chore(ci): add process CodeQL PR quality guard · openclaw/openclaw@4fc0981

Recent Commits to openclaw:main

vincentkoc · 2026-04-30 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@ on:`
`12`	`12`	`- all`
`13`	`13`	`- channel-runtime-boundary`
`14`	`14`	`- gateway-runtime-boundary`
	`15`	`+ - mcp-process-runtime-boundary`
`15`	`16`	`- plugin-boundary`
`16`	`17`	`- plugin-sdk-package-contract`
`17`	`18`	`- plugin-sdk-reply-runtime`
`@@ -30,9 +31,12 @@ on:`
`30`	`31`	`- "src/gateway/server-methods/**"`
`31`	`32`	`- "src/gateway/server-methods.ts"`
`32`	`33`	`- "src/gateway/server-methods-list.ts"`
	`34`	`+ - "src/infra/outbound/**"`
	`35`	`+ - "src/mcp/**"`
`33`	`36`	`- "src/model-catalog/**"`
`34`	`37`	`- "src/plugin-sdk/**"`
`35`	`38`	`- "src/plugins/**"`
	`39`	`+ - "src/process/**"`
`36`	`40`	`schedule:`
`37`	`41`	`- cron: "30 6 * * *"`
`38`	`42`
`@@ -57,6 +61,7 @@ jobs:`
`57`	`61`	`outputs:`
`58`	`62`	`channel: ${{ steps.detect.outputs.channel }}`
`59`	`63`	`gateway: ${{ steps.detect.outputs.gateway }}`
	`64`	`+mcp_process: ${{ steps.detect.outputs.mcp_process }}`
`60`	`65`	`plugin: ${{ steps.detect.outputs.plugin }}`
`61`	`66`	`plugin_sdk_package: ${{ steps.detect.outputs.plugin_sdk_package }}`
`62`	`67`	`provider: ${{ steps.detect.outputs.provider }}`
`@@ -73,13 +78,15 @@ jobs:`
`73`	`78`
`74`	`79`	`channel=false`
`75`	`80`	`gateway=false`
	`81`	`+ mcp_process=false`
`76`	`82`	`plugin=false`
`77`	`83`	`plugin_sdk_package=false`
`78`	`84`	`provider=false`
`79`	`85`
`80`	`86`	`if [[ "${EVENT_NAME}" != "pull_request" ]]; then`
`81`	`87`	`channel=true`
`82`	`88`	`gateway=true`
	`89`	`+ mcp_process=true`
`83`	`90`	`plugin=true`
`84`	`91`	`plugin_sdk_package=true`
`85`	`92`	`provider=true`
`@@ -89,6 +96,7 @@ jobs:`
`89`	`96`	`.github/codeql/*\|.github/workflows/codeql-critical-quality.yml)`
`90`	`97`	`channel=true`
`91`	`98`	`gateway=true`
	`99`	`+ mcp_process=true`
`92`	`100`	`plugin=true`
`93`	`101`	`plugin_sdk_package=true`
`94`	`102`	`provider=true`
`@@ -99,6 +107,9 @@ jobs:`
`99`	`107`	`src/gateway/method-scopes.ts\|src/gateway/protocol/\|src/gateway/server-methods/\|src/gateway/server-methods.ts\|src/gateway/server-methods-list.ts)`
`100`	`108`	`gateway=true`
`101`	`109`	`;;`
	`110`	`+ src/infra/outbound/\|src/mcp/\|src/process/*)`
	`111`	`+ mcp_process=true`
	`112`	`+ ;;`
`102`	`113`	`src/plugin-sdk/*)`
`103`	`114`	`plugin=true`
`104`	`115`	`plugin_sdk_package=true`
`@@ -123,6 +134,7 @@ jobs:`
`123`	`134`	`{`
`124`	`135`	`echo "channel=${channel}"`
`125`	`136`	`echo "gateway=${gateway}"`
	`137`	`+ echo "mcp_process=${mcp_process}"`
`126`	`138`	`echo "plugin=${plugin}"`
`127`	`139`	`echo "plugin_sdk_package=${plugin_sdk_package}"`
`128`	`140`	`echo "provider=${provider}"`
`@@ -242,7 +254,8 @@ jobs:`
`242`	`254`
`243`	`255`	`mcp-process-runtime-boundary:`
`244`	`256`	`name: Critical Quality (mcp-process-runtime-boundary)`
`245`		`-if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' \|\| inputs.profile == 'all') }}`
	`257`	`+needs: quality-shards`
	`258`	`+if: ${{ needs.quality-shards.outputs.mcp_process == 'true' && (github.event_name != 'pull_request' \|\| !github.event.pull_request.draft) && (github.event_name == 'pull_request' \|\| github.event_name != 'workflow_dispatch' \|\| inputs.profile == 'all' \|\| inputs.profile == 'mcp-process-runtime-boundary') }}`
`246`	`259`	`runs-on: blacksmith-4vcpu-ubuntu-2404`
`247`	`260`	`timeout-minutes: 25`
`248`	`261`	`steps:`

Original file line number	Diff line number	Diff line change
@@ -335,12 +335,12 @@ The pull request guard stays light: it only starts for changes under `.github/ac
`335`	`335`
`336`	`336`	`### Critical Quality categories`
`337`	`337`
`338`		-`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `channel-runtime-boundary`, `gateway-runtime-boundary`, `provider-runtime-boundary`, `plugin-boundary`, and `plugin-sdk-package-contract` shards for channel runtime, gateway protocol/server-method, provider runtime/model catalog, plugin loader, Plugin SDK, or package-contract changes. CodeQL config and quality workflow changes run all five PR quality shards.
	`338`	+`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `channel-runtime-boundary`, `gateway-runtime-boundary`, `mcp-process-runtime-boundary`, `provider-runtime-boundary`, `plugin-boundary`, and `plugin-sdk-package-contract` shards for channel runtime, gateway protocol/server-method, MCP/process/outbound delivery, provider runtime/model catalog, plugin loader, Plugin SDK, or package-contract changes. CodeQL config and quality workflow changes run all six PR quality shards.
`339`	`339`
`340`	`340`	`Manual dispatch accepts:`
`341`	`341`
`342`	`342`	```
`343`		`-profile=all\|channel-runtime-boundary\|gateway-runtime-boundary\|plugin-boundary\|plugin-sdk-package-contract\|plugin-sdk-reply-runtime\|provider-runtime-boundary\|session-diagnostics-boundary`
	`343`	`+profile=all\|channel-runtime-boundary\|gateway-runtime-boundary\|mcp-process-runtime-boundary\|plugin-boundary\|plugin-sdk-package-contract\|plugin-sdk-reply-runtime\|provider-runtime-boundary\|session-diagnostics-boundary`
`344`	`344`	```
`345`	`345`
`346`	`346`	`The narrow profiles are teaching/iteration hooks for running one quality shard in isolation.`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main