provenance: mode=max

push: true

prepare_live_test_image:

needs: validate_selected_ref

if: inputs.include_live_suites

runs-on: blacksmith-32vcpu-ubuntu-2404

timeout-minutes: 60

permissions:

contents: read

packages: write

outputs:

live_image: ${{ steps.image.outputs.live_image }}

env:

DOCKER_BUILD_SUMMARY: "false"

DOCKER_BUILD_RECORD_UPLOAD: "false"

steps:

- name: Checkout selected ref

uses: actions/checkout@v6

with:

ref: ${{ needs.validate_selected_ref.outputs.selected_sha }}

fetch-depth: 1

- name: Resolve shared live-test image tag

id: image

shell: bash

env:

SELECTED_SHA: ${{ needs.validate_selected_ref.outputs.selected_sha }}

run: |

set -euo pipefail

repository="${GITHUB_REPOSITORY,,}"

live_image="ghcr.io/${repository}-live-test:${SELECTED_SHA}"

echo "live_image=${live_image}" >> "$GITHUB_OUTPUT"

echo "Shared live-test image: \`${live_image}\`" >> "$GITHUB_STEP_SUMMARY"

- name: Log in to GHCR

uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ github.token }}

- name: Check existing shared live-test image

id: image_exists

shell: bash

run: |

set -euo pipefail

if docker manifest inspect "${{ steps.image.outputs.live_image }}" >/dev/null 2>&1; then

echo "Shared live-test image already exists: ${{ steps.image.outputs.live_image }}"

echo "exists=1" >> "$GITHUB_OUTPUT"

else

echo "exists=0" >> "$GITHUB_OUTPUT"

fi

- name: Setup Docker builder

if: steps.image_exists.outputs.exists != '1'

uses: useblacksmith/setup-docker-builder@ac083cc84672d01c60d5e8561d0a939b697de542 # v1

with:

max-cache-size-mb: 800000

- name: Build and push shared live-test image

if: steps.image_exists.outputs.exists != '1'

uses: useblacksmith/build-push-action@cbd1f60d194a98cb3be5523b15134501eaf0fbf3 # v2

with:

context: .

file: ./Dockerfile

target: build

build-args: |

OPENCLAW_EXTENSIONS=matrix

platforms: linux/amd64

tags: ${{ steps.image.outputs.live_image }}

sbom: true

provenance: mode=max

push: true

validate_live_models_docker:

name: Docker live models (${{ matrix.provider_label }})

needs: validate_selected_ref

needs: [validate_selected_ref, prepare_live_test_image]

if: inputs.include_live_suites && inputs.live_model_providers == ''

runs-on: ubuntu-24.04

runs-on: blacksmith-32vcpu-ubuntu-2404

timeout-minutes: 75

strategy:

fail-fast: false

OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }}

FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }}

OPENCLAW_LIVE_PROVIDERS: ${{ matrix.providers }}

OPENCLAW_LIVE_IMAGE: ${{ needs.prepare_live_test_image.outputs.live_image }}

OPENCLAW_SKIP_DOCKER_BUILD: "1"

OPENCLAW_VITEST_MAX_WORKERS: "2"

steps:

- name: Checkout selected ref

if: contains(matrix.profiles, inputs.release_test_profile)

run: bash scripts/ci-hydrate-live-auth.sh

- name: Log in to GHCR

if: contains(matrix.profiles, inputs.release_test_profile)

uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ github.token }}

- name: Validate provider credential

if: contains(matrix.profiles, inputs.release_test_profile)

shell: bash

validate_live_models_docker_targeted:

name: Docker live models (selected providers)

needs: validate_selected_ref

needs: [validate_selected_ref, prepare_live_test_image]

if: inputs.include_live_suites && inputs.live_model_providers != ''

runs-on: ubuntu-24.04

runs-on: blacksmith-32vcpu-ubuntu-2404

timeout-minutes: 75

env:

OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }}

FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }}

REQUESTED_LIVE_MODEL_PROVIDERS: ${{ inputs.live_model_providers }}

OPENCLAW_LIVE_IMAGE: ${{ needs.prepare_live_test_image.outputs.live_image }}

OPENCLAW_SKIP_DOCKER_BUILD: "1"

OPENCLAW_VITEST_MAX_WORKERS: "2"

steps:

