ci: add workflow to check for new OpenClaw releases#675
ci: add workflow to check for new OpenClaw releases#675pandemicsyn wants to merge 6 commits intomainfrom
Conversation
Scheduled every 12 hours. When a new stable (non-beta) openclaw release is detected that differs from the version pinned in kiloclaw/Dockerfile and is less than 24 hours old: - POSTs to the openclaw-bump webhook - Sends a Slack notification with current/new versions and release link
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Code Review SummaryStatus: No New Issues Found | Recommendation: Address existing comments before merge OverviewAll issues in this PR have already been flagged by prior reviewers. No additional issues were found during this review pass. The existing inline comments cover:
Files Reviewed (1 file)
|
- Move step output interpolations to env vars to prevent shell injection from external openclaw/openclaw tag names - Validate extracted version matches expected numeric format - Add guards with descriptive errors for grep/API failures
|
|
||
| on: | ||
| schedule: | ||
| - cron: '0 */12 * * *' # Every 12 hours (midnight and noon UTC) |
There was a problem hiding this comment.
SUGGESTION: Potential duplicate notifications per release
The workflow runs every 12 hours (line 5) but the age gate on line 69 allows releases up to 24 hours old. This means a single new release can trigger the webhook + Slack notification twice — once in each 12-hour window.
If the webhook endpoint is not idempotent, this could cause duplicate processing. And Slack will receive two identical notifications. Consider either:
- Reducing the age threshold to 12 hours to match the schedule interval, or
- Adding state (e.g., a cache key or artifact) to track whether a notification was already sent for a given version.
There was a problem hiding this comment.
rather have 2 than 0 if the webhook doesn't fire, and we can always add instructions on the webhook agent side to check for other PRs
- Fail with descriptive error if tag date API call returns empty - Reduce age threshold from 24h to 12h to match cron interval, preventing duplicate notifications per release
The webhook endpoint is idempotent, so duplicate calls are harmless. A 24h window provides better coverage in case the first notification fails to produce a PR.
- Reference OPENCLAW_BUMP_WEBHOOK_URL secret instead of hardcoding URL - Add -o /dev/null to curl to prevent response body leaking to logs
Prevents a webhook outage from blocking the Slack notification.
2 participants
Summary
Adds a scheduled GitHub Actions workflow (
.github/workflows/bump-openclaw.yml) that checks for new stable OpenClaw releases every 12 hours.When a new non-beta release is detected that:
kiloclaw/DockerfileIt will:
openclaw-bumpwebhook athooks.kilosessions.aiRequired secrets
KILOCLAW_GITHUB_WEBHOOK_TRIGGER_TOKEN— used asx-webhook-secretheader for the webhook POSTDEPLOY_NOTIFY_SLACK_WEBHOOK_URL— already exists (used by deploy-kiloclaw workflow)