ci(images): build OpenClaw base image on native runners#7520
Merged
apurvvkumaria merged 4 commits intoJul 25, 2026
Conversation
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
senthilr-nv
added
the
area: security
Contributor
📝 WalkthroughWalkthroughOpenClaw base-image publishing now builds amd64 and arm64 images on native runners, stores immutable digests, and creates a validated multi-platform manifest. Shared publishing excludes OpenClaw, while workflow and remediation tests follow the new job structure. ChangesOpenClaw publishing workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant NativeBuild as build-openclaw-platforms
participant Artifacts as Digest artifacts
participant ManifestJob as build-and-push-openclaw
participant Registry as Container registry
NativeBuild->>Registry: Push amd64 and arm64 images by digest
NativeBuild->>Artifacts: Upload platform digests
Artifacts->>ManifestJob: Provide exactly two digests
ManifestJob->>Registry: Create and push multi-platform manifest
ManifestJob->>Registry: Verify amd64 and arm64 platforms
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
apurvvkumaria
approved these changes
Jul 25, 2026
apurvvkumaria
enabled auto-merge (squash)
July 25, 2026 06:29
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/base-image.yaml (1)
86-87: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueConsider
persist-credentials: falseon the new checkout.This job only needs the tree to build; the token isn't used afterward. Setting it avoids leaving credentials in
.git/configinside the build context (context: .).🔒 Proposed hardening
- name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/base-image.yaml around lines 86 - 87, Update the Checkout step using actions/checkout to set persist-credentials to false, ensuring the build context does not retain the checkout token in .git/config.Source: Linters/SAST tools
test/dcode-base-image-workflow.test.ts (1)
330-417: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider splitting this into focused cases.
One
itnow covers matrix topology, guard ordering, cache namespacing, digest export/upload, and manifest-job wiring; a failure anywhere reports as one opaque case. Splitting per claim (platform matrix / per-arch build contract / manifest assembly) would keep each assertion diagnosable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/dcode-base-image-workflow.test.ts` around lines 330 - 417, Split the single test case around “publishes OpenClaw atomically from native architecture runners” into focused cases for platform matrix topology, per-architecture build and digest contracts, and manifest assembly wiring. Move each related assertion group into its corresponding test while preserving the existing expectations and shared setup.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/dcode-base-image-workflow.test.ts`:
- Around line 90-120: Update validatePublishers and its callers so the
publishers returned by openClawPlatformPublishers are included in trigger-path
and copiedInputs validation. Preserve platform-specific differences by relaxing
only expectations that do not apply to native OpenClaw builds, while retaining
coverage for Dockerfile.base paths and copied production inputs; do not rely
solely on the separate structural assertions.
---
Nitpick comments:
In @.github/workflows/base-image.yaml:
- Around line 86-87: Update the Checkout step using actions/checkout to set
persist-credentials to false, ensuring the build context does not retain the
checkout token in .git/config.
In `@test/dcode-base-image-workflow.test.ts`:
- Around line 330-417: Split the single test case around “publishes OpenClaw
atomically from native architecture runners” into focused cases for platform
matrix topology, per-architecture build and digest contracts, and manifest
assembly wiring. Move each related assertion group into its corresponding test
while preserving the existing expectations and shared setup.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7fe2938e-c946-4ff3-8de2-1425fc5781a1
📒 Files selected for processing (5)
.github/workflows/base-image.yamlDockerfile.basetest/dcode-base-image-workflow.test.tstest/openclaw-dependency-review.test.tstest/perl-critical-cve-remediation.test.ts
Contributor
PR Review Advisor — InformationalAdvisor assessment: Informational / low confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 warning · 0 suggestionsWarningsWarnings do not block.
|
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
23 tasks
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OpenClaw base-image publication runs its full Perl regression suite for arm64 under QEMU, which can exceed the 90-minute job timeout. This change builds each platform on a native GitHub-hosted runner and publishes user-facing tags only after both immutable digests succeed.
Changes
latest, and SHA tags only after both builds pass.Type of Change
Quality Gates
Documentation Writer Review
no-docs-neededDGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: Not applicable; focused workflow contracts cover this change.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Senthil Ravichandran senthilr@nvidia.com
Summary by CodeRabbit