ci(release): let unified workflow own tags

[steipete]

Summary

• let openclaw/release-workflows/.github/workflows/release-go-cli.yml@v1 create and freeze the annotated release tag
• remove the obsolete local SSH signer allowlist and signed-tag instructions
• retain Discrawl's established archive contents, checksums.txt, native Darwin archives, signing identifier, and openclaw/homebrew-tap formula handoff
• finalize the accumulated additive work as the dated 0.12.0 changelog section

release-go-cli.yml is the only reusable release archetype exposed by @v1, and it matches this repository's Go module plus GoReleaser matrix. nfpm: auto remains binary-only because the current GoReleaser config has no nfpms block.

Validation

• actionlint .github/workflows/release-unified.yml
• GOWORK=off go test ./scripts ./...
• make check
  • module verification and tidiness
  • gofumpt, golangci-lint, vet, staticcheck, gosec, and govulncheck
  • 85.1% coverage and the race suite
  • CLI smoke checks
  • six-platform GoReleaser snapshot
• AutoReview: clean, no accepted/actionable findings

The actual operator behavior will be live-proven by dispatching the merged workflow for 0.12.0; no local release credential or local tag operation is part of that path.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 2:07 PM ET / 18:07 UTC.

ClawSweeper review

What this changes

The branch removes Discrawl’s local SSH signed-tag requirement and signer allowlist, documents workflow-owned tag creation, and records the release-process change for version 0.12.0.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

Keep this collaborator-authored PR open for maintainer review. It is a focused release-process change, but it removes Discrawl’s documented local signed-tag verification gate and relies on an external reusable workflow whose equivalent authorization and tag-freezing guarantees were not available to verify locally.

Priority: P2
Reviewed head: d71c433f3940455361d22423f37eb5cb08d7f995
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and internally consistent, but the shared workflow’s replacement tag-control guarantee needs maintainer-visible verification before merge.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored PR is not subject to the external-contributor proof gate; the relevant evidence is maintainer verification of the shared release-workflow contract.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored PR is not subject to the external-contributor proof gate; the relevant evidence is maintainer verification of the shared release-workflow contract.
Evidence reviewed	5 items	Current release wrapper: Current main delegates to the reusable v1 workflow and explicitly passes require-signed-tag: true; the PR removes that contract input. Current operator trust boundary: Current main requires release operators to create, verify, and push an SSH-signed annotated tag before dispatching the release workflow. Release-model provenance: The shared-pipeline release model and signed-tag instructions date to the shipped migration commit, with the relevant documentation attributed to that commit in current blame output.
Findings	None	None.
Security	Needs attention	Verify the replacement tag authorization boundary: This line removes require-signed-tag; with the local allowlist also deleted, maintainers must confirm that the referenced reusable workflow creates and freezes the requested tag under equivalent authorization before the trust-boundary change lands.

How this fits together

Discrawl releases start with a manual GitHub Actions dispatch that calls an organization-managed reusable workflow. The workflow is responsible for versioning, building the Go CLI, signing and notarizing archives, publishing assets, and handing the formula to Homebrew.

flowchart LR
  A[Release operator] --> B[Manual release dispatch]
  B --> C[Shared release workflow]
  C --> D[Create and freeze version tag]
  D --> E[Build and sign archives]
  E --> F[Publish GitHub release]
  F --> G[Update Homebrew formula]

Loading

Decision needed

Question	Recommendation
Does openclaw/release-workflows/.github/workflows/release-go-cli.yml@v1 provide the approved equivalent of Discrawl’s locally verified SSH-signed annotated-tag gate before this PR removes it?	Confirm shared tag ownership: Confirm that the pinned workflow creates and freezes the requested annotated tag with the expected authorization and release-to-commit audit trail, then merge this cleanup.

Why: The changed authorization and tag-freezing behavior lives in the external reusable workflow rather than this repository. Local inspection proves the outgoing gate but cannot prove the proposed replacement control.

Before merge

• Resolve security concern: Verify the replacement tag authorization boundary - This line removes require-signed-tag; with the local allowlist also deleted, maintainers must confirm that the referenced reusable workflow creates and freezes the requested tag under equivalent authorization before the trust-boundary change lands.
• Resolve merge risk (P1) - Merging removes the locally verified SSH-signed-tag gate. If the pinned reusable workflow does not create and freeze an equivalently authorized annotated tag with an auditable release-to-commit binding, a release could originate from an unintended version point.
• Complete next step (P2) - The remaining blocker is an external reusable-workflow authorization contract that needs maintainer confirmation, not a safe repository-local repair task.

Findings

• [medium] Verify the replacement tag authorization boundary — .github/workflows/release-unified.yml:31

Agent review details

Security

Needs attention: Removing the local signed-tag control is security-sensitive until maintainers verify that the pinned shared workflow provides an equivalent authorized and auditable tag-creation boundary.

