release.yml

name: Publish release

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

env:
  CLAWHUB_OWNER: serpapi

jobs:
  test:
    name: Node ${{ matrix.node-version }}
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        node-version: [22, 24]

    steps:
      - name: Check out the released revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 10.33.1

      - name: Set up Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: pnpm

      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm run lint

      - name: Typecheck
        run: pnpm run typecheck

  build:
    name: Build release distribution
    needs: test
    runs-on: ubuntu-latest

    steps:
      - name: Check out the released revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 10.33.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: pnpm

      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify the release tag matches the package version
        if: github.event_name == 'release'
        shell: bash
        run: |
          package_version="$(node -p "require('./package.json').version")"
          if [[ "${GITHUB_REF_NAME}" != "v${package_version}" ]]; then
            echo "Release tag ${GITHUB_REF_NAME} must equal v${package_version}." >&2
            exit 1
          fi

      - name: Build
        run: pnpm run build

      - name: Pack the release tarball
        # The tarball is only used to verify the exact files ClawHub receives,
        # so it is packed the same way ClawHub packs: `--ignore-scripts`, so a
        # future prepare/prepack script cannot make the two diverge. The
        # compiled output is never rebuilt after this point.
        run: npm pack --ignore-scripts

      - name: Upload the release tarball
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: release-tarball
          path: "*.tgz"
          if-no-files-found: error
          retention-days: 7

      - name: Upload the compiled output
        # ClawHub packs a working directory rather than a tarball, so it needs
        # `dist/` on disk. Reusing this artifact keeps it byte-identical to the
        # verified tarball.
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: compiled-output
          path: dist/
          if-no-files-found: error
          retention-days: 7

  verify:
    name: Verify the built tarball
    needs: build
    runs-on: ubuntu-latest

    steps:
      - name: Check out the released revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Download the release tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: release-tarball
          path: artifact/

      - name: Install the tarball against the supported host
        shell: bash
        run: |
          host_version="$(node -p "require('./package.json').devDependencies.openclaw")"
          mkdir -p "${RUNNER_TEMP}/smoke"
          cd "${RUNNER_TEMP}/smoke"
          npm init -y > /dev/null
          npm pkg set type=module > /dev/null
          npm install --no-audit --no-fund \
            "${GITHUB_WORKSPACE}"/artifact/*.tgz \
            "openclaw@${host_version}"

      - name: Load the plugin entry point
        shell: bash
        run: |
          cd "${RUNNER_TEMP}/smoke"
          node --input-type=module -e '
            const manifest = await import(
              "@serpapi/openclaw-plugin/package.json",
              { with: { type: "json" } }
            );
            const [entry] = manifest.default.openclaw.extensions;
            const plugin = (await import(`@serpapi/openclaw-plugin/${entry.slice(2)}`)).default;
            if (typeof plugin?.register !== "function") {
              throw new Error(`Plugin ${entry} exposes no register() function.`);
            }
            console.log(`Loaded ${plugin.id} (${plugin.name}) from ${entry}.`);
          '

      - name: Install the ClawHub CLI
        run: npm install -g clawhub@latest

      - name: ClawHub validate the packed contents
        # Validate the extracted tarball rather than the repository, so the
        # check runs against the exact files ClawHub receives.
        shell: bash
        run: |
          mkdir -p "${RUNNER_TEMP}/packed"
          tar -xzf artifact/*.tgz -C "${RUNNER_TEMP}/packed"
          clawhub package validate "${RUNNER_TEMP}/packed/package"

  publish-clawhub:
    name: Publish to ClawHub
    # `workflow_dispatch` stops after `verify`: publishing must always come from
    # a published release so the checked-out ref is the release tag.
    if: github.event_name == 'release'
    needs: verify
    runs-on: ubuntu-latest
    environment:
      name: release
      url: https://clawhub.ai/serpapi

    steps:
      - name: Check out the released revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Download the compiled output
        # ClawHub packs the folder with `npm pack --ignore-scripts`, so `dist/`
        # must be on disk before publishing. It is restored from the verified
        # build rather than rebuilt here.
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: compiled-output
          path: dist/

      - name: Install the ClawHub CLI
        run: npm install -g clawhub@latest

      - name: Sign in to ClawHub
        env:
          CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
        run: |
          if [ -z "$CLAWHUB_TOKEN" ]; then
            echo "::error::CLAWHUB_TOKEN secret is required to publish."
            exit 1
          fi
          clawhub login --token "$CLAWHUB_TOKEN"
          clawhub whoami

      - name: ClawHub publish (dry run)
        run: |
          clawhub package publish . \
            --family code-plugin \
            --owner "$CLAWHUB_OWNER" \
            --dry-run

      - name: ClawHub publish
        run: |
          clawhub package publish . \
            --family code-plugin \
            --owner "$CLAWHUB_OWNER"