- name: Audit production dependencies

run: node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high

# Warm the lockfile- and pnpm-pinned store once before Linux Node shards fan out.

# On a cold key this job owns the save, so later shards restore the exact key.

pnpm-store-warmup:

permissions:

contents: read

needs: [preflight]

if: needs.preflight.outputs.run_node == 'true' || needs.preflight.outputs.run_check_docs == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20

steps:

- name: Checkout

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}

run: |

set -euo pipefail

workdir="$GITHUB_WORKSPACE"

reset_checkout_dir() {

mkdir -p "$workdir"

find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +

}

checkout_attempt() {

local attempt="$1"

reset_checkout_dir

git init "$workdir" >/dev/null

git config --global --add safe.directory "$workdir"

git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}.git"

git -C "$workdir" config gc.auto 0

timeout --signal=TERM --kill-after=10s 30s git -C "$workdir" \

-c protocol.version=2 \

fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \

"+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1

git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1

test -f "$workdir/.github/actions/setup-node-env/action.yml" || return 1

echo "checkout attempt ${attempt}/5 succeeded"

}

for attempt in 1 2 3 4 5; do

if checkout_attempt "$attempt"; then

exit 0

fi

echo "checkout attempt ${attempt}/5 failed"

sleep $((attempt * 5))

done

echo "checkout failed after 5 attempts" >&2

exit 1

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

install-bun: "false"

save-actions-cache: "true"

# Build dist once for Node-relevant changes and share it with downstream jobs.

# Keep this overlapping with the fast correctness lanes so green PRs get heavy

# test/build feedback sooner instead of waiting behind a full `check` pass.

build-artifacts:

permissions:

contents: read

needs: [preflight]

needs: [preflight, pnpm-store-warmup]

if: needs.preflight.outputs.run_build_artifacts == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20

permissions:

contents: read

name: ${{ matrix.check_name }}

needs: [preflight]

needs: [preflight, pnpm-store-warmup]

if: needs.preflight.outputs.run_checks_fast_core == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 60

permissions:

contents: read

name: ${{ matrix.checkName }}

needs: [preflight]

needs: [preflight, pnpm-store-warmup]

if: needs.preflight.outputs.run_plugin_contracts_shards == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 60

permissions:

contents: read

name: ${{ matrix.checkName }}

needs: [preflight]

needs: [preflight, pnpm-store-warmup]

if: needs.preflight.outputs.run_checks_fast == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 60

permissions:

contents: read

name: ${{ matrix.check_name }}

needs: [preflight]

needs: [preflight, pnpm-store-warmup]

if: needs.preflight.outputs.run_checks_node_core_nondist == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && (matrix.runner || 'ubuntu-24.04') || 'ubuntu-24.04') }}

timeout-minutes: 60

permissions:

contents: read

name: ${{ matrix.check_name }}

needs: [preflight]

if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check == 'true' }}

needs: [preflight, pnpm-store-warmup]

if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check == 'true' && needs.pnpm-store-warmup.result == 'success' }}

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && matrix.runner || 'ubuntu-24.04') }}

timeout-minutes: 20

strategy:

permissions:

contents: read

name: ${{ matrix.check_name }}

needs: [preflight]

if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check_additional == 'true' }}

needs: [preflight, pnpm-store-warmup]

if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check_additional == 'true' && needs.pnpm-store-warmup.result == 'success' }}

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20

strategy:

check-docs:

permissions:

contents: read

needs: [preflight]

needs: [preflight, pnpm-store-warmup]

if: needs.preflight.outputs.run_check_docs == 'true'

runs-on: ${{ github.event_name == 'workflow_dispatch' && 'ubuntu-24.04' || (github.repository == 'openclaw/openclaw' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04') }}

timeout-minutes: 20