Skip to content

Commit ada01b8

Browse files
bussyjdbussyjd
authored
Merge pull request #143 from ObolNetwork/feat/openclaw-ci
ci(openclaw): Docker image build workflow with Renovate auto-bump
2 parents 79d4b99 + e27de58 commit ada01b8

3 files changed

Lines changed: 149 additions & 0 deletions

File tree

‎.github/workflows/docker-publish-openclaw.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
name: Build and Publish OpenClaw Image
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- integration-okr-1 # TODO: remove after testing — limit to main only
8+
- feat/openclaw-ci # TODO: remove after testing — limit to main only
9+
paths:
10+
- 'internal/openclaw/OPENCLAW_VERSION'
11+
workflow_dispatch:
12+
inputs:
13+
version:
14+
description: 'OpenClaw version to build (e.g. v2026.2.3)'
15+
required: false
16+
type: string
17+
18+
env:
19+
REGISTRY: ghcr.io
20+
IMAGE_NAME: obolnetwork/openclaw
21+
22+
jobs:
23+
build-and-push:
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read
27+
packages: write
28+
29+
steps:
30+
- name: Checkout obol-stack
31+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
32+
33+
- name: Read pinned version
34+
id: version
35+
run: |
36+
if [ -n "${{ github.event.inputs.version }}" ]; then
37+
VERSION="${{ github.event.inputs.version }}"
38+
else
39+
VERSION=$(grep -v '^#' internal/openclaw/OPENCLAW_VERSION | tr -d '[:space:]')
40+
fi
41+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
42+
echo "Building OpenClaw $VERSION"
43+
44+
- name: Checkout upstream OpenClaw
45+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
46+
with:
47+
repository: openclaw/openclaw
48+
ref: ${{ steps.version.outputs.version }}
49+
path: openclaw-src
50+
51+
- name: Set up Docker Buildx
52+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
53+
54+
- name: Set up QEMU
55+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
56+
57+
- name: Login to GitHub Container Registry
58+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
59+
with:
60+
registry: ${{ env.REGISTRY }}
61+
username: ${{ github.actor }}
62+
password: ${{ secrets.GITHUB_TOKEN }}
63+
64+
- name: Extract metadata
65+
id: meta
66+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
67+
with:
68+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
69+
tags: |
70+
type=semver,pattern={{version}},value=${{ steps.version.outputs.version }}
71+
type=semver,pattern={{major}}.{{minor}},value=${{ steps.version.outputs.version }}
72+
type=sha,prefix=
73+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
74+
labels: |
75+
org.opencontainers.image.title=OpenClaw
76+
org.opencontainers.image.description=AI agent gateway for Obol Stack
77+
org.opencontainers.image.vendor=Obol Network
78+
org.opencontainers.image.source=https://github.com/openclaw/openclaw
79+
org.opencontainers.image.version=${{ steps.version.outputs.version }}
80+
81+
- name: Build and push Docker image
82+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
83+
with:
84+
context: openclaw-src
85+
platforms: linux/amd64,linux/arm64
86+
push: true
87+
tags: ${{ steps.meta.outputs.tags }}
88+
labels: ${{ steps.meta.outputs.labels }}
89+
cache-from: type=gha
90+
cache-to: type=gha,mode=max
91+
provenance: true
92+
sbom: true
93+
94+
security-scan:
95+
needs: build-and-push
96+
runs-on: ubuntu-latest
97+
permissions:
98+
security-events: write
99+
100+
steps:
101+
- name: Read pinned version
102+
id: version
103+
run: |
104+
# Re-derive for the scan job
105+
echo "Scanning latest pushed image"
106+
107+
- name: Run Trivy vulnerability scanner
108+
uses: aquasecurity/trivy-action@22438a435773de8c97dc0958cc0b823c45b064ac # master
109+
with:
110+
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
111+
format: 'sarif'
112+
output: 'trivy-results.sarif'
113+
severity: 'CRITICAL,HIGH'
114+
115+
- name: Upload Trivy scan results to GitHub Security tab
116+
uses: github/codeql-action/upload-sarif@b13d724d35ff0a814e21683638ed68ed34cf53d1 # main
117+
with:
118+
sarif_file: 'trivy-results.sarif'
119+
if: always()

‎internal/openclaw/OPENCLAW_VERSION‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# renovate: datasource=github-releases depName=openclaw/openclaw
2+
# Pins the upstream OpenClaw version to build and publish.
3+
v2026.2.9

‎renovate.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,17 @@
3333
"datasourceTemplate": "github-releases",
3434
"depNameTemplate": "kubernetes-sigs/gateway-api",
3535
"versioningTemplate": "semver"
36+
},
37+
{
38+
"customType": "regex",
39+
"description": "Update OpenClaw version from upstream GitHub releases",
40+
"matchStrings": [
41+
"#\\s*renovate:\\s*datasource=(?<datasource>.*?)\\s+depName=(?<depName>.*?)\\n(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"
42+
],
43+
"fileMatch": [
44+
"^internal/openclaw/OPENCLAW_VERSION$"
45+
],
46+
"versioningTemplate": "semver"
3647
}
3748
],
3849
"packageRules": [
@@ -89,6 +100,22 @@
89100
],
90101
"dependencyDashboardApproval": true,
91102
"prBodyTemplate": "⚠️ **MAJOR VERSION UPDATE** ⚠️\n\nThis PR updates **obol-stack-front-end** from `{{currentVersion}}` to `{{newVersion}}`.\n\n### ⚠️ Breaking Changes Expected\n\nMajor version updates may include breaking changes. Please review the release notes carefully.\n\n### Release Notes\n\n{{{changelog}}}\n\n### Migration Checklist\n- [ ] Review breaking changes in release notes\n- [ ] Test the new version in staging environment\n- [ ] Update any integration code if needed\n- [ ] Verify deployment scripts still work\n\n---\n**⚠️ This PR requires manual approval due to major version change**\n**Auto-generated by Renovate Bot**"
103+
},
104+
{
105+
"description": "Group OpenClaw updates",
106+
"matchDatasources": [
107+
"github-releases"
108+
],
109+
"matchPackageNames": [
110+
"openclaw/openclaw"
111+
],
112+
"labels": [
113+
"renovate/openclaw"
114+
],
115+
"schedule": [
116+
"every hour"
117+
],
118+
"groupName": "OpenClaw updates"
92119
}
93120
]
94121
}

0 commit comments

Comments
 (0)