Support/openclaw - #30
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7920b291c4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| push: | ||
| branches: | ||
| - master | ||
| paths: | ||
| - "packages/cli/**" |
There was a problem hiding this comment.
When a PR that changes packages/cli/** is merged into master, GitHub emits both the pull_request: closed event configured above and this push event. GitHub documents that a merged PR's GITHUB_REF is the target branch ref, so both runs also share the concurrency key from lines 21-23 (GitHub Docs). Depending on event ordering, the PR run can cancel a push run while it is publishing, or the push run can execute afterward and attempt to publish the same immutable npm and ClawHub versions again. Keep only one publish trigger, or make one event validation-only.
Useful? React with 👍 / 👎.
| - name: Configure ClawHub token fallback | ||
| if: env.CLAWHUB_TOKEN != '' | ||
| run: pnpm dlx clawhub@0.18.0 login --token "$CLAWHUB_TOKEN" --no-browser |
There was a problem hiding this comment.
When CLAWHUB_TOKEN is intentionally omitted as allowed by the new README's OIDC guidance, this conditional skips the only login step and the subsequent ClawHub publish runs unauthenticated. The official ClawHub workflow documentation explicitly states that tokenless trusted publishing works only for workflow_dispatch; other trusted release events require clawhub_token (ClawHub CLI docs). This workflow has only push and pull_request: closed triggers, so id-token: write is not a usable fallback here. Require CLAWHUB_TOKEN, or move tokenless publishing to a supported dispatch flow.
Useful? React with 👍 / 👎.
No description provided.