Configure CI

Set Actions variables/secrets under Settings → Secrets and variables → Actions or the named Settings → Environments entry. Keep provider credentials in their environments. GitHub supplies workflow/cache tokens automatically. Manual dispatch inputs are per-run values; use the owning check page for commands.

Shared settings

Native image checks use the release build settings.

Ordinary CI, First Agent Smoke, and Observability Demo need no provider secrets. Runner labels, tool pins, triggers, timeouts, and job permissions are set in the workflow files; test lane definitions list required inputs.

Environments

Full Integration runs on main when a scheduled tick passes admission, or when the dispatcher approves a manual run through integration-main-approval. The approval environment has no secrets or variables. Set its sole required reviewer to @openclaw/maintainers-oce, allow self-review, and disable administrator bypass. Both environments must have exactly one custom deployment rule for branch main. Keep integration-main free of required reviewers so admitted scheduled runs do not wait for approval.

After a manual approval, preflight reads the environment policy and the run's review history with the workflow token. The approved review must name the exact approval environment and match the dispatcher's user ID and triggering login. Missing, rejected, conflicting, or unverifiable reviews fail before integration-main jobs start. Repository write access alone does not authorize a manual dispatch.

To retry a scheduled or manual run, start a new approved manual dispatch on main. Each credentialed job checks the event and attempt before reading credentials. Preflight rejects extra branches, tags, incomplete policy metadata, and a missing or enabled bypass flag.

The separate integration-qa-pr environment permits main and refs/pull/*/merge. Its fixed coverage labels select full QA, Compose OpenShell, Keycloak installation, or OpenClaw model/browser advisory runs. Keep its two secret values separate from integration-main. Full Integration preflight does not govern this environment.

Full Integration rejects tags and all branch dispatches outside main. Check the source commit before dispatch and confirm the run's headSha matches it.

dev-up-k3d and skipper-prepared-git-installed need no credential environment, but manual runs still require main and the dispatcher's team approval. The Skipper job uses synthetic, job-local model and Git credentials for the installed private Git fixture and a GitHub Actions cache token to build images. helper-timeout and standalone logging-collector also need no environment, but both require main.

The table distinguishes secret names from variable names. The common runtime image variables are optional OCC_TEST_KUBERNETES_GATEWAY_IMAGE and OCC_TEST_KUBERNETES_AGENT_IMAGE; unset values use preparation's builds/defaults. CONTAINER_NODE_BASE_IMAGE remains a shared repository setting.

NODE_BASE_IMAGE is a separate variable consumed by selected Full Integration jobs; it is not an alias for CONTAINER_NODE_BASE_IMAGE. Model/image requirements and defaults differ by lane: follow its linked suite guide. Missing required inputs fail selected lanes.

OpenShell image overrides must retain the pinned release digest, or use the complete candidate image and chart selection during local preparation. Hosted jobs do not acquire candidate source checkouts or charts from image variables alone.

QA model overrides default to gpt-6-luna.

For hosted QA scenario exclusions, see Full Integration.

Every integration-main job can reference its combined secret set. Workflow steps pass only their selected inputs to tests. Preserve the old environments until credential migration and hosted verification are complete.

Runner overrides

For lanes that accept optional Kubernetes runtime images, set both OCC_TEST_KUBERNETES_GATEWAY_IMAGE and OCC_TEST_KUBERNETES_AGENT_IMAGE to immutable references, or omit both to build from source. Supplying only one fails preparation before state or resources are created. Preparation also selects the verified Gateway image in the host container engine for OCC_DOCKER_RUNTIME_IMAGE, used by the loopback Gateway relay. Kubernetes selectors use the separately verified references imported into the cluster.

Before a cold local source build, check for an exact-source retained CI runtime. This discovers candidate artifacts; it does not import or qualify them.

These process environment variables are optional. First Agent Smoke has its own directories and slot settings.

Cleanup timeout/grace overrides that are not positive numbers use defaults. Deadlines include pipe drain; a wait timeout does not prove deletion. Preparation verifies imported image references on every node and fails on import timeout.