From ed283490b542b3f04e75dfe0a4f7c1ff4f4051f8 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Wed, 3 Jun 2026 22:42:53 +0100 Subject: [PATCH] docs(release): require verified Windows asset links --- .agents/skills/release-openclaw-maintainer/SKILL.md | 9 +++++---- docs/reference/RELEASING.md | 6 ++++-- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.agents/skills/release-openclaw-maintainer/SKILL.md b/.agents/skills/release-openclaw-maintainer/SKILL.md index 1ba3c8cb48e1..661c7695a67e 100644 --- a/.agents/skills/release-openclaw-maintainer/SKILL.md +++ b/.agents/skills/release-openclaw-maintainer/SKILL.md @@ -150,10 +150,11 @@ Use this skill for release and publish-time workflow. Load `$release-private` if `openclaw/openclaw` GitHub Release. Use the public `Windows Node Release` workflow after the matching `openclaw/openclaw-windows-node` release exists; it verifies Authenticode signatures on Windows before uploading assets. -- Website Windows Hub download links should target the canonical - `openclaw/openclaw/releases/latest/download/...` assets so the installable - signed Windows artifact is visible from both the GitHub release page and - openclaw.ai. +- Website Windows Hub download links should target exact canonical + `openclaw/openclaw/releases/download/vYYYY.M.D/...` assets for the current + stable release, or `releases/latest/download/...` only after verifying the + redirect resolves to that same tag, so the installable signed Windows artifact + is visible from both the GitHub release page and openclaw.ai. ## Build changelog-backed release notes diff --git a/docs/reference/RELEASING.md b/docs/reference/RELEASING.md index 9a162b2a6e87..fefd7da9cadb 100644 --- a/docs/reference/RELEASING.md +++ b/docs/reference/RELEASING.md @@ -243,8 +243,10 @@ vYYYY.M.D-beta.N` from the matching `release/YYYY.M.D` branch. The helper runs signed Windows Hub installers from the companion repo, verifies their Authenticode signatures on a Windows runner, writes a SHA-256 manifest, and uploads the installers plus manifest onto the canonical OpenClaw GitHub - release. Website download links should target the OpenClaw release assets, not - only the companion repo release page. + release. Website download links should target exact OpenClaw release asset + URLs for the current stable release, or `releases/latest/download/...` only + after verifying GitHub's latest redirect points at that same release; do not + link only to the companion repo release page. - Release checks now run in a separate manual workflow: `OpenClaw Release Checks` - `OpenClaw Release Checks` also runs the QA Lab mock parity lane plus the fast