install behavior. Set `OPENCLAW_INSTALL_SMOKE_NPM_CACHE_DIR=/path/to/cache` to reuse the root/update/direct-npm cache across local reruns.