From 0f7fbfa0039f1358164dc2a503d8dfffa335d42e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Wed, 15 Jul 2026 17:41:43 +0100 Subject: [PATCH] fix(release): bind bootstrap publish workflow identity --- .github/workflows/plugin-clawhub-new.yml | 4 ++++ test/scripts/plugin-clawhub-new-workflow.test.ts | 2 ++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/plugin-clawhub-new.yml b/.github/workflows/plugin-clawhub-new.yml index 2b5cc7601b66..8901e5ad40b5 100644 --- a/.github/workflows/plugin-clawhub-new.yml +++ b/.github/workflows/plugin-clawhub-new.yml @@ -823,6 +823,8 @@ jobs: ARTIFACT_SIZE: ${{ needs.pack_bootstrap_plugins.outputs.artifact_size }} GH_TOKEN: ${{ github.token }} TARGET_SHA: ${{ needs.resolve_bootstrap_plan.outputs.ref_revision }} + WORKFLOW_HEAD_BRANCH: ${{ github.ref_name }} + WORKFLOW_REF: ${{ github.ref }} WORKFLOW_SHA: ${{ github.sha }} CLAWHUB_TOOLCHAIN_INTEGRITY: ${{ steps.clawhub_cli.outputs.integrity }} CLAWHUB_TOOLCHAIN_SHA256: ${{ steps.clawhub_cli.outputs.lock_sha256 }} @@ -844,6 +846,8 @@ jobs: --run-attempt "${ARTIFACT_RUN_ATTEMPT}" \ --run-id "${ARTIFACT_RUN_ID}" \ --target-sha "${TARGET_SHA}" \ + --workflow-head-branch "${WORKFLOW_HEAD_BRANCH}" \ + --workflow-ref "${WORKFLOW_REF}" \ --workflow-sha "${WORKFLOW_SHA}" - name: Rehash immutable ClawHub bootstrap artifacts diff --git a/test/scripts/plugin-clawhub-new-workflow.test.ts b/test/scripts/plugin-clawhub-new-workflow.test.ts index a157bfba50e8..8a2e53ca4ef3 100644 --- a/test/scripts/plugin-clawhub-new-workflow.test.ts +++ b/test/scripts/plugin-clawhub-new-workflow.test.ts @@ -256,6 +256,8 @@ describe("Plugin ClawHub New workflow", () => { expect(binding).toContain("--clawhub-toolchain-integrity"); expect(binding).toContain("--clawhub-toolchain-sha256"); expect(binding).toContain("--clawhub-toolchain-version"); + expect(binding).toContain('--workflow-head-branch "${WORKFLOW_HEAD_BRANCH}"'); + expect(binding).toContain('--workflow-ref "${WORKFLOW_REF}"'); }); it("rehashes and validates tgz identity before exposing the token", () => {