clawpatch-release

name	clawpatch-release
description	Release the clawpatch TypeScript CLI to npm and GitHub. Use when asked to publish, ship, or verify a clawpatch version: version/changelog prep, local proof, CI/CodeQL watch, npm publish, GitHub tag/release, release verification, and post-release changelog bump.

Clawpatch Release

Scope

Release ~/Projects/clawpatch as the public npm package clawpatch.

Use $npm and $one-password rules for registry auth. Keep all op and npm secret work inside one persistent tmux session and temp npmrc. Never print tokens, passwords, or OTPs.

Workflow

1. Start clean on main.

   • cd ~/Projects/clawpatch
   • git status --short --branch
   • git pull --ff-only
   • Confirm target version is not already tagged or released: git tag --list "vX.Y.Z" and gh release view vX.Y.Z --repo openclaw/clawpatch.
   • Confirm npm state: npm view clawpatch version dist-tags time --json.

2. Prep release files.

   • Set package.json version to target.
   • Change top changelog section from Unreleased to X.Y.Z - YYYY-MM-DD.
   • Ensure release notes are the changelog body for that version and include all user-facing changes.
   • Run pnpm install --lockfile-only; commit lockfile only if it actually changes.

3. Prove locally before publishing.

   • Run pnpm typecheck && pnpm lint && pnpm format:check && pnpm test && pnpm build && pnpm pack:smoke.
   • Fix failures before continuing.

4. Commit and push release prep.

   • Commit with committer "chore(release): X.Y.Z" CHANGELOG.md package.json [pnpm-lock.yaml].
   • git push origin main.
   • Watch CI/CodeQL for the release commit:
     • gh run list --repo openclaw/clawpatch --branch main --commit <sha> --json databaseId,workflowName,status,conclusion,url,headSha
     • gh run view <run_id> --repo openclaw/clawpatch --json status,conclusion,url,jobs
   • Do not publish until release-commit CI and CodeQL are green.

5. Publish npm.

   • Use a temp npmrc, never the default user npmrc.
   • First try npm whoami; if unauthenticated, use npm web login in the tmux session:
     • NPM_CONFIG_USERCONFIG="$tmp_npmrc" npm login --auth-type=web --registry=https://registry.npmjs.org/
     • Open/approve browser login if prompted.
   • For publish, fetch a fresh OTP from the npmjs 1Password item inside the same tmux session.
   • Publish with NPM_CONFIG_USERCONFIG="$tmp_npmrc" npm publish --access public --otp "$NPM_OTP".
   • Clean temp npmrc/work dirs after publish.
   • If publish says the version already exists, verify npm metadata and continue only if it matches the release commit/package contents.

6. Verify npm before GitHub release.

   • npm view clawpatch@X.Y.Z version dist-tags dist.tarball dist.integrity time --json
   • Required: version is X.Y.Z, latest points to X.Y.Z, tarball URL exists, integrity exists, publish time exists.

7. Tag and create GitHub release.

   • Build release notes from changelog plus npm/proof:
     • npm version page
     • registry tarball
     • integrity string
     • CI and CodeQL run URLs
     • local proof command
   • Use temp files for public GitHub bodies.
   • git tag -a vX.Y.Z <release_sha> -m "vX.Y.Z"
   • git push origin vX.Y.Z
   • gh release create vX.Y.Z --repo openclaw/clawpatch --title "vX.Y.Z" --notes-file "$notes"

8. Release verify.

   • npm view clawpatch@X.Y.Z version dist-tags.latest dist.tarball dist.integrity time.X.Y.Z --json
   • gh release view vX.Y.Z --repo openclaw/clawpatch --json tagName,url,body,isDraft,isPrerelease
   • Confirm release body contains changelog notes, npm version link, tarball, integrity, and CI/proof.
   • Confirm tag points at the release commit: git rev-list -n1 vX.Y.Z.

9. Post-release closeout.

   • Add next patch section at top of CHANGELOG.md: ## X.Y.(Z+1) - Unreleased.
   • Commit with committer "docs(changelog): open X.Y.(Z+1)" CHANGELOG.md.
   • Push main.
   • Watch closeout CI until green.
   • Final: git checkout main && git pull --ff-only && git status --short --branch.

Notes

• Do not create the GitHub release before npm publish is verified; the release body must include npm proof.
• If npm auth scripts fail, keep the same tmux session. Do not start a second secret session unless the first is unusable.
• Avoid broad secret inspection. Query exact npmjs fields only.
• Public gh comments/releases should use temp --body-file / --notes-file, not inline quoted bodies.