ci: pin the Swift release checkout ownership fix

[steipete]

imsg pins the reusable Swift release workflow by immutable commit, so moving the upstream compatibility tag cannot fix its Linux release job. Advance the caller to release-workflows v1.11.8 at fc49859568b3781af7663bee48c003fd987dc08b, which trusts only the exact container checkout before dependency preparation and retains the Package.resolved drift check.

Update the existing packaging assertion to the same SHA and document the pinning contract. The imsg version remains 0.17.0.

Independent Codex autoreview found no actionable P0–P2 issues; actionlint and diff checks passed. The documented scripts/check-linux.sh gate passed on AWS Crabbox lease cbx_fea60230328e (run), including Linux tests, the standalone archive smoke check, and docs tests. CI supplies full macOS proof. This PR will merge after upstream release verification and exact-head CI, followed by an imsg release dry run on merged main.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T03:36:36.100965Z	6da1225	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR advances imsg’s immutable shared release-workflow pin to the Linux checkout ownership fix and updates its assertion and documentation.

Example: Run the imsg 0.17.0 release dry run inside the Swift Linux container.

• Before: Git rejects the differently owned checkout, stopping dependency preparation with exit 129.
• After: The pinned workflow trusts the exact checkout so an unchanged Package.resolved passes, while lockfile drift still fails.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused, correct caller update supported by production-shell regression coverage rather than a completed imsg release rehearsal.
Proof confidence	🦐 gold shrimp (3/6) ✨ media proof bonus	Sufficient (linked_artifact): The upstream production-shell harness exercises real Git’s permitted-checkout and forbidden-unrelated-checkout decisions, with passing validation at the pinned commit; package installation and Swift resolution are stubbed, and ordinary contributor proof requirements are exempt for this maintainer-authored PR.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Release operators cannot complete the Linux release build because Git rejects the container checkout.
Reason: The failure is concrete, and the maintainer-authored direction preserves the established release contract.

Merge readiness

✅ Ready for maintainer review

Keep open: this maintainer-authored PR supplies a necessary pin update still absent from main, with no actionable defects found.

Priority: P2
Reviewed head: 6da122555c325701bcb5031f6dc53735220838f3

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The actual imsg shared release path has not yet been shown succeeding with this pin; the author schedules that dry run after merge.

Agent review details

How this fits together

The release caller passes version, artifact, signing, and platform settings to a shared workflow that builds, verifies, and publishes release payloads.

flowchart LR
  A[Release dispatch] --> B[imsg release caller]
  B --> C[Pinned shared workflow]
  C --> D[Frozen Linux checkout]
  D --> E[Dependency preparation and lockfile check]
  E --> F[Linux archive build]

Loading

Technical review

Best possible solution:

Land the immutable caller update after the recorded upstream release verification gate, then rehearse the release from merged main.

Do we have a high-confidence way to reproduce the issue?

The failed release job, upstream diagnosis, and source-verified ownership regression establish the failure path; no target code was executed during this review.

Is this the best way to solve the issue?

Updating the existing immutable pin is the smallest complete caller fix because the shared workflow already owns dependency preparation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8b16d157b425.

Provenance checked

• Immutable workflow pin and packaging assertion keeps the original intent (ci: move macOS jobs to Xcode 27 #354: Adopt the Xcode 27 shared workflow while preserving immutable revision selection and existing release inputs.)
• Shared release ownership and documentation keeps the original intent (ci: adopt shared Swift release workflow #205: Delegate release mechanics to the shared workflow while retaining imsg’s artifact, signing, and Homebrew contracts.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Focused introduced diff: The pinned introduction changes only the workflow revision, its existing packaging assertion, release documentation, and one changelog entry. (.github/workflows/release.yml:95, 6da122555c32)
• Current main still needs the update: Current main continues to pin 55c651f600fadc8d565512642c38a4d45890c0a0; moving the upstream compatibility tag cannot update this caller. (.github/workflows/release.yml:95, 8b16d157b425)
• Executed dependency and narrowly scoped fix: The caller executes this dependency, making its workflow contract relevant: the comparison adds only exact GITHUB_WORKSPACE trust to production code, before caller preparation and the retained lockfile check. (.github/workflows/release-swift-cli.yml:745, fc49859568b3)
• Trust-boundary regression coverage: The production-shell harness uses real Git to reproduce ownership rejection, accept the exact checkout, reject changed lockfiles, and keep unrelated checkouts untrusted; the validation job passed at the pinned commit. (scripts/test-swift-linux-git-ownership.mjs:34, fc49859568b3)
• Observed release failure: The prior release dry run failed specifically in shared Linux dependency preparation: https://github.com/openclaw/imsg/actions/runs/39180075983/job/117830800068; the upstream diagnosis and regression are documented at fix: trust the Swift Linux release checkout release-workflows#84. (.github/workflows/release.yml:95, 1d2e372a7171)
• Owner direction and landing gate: The collaborator-authored PR explicitly waits for upstream release verification and exact-head CI; its macOS and Linux checks passed, while Swift analysis remained in progress. (6da122555c32)

Labels

Label changes:

• add P2: Repairs the Linux release pipeline without changing installed CLI behavior.
• add proof: sufficient: Contributor real behavior proof is sufficient.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: Repairs the Linux release pipeline without changing installed CLI behavior.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 18, 2026, 11:47 PM ET / October 19, 2026, 03:47 UTC.