@@ -100,6 +100,26 @@ Use this skill for release and publish-time workflow. Load `$release-private` if
|
100 | 100 | - `dev`: moving head on `main` |
101 | 101 | - When using a beta Git tag, publish npm with the matching beta version suffix so the plain version is not consumed or blocked |
102 | 102 | |
| 103 | +## Close stable releases on main |
| 104 | + |
| 105 | +Stable publication is not complete until `main` carries the actual shipped release state. |
| 106 | + |
| 107 | +1. Start from fresh latest `main`. Audit `release/YYYY.M.PATCH` against it and |
| 108 | + forward-port real fixes that are absent from `main`. Do not blindly merge |
| 109 | + release-only compatibility, test, or validation adapters into newer `main`. |
| 110 | +2. Set `main` to the shipped stable version, not a speculative next train. Run |
| 111 | +`pnpm release:prep` after the root version change, then |
| 112 | +`pnpm deps:shrinkwrap:generate`. |
| 113 | +3. Make `CHANGELOG.md`'s `## YYYY.M.PATCH` section on `main` exactly match the |
| 114 | + tagged release branch. Include the stable `appcast.xml` update when the mac |
| 115 | + release published one. |
| 116 | +4. Do not add `YYYY.M.PATCH+1`, a beta version, or an empty future changelog |
| 117 | + section to `main` until the operator explicitly starts that release train. |
| 118 | +5. Run `pnpm release:generated:check`, `pnpm deps:shrinkwrap:check`, and |
| 119 | +`OPENCLAW_TESTBOX=1 pnpm check:changed`. Push, then verify `origin/main` |
| 120 | + contains the shipped version and changelog before calling the stable release |
| 121 | + done. |
| 122 | + |
103 | 123 | ## Handle versions and release files consistently |
104 | 124 | |
105 | 125 | - Version locations include: |
@@ -778,13 +798,13 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts <published-version>
|
778 | 798 | and `.dSYM.zip` artifacts to the existing GitHub release in |
779 | 799 | `openclaw/openclaw`. |
780 | 800 | 32. For stable releases, download `macos-appcast-<tag>` from the successful |
781 | | - private mac run, update `appcast.xml` on `main`, and verify the feed. Merge |
782 | | -or cherry-pick release branch changes back to `main` after stable succeeds. |
| 801 | + private mac run, update `appcast.xml` on `main`, verify the feed, then |
| 802 | +complete the **Close stable releases on main** gate. |
783 | 803 | 33. For beta releases, publish the mac assets only when intentionally requested; |
784 | 804 | expect no shared production |
785 | 805 | `appcast.xml` artifact and do not update the shared production feed unless a |
786 | 806 | separate beta feed exists. |
787 | | -34. After publish, verify npm and the attached release artifacts. |
| 807 | +34. After stable main closeout, verify npm and the attached release artifacts. |
788 | 808 | |
789 | 809 | ## GHSA advisory work |
790 | 810 | |
|