Review metrics

Metric	Value	Why it matters
Release surface	4 files affected; 7 added, 9 removed	The PR changes the release wrapper, operator guide, signer material, and changelog without changing runtime code.

Merge-risk options

Maintainer options:

1. Verify reusable-workflow guarantees (recommended)
   Review the pinned shared workflow’s tag creation, authorization, and release-to-commit binding before deleting Discrawl’s local signed-tag gate.
2. Keep the existing verification gate
   Preserve the local signed-tag input and operator instructions until the replacement organization-managed control is documented and approved.
3. Defer the release-model transition
   Pause this cleanup if the shared workflow cannot demonstrate a clear, auditable equivalent tag-ownership guarantee.

Technical review

Best possible solution:

Adopt one organization-managed release path only after maintainers confirm that the pinned reusable workflow provides equivalent tag authorization, tag immutability, and release-to-commit traceability.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is release-process maintenance rather than a user-reported runtime bug. Current source establishes the existing local tag gate, but the organization-managed replacement was unavailable in the checkout to exercise.

Is this the best way to solve the issue?

Unclear: the proposed simplification is appropriate only if the pinned reusable workflow enforces an equivalent authorized, immutable tag contract; that source-level proof was unavailable.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against bd17ef14156b.

Labels

Label changes:

• add P2: The branch changes official release automation and its operator authorization model, with bounded but meaningful publishing impact.
• add merge-risk: 🚨 compatibility: Existing release operators would lose the documented signed-tag preparation and verification path.
• add merge-risk: 🚨 security-boundary: The branch removes a local signing verification gate and relies on the external reusable workflow to enforce its replacement.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This collaborator-authored PR is not subject to the external-contributor proof gate; the relevant evidence is maintainer verification of the shared release-workflow contract.

Label justifications:

• P2: The branch changes official release automation and its operator authorization model, with bounded but meaningful publishing impact.
• merge-risk: 🚨 compatibility: Existing release operators would lose the documented signed-tag preparation and verification path.
• merge-risk: 🚨 security-boundary: The branch removes a local signing verification gate and relies on the external reusable workflow to enforce its replacement.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This collaborator-authored PR is not subject to the external-contributor proof gate; the relevant evidence is maintainer verification of the shared release-workflow contract.

Evidence

Security concerns:

• [medium] Verify the replacement tag authorization boundary — .github/workflows/release-unified.yml:31
  This line removes require-signed-tag; with the local allowlist also deleted, maintainers must confirm that the referenced reusable workflow creates and freezes the requested tag under equivalent authorization before the trust-boundary change lands.
  Confidence: 0.93

What I checked:

• Current release wrapper: Current main delegates to the reusable v1 workflow and explicitly passes require-signed-tag: true; the PR removes that contract input. (.github/workflows/release-unified.yml:21, bd17ef14156b)
• Current operator trust boundary: Current main requires release operators to create, verify, and push an SSH-signed annotated tag before dispatching the release workflow. (docs/RELEASING.md:21, bd17ef14156b)
• Release-model provenance: The shared-pipeline release model and signed-tag instructions date to the shipped migration commit, with the relevant documentation attributed to that commit in current blame output. (docs/RELEASING.md:7, 4f3017c8188d)
• Release containment: The migration commit is contained by v0.11.10 and current main; the proposed branch commit is not contained by current main or any local release tag. (.github/workflows/release-unified.yml:31, 4f3017c8188d)
• External-workflow verification unavailable: Current source and local history were inspected, but the reusable workflow implementation is outside this checkout and deeper local history required missing promisor objects that could not be fetched because GitHub hostname resolution was unavailable.

Likely related people:

• Peter Steinberger: Current release documentation and local file history attribute the shared-pipeline migration and signed-tag contract to this contributor. (role: introduced shared release pipeline; confidence: high; commits: 4f3017c8188d, b1e388a6b484; files: .github/workflows/release-unified.yml, docs/RELEASING.md, .github/release-allowed-signers)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide maintainer-visible confirmation of the pinned reusable workflow’s annotated-tag creation, authorization, freeze, and release-to-commit binding.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

@clawsweeper re-review

The external tag boundary is now maintainer-verified, and Peter explicitly approved this unified model on 2026-08-02.

The pinned openclaw/release-workflows@v1 peels to commit 0b6aef83d05f4c2a73b6f8ab59e8483c4de76572. Its release workflow:

• requires dispatch from the exact protected default-branch head; retries accept only an annotated tag peeling directly to a reachable commit (target resolution);
• creates the annotated tag with the job-scoped contents: write token, while an existing tag must already freeze the exact target SHA (tag freeze);
• checks the peeled tag before creating the draft and binds every verifier attestation to the tag and commit (draft binding);
• rechecks that the frozen tag target did not change immediately before publishing the verified draft (publication binding).

This is the approved replacement authorization and audit boundary. The first merged dispatch for 0.12.0 will also provide live end-to-end proof before closeout.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.