- name: Checkout selected ref

- name: Hydrate live auth/profile inputs

run: bash scripts/ci-hydrate-live-auth.sh

- name: Log in to GHCR

uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ github.token }}

- name: Validate provider credentials

shell: bash

run: |

timeout_minutes: 90

profile_env_only: false

profiles: full

env:

OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}

ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

ANTHROPIC_API_TOKEN: ${{ secrets.ANTHROPIC_API_TOKEN }}

ANTHROPIC_API_KEY_OLD: ${{ secrets.ANTHROPIC_API_KEY_OLD }}

BYTEPLUS_API_KEY: ${{ secrets.BYTEPLUS_API_KEY }}

CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}

DEEPINFRA_API_KEY: ${{ secrets.DEEPINFRA_API_KEY }}

DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }}

GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}

KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}

MODELSTUDIO_API_KEY: ${{ secrets.MODELSTUDIO_API_KEY }}

MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}

MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}

MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}

OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}

OPENCODE_ZEN_API_KEY: ${{ secrets.OPENCODE_ZEN_API_KEY }}

OPENCLAW_LIVE_BROWSER_CDP_URL: ${{ secrets.OPENCLAW_LIVE_BROWSER_CDP_URL }}

OPENCLAW_LIVE_SETUP_TOKEN: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN }}

OPENCLAW_LIVE_SETUP_TOKEN_MODEL: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_MODEL }}

OPENCLAW_LIVE_SETUP_TOKEN_PROFILE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_PROFILE }}

OPENCLAW_LIVE_SETUP_TOKEN_VALUE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_VALUE }}

GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}

GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}

OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}

QWEN_API_KEY: ${{ secrets.QWEN_API_KEY }}

FAL_KEY: ${{ secrets.FAL_KEY }}

RUNWAY_API_KEY: ${{ secrets.RUNWAY_API_KEY }}

DEEPGRAM_API_KEY: ${{ secrets.DEEPGRAM_API_KEY }}

TOGETHER_API_KEY: ${{ secrets.TOGETHER_API_KEY }}

VYDRA_API_KEY: ${{ secrets.VYDRA_API_KEY }}

XAI_API_KEY: ${{ secrets.XAI_API_KEY }}

ZAI_API_KEY: ${{ secrets.ZAI_API_KEY }}

Z_AI_API_KEY: ${{ secrets.Z_AI_API_KEY }}

BYTEPLUS_ACCESS_KEY_ID: ${{ secrets.BYTEPLUS_ACCESS_KEY_ID }}

BYTEPLUS_SECRET_ACCESS_KEY: ${{ secrets.BYTEPLUS_SECRET_ACCESS_KEY }}

CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

OPENCLAW_CODEX_AUTH_JSON: ${{ secrets.OPENCLAW_CODEX_AUTH_JSON }}

OPENCLAW_CODEX_CONFIG_TOML: ${{ secrets.OPENCLAW_CODEX_CONFIG_TOML }}

OPENCLAW_CLAUDE_JSON: ${{ secrets.OPENCLAW_CLAUDE_JSON }}

OPENCLAW_CLAUDE_CREDENTIALS_JSON: ${{ secrets.OPENCLAW_CLAUDE_CREDENTIALS_JSON }}

OPENCLAW_CLAUDE_SETTINGS_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_JSON }}

OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON }}

OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }}

FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }}

OPENCLAW_LIVE_VIDEO_GENERATION_SKIP_PROVIDERS: ""

OPENCLAW_LIVE_VYDRA_VIDEO: "1"

OPENCLAW_VITEST_MAX_WORKERS: "2"

steps:

- name: Checkout selected ref

if: contains(matrix.profiles, inputs.release_test_profile)

uses: actions/checkout@v6

with:

ref: ${{ needs.validate_selected_ref.outputs.selected_sha }}

fetch-depth: 1

- name: Checkout trusted live shard harness

if: contains(matrix.profiles, inputs.release_test_profile)

uses: actions/checkout@v6

with:

ref: ${{ github.sha }}

fetch-depth: 1

path: .release-harness

- name: Setup Node environment

if: contains(matrix.profiles, inputs.release_test_profile)

uses: ./.github/actions/setup-node-env

with:

node-version: ${{ env.NODE_VERSION }}

pnpm-version: ${{ env.PNPM_VERSION }}

install-bun: "true"

- name: Hydrate live auth/profile inputs

if: contains(matrix.profiles, inputs.release_test_profile)

run: bash scripts/ci-hydrate-live-auth.sh

- name: Configure suite-specific env

if: contains(matrix.profiles, inputs.release_test_profile)

shell: bash

run: |

set -euo pipefail

if [[ "${{ matrix.profile_env_only }}" == "true" ]]; then

echo "OPENCLAW_DOCKER_PROFILE_ENV_ONLY=1" >> "$GITHUB_ENV"

fi

case "${{ matrix.suite_id }}" in

live-cli-backend-docker)

echo "OPENCLAW_LIVE_CLI_BACKEND_MODEL=codex-cli/gpt-5.5" >> "$GITHUB_ENV"

# Keep the release-blocking CI lane on Codex API-key auth. The

# staged auth-file path remains supported for local maintainer

# reruns, but it can hang on stale subscription/session state in

# an otherwise healthy release run.

echo "OPENCLAW_LIVE_CLI_BACKEND_AUTH=api-key" >> "$GITHUB_ENV"

# Replace the staged config.toml with a minimal CI-safe config so

# the repo stays trusted for MCP/tool use without inheriting

# maintainer-local provider/profile overrides that do not exist

# inside CI.

# Codex's workspace-write sandbox relies on user namespaces that

# this Docker lane does not provide, so run Codex unsandboxed

# inside the already-isolated container to keep MCP cron/tool

# execution representative instead of failing on nested sandbox

# setup.

echo 'OPENCLAW_LIVE_CLI_BACKEND_ARGS=["exec","--json","--color","never","--sandbox","danger-full-access","--skip-git-repo-check"]' >> "$GITHUB_ENV"

echo 'OPENCLAW_LIVE_CLI_BACKEND_RESUME_ARGS=["exec","resume","{sessionId}","-c","sandbox_mode=\"danger-full-access\"","--skip-git-repo-check"]' >> "$GITHUB_ENV"

echo "OPENCLAW_LIVE_CLI_BACKEND_DEBUG=1" >> "$GITHUB_ENV"

echo "OPENCLAW_CLI_BACKEND_LOG_OUTPUT=1" >> "$GITHUB_ENV"

echo "OPENCLAW_TEST_CONSOLE=1" >> "$GITHUB_ENV"

echo "OPENCLAW_LIVE_CLI_BACKEND_USE_CI_SAFE_CODEX_CONFIG=1" >> "$GITHUB_ENV"

;;

live-codex-harness-docker)

# Keep CI on the API-key path for now. The staged Codex auth secret

# is currently stale, but the wrapper still supports codex-auth for

# local maintainer reruns without changing Peter's flow.

echo "OPENCLAW_LIVE_CODEX_HARNESS_AUTH=api-key" >> "$GITHUB_ENV"

echo "OPENCLAW_LIVE_CODEX_HARNESS_DEBUG=1" >> "$GITHUB_ENV"

echo "OPENCLAW_CLI_BACKEND_LOG_OUTPUT=1" >> "$GITHUB_ENV"

echo "OPENCLAW_TEST_CONSOLE=1" >> "$GITHUB_ENV"

;;

live-acp-bind-docker)

if [[ -n "${GEMINI_API_KEY:-}" || -n "${GOOGLE_API_KEY:-}" ]]; then

echo "OPENCLAW_LIVE_ACP_BIND_AGENTS=claude,codex,gemini" >> "$GITHUB_ENV"

else

# The hydrated Gemini settings file only selects Gemini CLI auth

# mode. CI still needs a usable Gemini or Google API key before

# ACP bind can initialize a Gemini session.

echo "OPENCLAW_LIVE_ACP_BIND_AGENTS=claude,codex" >> "$GITHUB_ENV"

fi

;;

esac

- name: Run ${{ matrix.label }}

if: contains(matrix.profiles, inputs.release_test_profile)

run: ${{ matrix.command }}

validate_live_docker_provider_suites:

name: Docker live suites (${{ matrix.label }})

needs: [validate_selected_ref, prepare_live_test_image]

if: inputs.include_live_suites && !inputs.live_models_only

runs-on: blacksmith-32vcpu-ubuntu-2404

timeout-minutes: ${{ matrix.timeout_minutes }}

strategy:

fail-fast: false

matrix:

include:

- suite_id: live-gateway-docker

label: Docker live gateway

command: OPENCLAW_LIVE_DOCKER_REPO_ROOT="$GITHUB_WORKSPACE" bash .release-harness/scripts/test-live-gateway-models-docker.sh

OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON }}

OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }}

FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }}

OPENCLAW_LIVE_IMAGE: ${{ needs.prepare_live_test_image.outputs.live_image }}

OPENCLAW_SKIP_DOCKER_BUILD: "1"

OPENCLAW_LIVE_VIDEO_GENERATION_SKIP_PROVIDERS: ""

OPENCLAW_LIVE_VYDRA_VIDEO: "1"

OPENCLAW_VITEST_MAX_WORKERS: "2"

if: contains(matrix.profiles, inputs.release_test_profile)

run: bash scripts/ci-hydrate-live-auth.sh

- name: Log in to GHCR

if: contains(matrix.profiles, inputs.release_test_profile)

uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4

with:

registry: ghcr.io

username: ${{ github.actor }}

password: ${{ github.token }}

- name: Configure suite-specific env

if: contains(matrix.profiles, inputs.release_test_profile)

shell: bash

case "${{ matrix.suite_id }}" in

live-cli-backend-docker)

echo "OPENCLAW_LIVE_CLI_BACKEND_MODEL=codex-cli/gpt-5.5" >> "$GITHUB_ENV"

# Keep the release-blocking CI lane on Codex API-key auth. The

# staged auth-file path remains supported for local maintainer

# reruns, but it can hang on stale subscription/session state in

# an otherwise healthy release run.

echo "OPENCLAW_LIVE_CLI_BACKEND_AUTH=api-key" >> "$GITHUB_ENV"

# Replace the staged config.toml with a minimal CI-safe config so

# the repo stays trusted for MCP/tool use without inheriting

# maintainer-local provider/profile overrides that do not exist

# inside CI.

# Codex's workspace-write sandbox relies on user namespaces that

# this Docker lane does not provide, so run Codex unsandboxed

# inside the already-isolated container to keep MCP cron/tool

# execution representative instead of failing on nested sandbox

# setup.

echo 'OPENCLAW_LIVE_CLI_BACKEND_ARGS=["exec","--json","--color","never","--sandbox","danger-full-access","--skip-git-repo-check"]' >> "$GITHUB_ENV"

echo 'OPENCLAW_LIVE_CLI_BACKEND_RESUME_ARGS=["exec","resume","{sessionId}","-c","sandbox_mode=\"danger-full-access\"","--skip-git-repo-check"]' >> "$GITHUB_ENV"

echo "OPENCLAW_LIVE_CLI_BACKEND_DEBUG=1" >> "$GITHUB_ENV"

echo "OPENCLAW_LIVE_CLI_BACKEND_USE_CI_SAFE_CODEX_CONFIG=1" >> "$GITHUB_ENV"

;;

live-codex-harness-docker)

# Keep CI on the API-key path for now. The staged Codex auth secret

# is currently stale, but the wrapper still supports codex-auth for

# local maintainer reruns without changing Peter's flow.

echo "OPENCLAW_LIVE_CODEX_HARNESS_AUTH=api-key" >> "$GITHUB_ENV"

echo "OPENCLAW_LIVE_CODEX_HARNESS_DEBUG=1" >> "$GITHUB_ENV"

echo "OPENCLAW_CLI_BACKEND_LOG_OUTPUT=1" >> "$GITHUB_ENV"

if [[ -n "${GEMINI_API_KEY:-}" || -n "${GOOGLE_API_KEY:-}" ]]; then

echo "OPENCLAW_LIVE_ACP_BIND_AGENTS=claude,codex,gemini" >> "$GITHUB_ENV"

else

# The hydrated Gemini settings file only selects Gemini CLI auth

# mode. CI still needs a usable Gemini or Google API key before

# ACP bind can initialize a Gemini session.

echo "OPENCLAW_LIVE_ACP_BIND_AGENTS=claude,codex" >> "$GITHUB_ENV"

fi

;;