include-hidden-files: true

retention-days: 1

- name: Cache dist-runtime build

uses: actions/cache@v5

with:

path: dist-runtime/

key: ${{ runner.os }}-dist-runtime-build-${{ github.sha }}

checks-fast-core:

permissions:

contents: read

group: extension-bundled

- check_name: check-additional-extension-package-boundary

group: extension-package-boundary

- check_name: check-additional-runtime-topology-gateway

group: runtime-topology-gateway

- check_name: check-additional-runtime-topology-architecture

group: runtime-topology-architecture

steps:

- name: Run additional check shard

env:

ADDITIONAL_CHECK_GROUP: ${{ matrix.group }}

RUN_CONTROL_UI_I18N: ${{ needs.preflight.outputs.run_control_ui_i18n }}

OPENCLAW_EXTENSION_BOUNDARY_CONCURRENCY: 6

shell: bash

run: |

run_check "test:extensions:package-boundary:compile" pnpm run test:extensions:package-boundary:compile

run_check "test:extensions:package-boundary:canary" pnpm run test:extensions:package-boundary:canary

;;

runtime-topology-gateway)

if [ "$RUN_CONTROL_UI_I18N" = "true" ]; then

run_check "ui:i18n:check" pnpm ui:i18n:check

fi

run_check "gateway-watch-regression" pnpm test:gateway:watch-regression

;;

runtime-topology-architecture)

run_check "check:architecture" pnpm check:architecture

;;

exit "$failures"

check-additional-runtime-topology-gateway:

permissions:

contents: read

name: "check-additional-runtime-topology-gateway"

needs: [preflight, build-artifacts]

if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check_additional == 'true' && needs.build-artifacts.result == 'success' }}

runs-on: ubuntu-24.04

timeout-minutes: 20

steps:

- name: Checkout

shell: bash

env:

CHECKOUT_REPO: ${{ github.repository }}

CHECKOUT_SHA: ${{ github.sha }}

CHECKOUT_TOKEN: ${{ github.token }}

run: |

set -euo pipefail

workdir="$GITHUB_WORKSPACE"

auth_header="$(printf 'x-access-token:%s' "$CHECKOUT_TOKEN" | base64 | tr -d '\n')"

reset_checkout_dir() {

mkdir -p "$workdir"

find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +

}

checkout_attempt() {

local attempt="$1"

reset_checkout_dir

git init "$workdir" >/dev/null

git config --global --add safe.directory "$workdir"

git -C "$workdir" remote add origin "https://github.com/${CHECKOUT_REPO}"

git -C "$workdir" config gc.auto 0

timeout --signal=TERM 30s git -C "$workdir" \

-c protocol.version=2 \

-c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" \

fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \

"+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1

git -C "$workdir" checkout --force --detach "$CHECKOUT_SHA" || return 1

test -f "$workdir/.github/actions/setup-node-env/action.yml" || return 1

echo "checkout attempt ${attempt}/2 succeeded"

}

for attempt in 1 2; do

if checkout_attempt "$attempt"; then

exit 0

fi

echo "checkout attempt ${attempt}/2 failed"

sleep $((attempt * 5))

done

echo "checkout failed after 2 attempts" >&2

exit 1

- name: Setup Node environment

uses: ./.github/actions/setup-node-env

with:

install-bun: "false"

- name: Restore dist cache

id: gateway-dist-cache

uses: actions/cache@v5

with:

path: dist/

key: ${{ runner.os }}-dist-build-${{ github.sha }}

- name: Download dist artifact

if: steps.gateway-dist-cache.outputs.cache-hit != 'true'

uses: actions/download-artifact@v8

with:

name: dist-build

path: dist/

- name: Restore dist-runtime cache

id: gateway-dist-runtime-cache

uses: actions/cache@v5

with:

path: dist-runtime/

key: ${{ runner.os }}-dist-runtime-build-${{ github.sha }}

- name: Run runtime topology gateway checks

env:

RUN_CONTROL_UI_I18N: ${{ needs.preflight.outputs.run_control_ui_i18n }}

shell: bash

run: |

set -euo pipefail

failures=0

run_check() {

local label="$1"

shift

echo "::group::${label}"

if "$@"; then

echo "[ok] ${label}"

else

echo "::error title=${label} failed::${label} failed"

failures=1

fi

echo "::endgroup::"

}

if [ "$RUN_CONTROL_UI_I18N" = "true" ]; then

run_check "ui:i18n:check" pnpm ui:i18n:check

fi

run_check "gateway-watch-regression" node scripts/check-gateway-watch-regression.mjs --skip-build

exit "$failures"

- name: Upload gateway watch regression artifacts

if: always()

if: always() && matrix.group == 'runtime-topology-gateway'

uses: actions/upload-artifact@v7

with:

name: gateway-watch-regression

permissions:

contents: read

name: "check-additional"

needs: [preflight, check-additional-shard, check-additional-runtime-topology-gateway]

needs: [preflight, check-additional-shard]

if: ${{ !cancelled() && always() && needs.preflight.outputs.run_check_additional == 'true' }}

runs-on: ubuntu-24.04

timeout-minutes: 5

steps:

- name: Verify additional check shards

env:

SHARD_RESULT: ${{ needs.check-additional-shard.result }}

GATEWAY_RESULT: ${{ needs.check-additional-runtime-topology-gateway.result }}

run: |

if [ "$SHARD_RESULT" != "success" ]; then

echo "Additional check shards failed: $SHARD_RESULT" >&2

exit 1

fi

if [ "$GATEWAY_RESULT" != "success" ]; then

echo "Runtime topology gateway check failed: $GATEWAY_RESULT" >&2

exit 1

fi

build-smoke:

permissions: