docs: clarify package guard policy · openclaw/openclaw@724160b
steipete
·
2026-05-31
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -211,6 +211,7 @@ Skills own workflows; root owns hard policy and routing.
|
211 | 211 | - Never commit real phone numbers, videos, credentials, live config. |
212 | 212 | - Secrets: channel/provider creds in `~/.openclaw/credentials/`; model auth profiles in `~/.openclaw/agents/<agentId>/agent/auth-profiles.json`. |
213 | 213 | - Dependency patches/overrides/vendor changes need explicit approval. `pnpm-workspace.yaml` patched dependencies use exact versions only. |
| 214 | +- Release/package guards: no hard-coded retired-package denylists; use generic artifact/dependency checks or fix build source. |
214 | 215 | - Lockfiles/shrinkwrap are security surface: review `pnpm-lock.yaml`, `npm-shrinkwrap.json`, `package-lock.json`; root/plugin npm packages ship shrinkwrap, not package-lock. |
215 | 216 | - Carbon pins owner-only: do not change `@buape/carbon` unless Shadow (`@thewilloftheshadow`, verified by `gh`) asks. |
216 | 217 | - Releases/publish/version bumps need explicit approval. Use `$release-openclaw-maintainer`. |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
