release-clawpatch

# Clawpatch Release ## Scope Release `~/Projects/clawpatch` as the public npm package `clawpatch`. Use `$npm` and `$one-password` rules for registry auth. Keep all `op` and npm secret work inside one persistent tmux session and temp npmrc. Never print tokens, passwords, or OTPs. ## Workflow 1. Start clean on `main`. - `cd ~/Projects/clawpatch` - `git status --short --branch` - `git pull --ff-only` - Confirm target version is not already tagged or released: `git tag --list "vX.Y.Z"` and `gh release view vX.Y.Z --repo openclaw/clawpatch`. - Confirm npm state: `npm view clawpatch version dist-tags time --json`. 2. Prep release files. - Set `package.json` version to target. - Change top changelog section from `Unreleased` to `X.Y.Z - YYYY-MM-DD`. - Ensure release notes are the changelog body for that version and include all user-facing changes. - Run `pnpm install --lockfile-only`; commit lockfile only if it actually changes. 3. Prove locally before publishing. - Run `pnpm typecheck && pnpm lint && pnpm format:check && pnpm test && pnpm build && pnpm pack:smoke`. - Fix failures before continuing. 4. Commit and push release prep. - Commit with `committer "chore(release): X.Y.Z" CHANGELOG.md package.json [pnpm-lock.yaml]`. - `git push origin main`. - Watch CI/CodeQL for the release commit: - `gh run list --repo openclaw/clawpatch --branch main --commit <sha> --json databaseId,workflowName,status,conclusion,url,headSha` - `gh run view <run_id> --repo openclaw/clawpatch --json status,conclusion,url,jobs` - Do not publish until release-commit CI and CodeQL are green. 5. Publish npm. - Use a temp npmrc, never the default user npmrc. - First try `npm whoami`; if unauthenticated, use npm web login in the tmux session: - `NPM_CONFIG_USERCONFIG="$tmp_npmrc" npm login --auth-type=web --registry=https://registry.npmjs.org/` - Open/approve browser login if prompted. - For publish, fetch a fresh OTP from the `npmjs` 1Password item inside the same tmux session. - Publish with `NPM_CONFIG_USERCONFIG="$tmp_npmrc" npm publish --access public --otp "$NPM_OTP"`. - Clean temp npmrc/work dirs after publish. - If publish says the version already exists, verify npm metadata and continue only if it matches the release commit/package contents. 6. Verify npm before GitHub release. - `npm view clawpatch@X.Y.Z version dist-tags dist.tarball dist.integrity time --json` - Required: version is `X.Y.Z`, `latest` points to `X.Y.Z`, tarball URL exists, integrity exists, publish time exists. 7. Tag and create GitHub release. - Build release notes from changelog plus npm/proof: - npm version page - registry tarball - integrity string - CI and CodeQL run URLs - local proof command - Use temp files for public GitHub bodies. - `git tag -a vX.Y.Z <release_sha> -m "vX.Y.Z"` - `git push origin vX.Y.Z` - `gh release create vX.Y.Z --repo openclaw/clawpatch --title "vX.Y.Z" --notes-file "$notes"` 8. Release verify. - `npm view clawpatch@X.Y.Z version dist-tags.latest dist.tarball dist.integrity time.X.Y.Z --json` - `gh release view vX.Y.Z --repo openclaw/clawpatch --json tagName,url,body,isDraft,isPrerelease` - Confirm release body contains changelog notes, npm version link, tarball, integrity, and CI/proof. - Confirm tag points at the release commit: `git rev-list -n1 vX.Y.Z`. 9. Post-release closeout. - Add next patch section at top of `CHANGELOG.md`: `## X.Y.(Z+1) - Unreleased`. - Commit with `committer "docs(changelog): open X.Y.(Z+1)" CHANGELOG.md`. - Push `main`. - Watch closeout CI until green. - Final: `git checkout main && git pull --ff-only && git status --short --branch`. ## Notes - Do not create the GitHub release before npm publish is verified; the release body must include npm proof. - If npm auth scripts fail, keep the same tmux session. Do not start a second secret session unless the first is unusable. - Avoid broad secret inspection. Query exact `npmjs` fields only. - Public `gh` comments/releases should use temp `--body-file` / `--notes-file`, not inline quoted bodies.