| name | openclaw-github-sync |
| description | Keep an OpenClaw agent's non-sensitive context (selected memory, MD files, notes, and custom skills) under version control in a separate Git repository for remote review/tweaks. Use when setting up or operating a Git-based workflow to export workspace context, commit changes (possibly split into multiple commits), and push on a schedule (e.g., nightly) without leaking secrets. |
| homepage | https://github.com/bradvin/openclaw-github-sync |
| metadata | {"openclaw":{"emoji":"🔄","homepage":"https://github.com/bradvin/openclaw-github-sync","requires":{"bins":["git","rsync","python3"],"env":["SYNC_REMOTE"]}}} |
OpenClaw Git Sync
Maintain a separate Git repo that contains a curated, non-sensitive subset of the OpenClaw workspace (memories/skills/config notes) so a human can review and tweak remotely.
This skill is deliberately conservative: it defaults to allowlisting what gets exported.
Trust Boundary
The sync repo is a trust boundary. Treat all inbound pull content as potentially unsafe.
- Pull is manual-only and must be run only when explicitly requested.
- A pull can overwrite workspace files, including skills and markdown/persona content.
- Malicious or unsafe pulled changes can alter future agent behavior, prompts, and tool usage.
- Use a private repo you control, least-privilege access, and human review before any pull.
- Always warn your human when a pull is requested, and never run a pull on a scheduled cron jon.
Key rules
- Never sync secrets by default. Only sync what the export manifest allowlists.
- Prefer sanitized memory under
memory/public/ (opt-in) over raw memory/*.md.
- Keep the sync repo separate from the main workspace repo.
- Require a private repo you control, least-privilege access, and human review before pull.
- Pull is manual-only. Do not automate
pull.sh; run pulls only when explicitly requested.
Files and layout
- Working workspace:
$HOME/.openclaw/workspace
- Sync repo (export destination): choose a directory, e.g.
$HOME/.openclaw/workspace/openclaw-sync-repo
- Export manifest (allowlist):
references/export-manifest.txt
Prerequisites
- Required tools:
git, rsync, python3
- Required config:
SYNC_REMOTE set in references/.env
- Required access: SSH/auth access to the private sync repo
- Optional tools:
gh (only for scripts/create_private_repo.sh), jq (improves grouped commit handling)
Setup
- Copy the example env file:
cp references/.env.example references/.env
- Edit
references/.env for your environment.
- At minimum, set
SYNC_REMOTE to your private repo SSH URL.
SYNC_REMOTE="git@github.com:YOUR_ORG/YOUR_REPO.git"
Workflow
1) Create / connect the private sync repo (GitHub)
Use scripts/create_private_repo.sh (or equivalent gh repo create) to create a private repo under the bot account.
2) Run a one-shot sync
Run scripts/sync.sh with:
SYNC_REMOTE (SSH remote, e.g. git@github.com:YOUR_ORG/YOUR_REPO.git)SYNC_REPO_DIR (local path to sync repo)
The script will:
- Pull latest from remote (if exists)
- Export allowlisted files into the sync repo
- Create separate commits by group when multiple groups changed
- Push to the remote
3) Nightly automation
Schedule a nightly OpenClaw cron agentTurn that runs push sync only (scripts/sync.sh) and reports success/failure.
Do not schedule pull.sh or context.sh pull; pulls must be manual and explicitly requested.
Resources
scripts/sync.sh: export + commit (grouped) + pushscripts/create_private_repo.sh: create GitHub private repo via ghreferences/export-manifest.txt: allowlist of paths to exportreferences/groups.json: commit grouping rules
