From bf96d4d31c60cec8fae37c222b6f72ddc5e5199b Mon Sep 17 00:00:00 2001 From: devSejung Date: Sat, 31 Oct 2026 22:35:21 +0900 Subject: [PATCH 1/2] fix(ci): let trusted maintainer approve dependency changes --- .github/workflows/dependency-guard.yml | 6 +++--- test/scripts/dependency-guard-workflow.test.ts | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependency-guard.yml b/.github/workflows/dependency-guard.yml index d780618d90c..656792b450b 100644 --- a/.github/workflows/dependency-guard.yml +++ b/.github/workflows/dependency-guard.yml @@ -34,7 +34,7 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} OPENCLAW_DEPENDENCY_GUARD_MODE: detect - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant + OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant,iililiiilili OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/dependency-guard.mjs @@ -82,7 +82,7 @@ jobs: GITHUB_TOKEN: ${{ github.token }} OPENCLAW_DEPENDENCY_GUARD_AUTOSCRUB_TOKEN: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }} OPENCLAW_DEPENDENCY_GUARD_MODE: autoscrub - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant + OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant,iililiiilili OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/dependency-guard.mjs @@ -104,6 +104,6 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} OPENCLAW_DEPENDENCY_GUARD_MODE: enforce - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant + OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant,iililiiilili OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/dependency-guard.mjs diff --git a/test/scripts/dependency-guard-workflow.test.ts b/test/scripts/dependency-guard-workflow.test.ts index 77db72efff6..65a689ef608 100644 --- a/test/scripts/dependency-guard-workflow.test.ts +++ b/test/scripts/dependency-guard-workflow.test.ts @@ -184,7 +184,9 @@ describe("dependency guard workflow", () => { const script = readFileSync("scripts/github/dependency-guard.mjs", "utf8"); expect(runStep.env?.OPENCLAW_SECURITY_TEAM_SLUG).toBe("openclaw-secops"); - expect(runStep.env?.OPENCLAW_SECURITY_APPROVERS).toBe("vincentkoc,steipete,joshavant"); + expect(runStep.env?.OPENCLAW_SECURITY_APPROVERS).toBe( + "vincentkoc,steipete,joshavant,iililiiilili", + ); expect(workflow).toContain("scripts/github/dependency-guard.mjs"); expect(script).toContain('"dependencies-changed"'); expect(script).not.toContain('"blocked: dependencies"'); From 37ec7b4111501a8401a978899a0753c8b6e3a406 Mon Sep 17 00:00:00 2001 From: devSejung Date: Sat, 31 Oct 2026 22:46:11 +0900 Subject: [PATCH 2/2] fix(ci): delegate both guards to PlatformClaw maintainer --- .github/workflows/dependency-guard.yml | 6 +++--- .github/workflows/security-sensitive-guard.yml | 4 ++-- test/scripts/dependency-guard-workflow.test.ts | 4 +--- test/scripts/security-sensitive-guard-workflow.test.ts | 4 +--- 4 files changed, 7 insertions(+), 11 deletions(-) diff --git a/.github/workflows/dependency-guard.yml b/.github/workflows/dependency-guard.yml index 656792b450b..31b23a2fc5c 100644 --- a/.github/workflows/dependency-guard.yml +++ b/.github/workflows/dependency-guard.yml @@ -34,7 +34,7 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} OPENCLAW_DEPENDENCY_GUARD_MODE: detect - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant,iililiiilili + OPENCLAW_SECURITY_APPROVERS: iililiiilili OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/dependency-guard.mjs @@ -82,7 +82,7 @@ jobs: GITHUB_TOKEN: ${{ github.token }} OPENCLAW_DEPENDENCY_GUARD_AUTOSCRUB_TOKEN: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }} OPENCLAW_DEPENDENCY_GUARD_MODE: autoscrub - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant,iililiiilili + OPENCLAW_SECURITY_APPROVERS: iililiiilili OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/dependency-guard.mjs @@ -104,6 +104,6 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} OPENCLAW_DEPENDENCY_GUARD_MODE: enforce - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant,iililiiilili + OPENCLAW_SECURITY_APPROVERS: iililiiilili OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/dependency-guard.mjs diff --git a/.github/workflows/security-sensitive-guard.yml b/.github/workflows/security-sensitive-guard.yml index 1cc3c5ba2ac..2274fe3161c 100644 --- a/.github/workflows/security-sensitive-guard.yml +++ b/.github/workflows/security-sensitive-guard.yml @@ -28,7 +28,7 @@ jobs: - name: Detect security-sensitive changes env: GITHUB_TOKEN: ${{ github.token }} - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant + OPENCLAW_SECURITY_APPROVERS: iililiiilili OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE: detect OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/security-sensitive-guard.mjs @@ -49,7 +49,7 @@ jobs: - name: Enforce security-sensitive guard env: GITHUB_TOKEN: ${{ github.token }} - OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant + OPENCLAW_SECURITY_APPROVERS: iililiiilili OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE: enforce OPENCLAW_SECURITY_TEAM_SLUG: openclaw-secops run: node scripts/github/security-sensitive-guard.mjs diff --git a/test/scripts/dependency-guard-workflow.test.ts b/test/scripts/dependency-guard-workflow.test.ts index 65a689ef608..d3d5b103d19 100644 --- a/test/scripts/dependency-guard-workflow.test.ts +++ b/test/scripts/dependency-guard-workflow.test.ts @@ -184,9 +184,7 @@ describe("dependency guard workflow", () => { const script = readFileSync("scripts/github/dependency-guard.mjs", "utf8"); expect(runStep.env?.OPENCLAW_SECURITY_TEAM_SLUG).toBe("openclaw-secops"); - expect(runStep.env?.OPENCLAW_SECURITY_APPROVERS).toBe( - "vincentkoc,steipete,joshavant,iililiiilili", - ); + expect(runStep.env?.OPENCLAW_SECURITY_APPROVERS).toBe("iililiiilili"); expect(workflow).toContain("scripts/github/dependency-guard.mjs"); expect(script).toContain('"dependencies-changed"'); expect(script).not.toContain('"blocked: dependencies"'); diff --git a/test/scripts/security-sensitive-guard-workflow.test.ts b/test/scripts/security-sensitive-guard-workflow.test.ts index f5b26c42f77..367c70de0d7 100644 --- a/test/scripts/security-sensitive-guard-workflow.test.ts +++ b/test/scripts/security-sensitive-guard-workflow.test.ts @@ -101,9 +101,7 @@ describe("security-sensitive guard workflow", () => { expect(detectSteps.at(-1)?.env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE).toBe("detect"); expect(finalSteps.at(-1)?.env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_MODE).toBe("enforce"); expect(finalSteps.at(-1)?.env?.OPENCLAW_SECURITY_TEAM_SLUG).toBe("openclaw-secops"); - expect(finalSteps.at(-1)?.env?.OPENCLAW_SECURITY_APPROVERS).toBe( - "vincentkoc,steipete,joshavant", - ); + expect(finalSteps.at(-1)?.env?.OPENCLAW_SECURITY_APPROVERS).toBe("iililiiilili"); }); it("uses a dedicated checked-in script and detects the intended file surfaces", () => {