[stubbi]

Summary

Fixes #625.

Release Please has failed on every push since the repository moved from paperclipinc to stubbi. vars.RELEASE_BOT_APP_ID and secrets.RELEASE_BOT_PRIVATE_KEY were settings of the old organization, so actions/create-github-app-token aborts with Input required and not supplied: app-id before release-please runs. The issue also points out a second problem the first release would hit: release.yaml signs the image and pushes the chart under the repository owner (now stubbi), while GoReleaser, the chart default, the bundle CSV and operatorhub.yaml all use ghcr.io/paperclipinc.

Changes

• Credentials fallback (release-please.yaml, release.yaml): the App token is minted only when vars.RELEASE_BOT_APP_ID is set. Otherwise the workflows use secrets.RELEASE_PLEASE_TOKEN, then GITHUB_TOKEN, and log a warning. GITHUB_TOKEN tag pushes and release publishing do not trigger other workflows, so in that mode release-please dispatches release.yaml --ref <tag> and release.yaml dispatches operatorhub.yaml -f tag=<tag>. release.yaml gains a workflow_dispatch trigger, and its jobs only run on refs/tags/v*.
• One image namespace: vars.IMAGE_NAMESPACE (default paperclipinc) feeds release.yaml (cosign signing, SBOM, chart push) and .goreleaser.yaml (envOrDefault). A preflight step fails the release before anything is pushed if it does not match the chart's default image.repository, which prevents a repeat of bug: chart versions 0.32.0-0.34.4 shipped with stale image.repository (openclaw-rocks) after org rename, causing silent ImagePullBackOff #536.
• GHCR login takes secrets.GHCR_PUSH_TOKEN / vars.GHCR_PUSH_USER when set. GITHUB_TOKEN cannot push into a namespace the repository owner does not own.
• GoReleaser creates the GitHub release in stubbi/openclaw-operator instead of relying on the redirect.
• make verify-signing (weekly drift check) accepts both the old (paperclipinc/...) and the new (stubbi/...) workflow identity. Releases signed from here will carry the new one.
• CLAUDE.md documents the credentials.

Testing

• actionlint clean on the changed workflows.
• goreleaser check passes.
• make verify-signing still verifies ghcr.io/paperclipinc/openclaw-operator:v0.40.0 with the widened identity regexp.
• The release path itself only runs on a tag, so it can't be exercised from this PR.

Owner actions after merge (settings, not code)

Release Please goes green with no further action, but it then uses the GITHUB_TOKEN fallback. Its release PRs get no CI run until someone pushes a commit to them. For the normal flow:

1. Release credentials, either:
   • create a GitHub App under stubbi (permissions: Contents RW, Pull requests RW, Actions RW; install it on this repo), then set the repository variable RELEASE_BOT_APP_ID and the secret RELEASE_BOT_PRIVATE_KEY. Or:
   • set the secret RELEASE_PLEASE_TOKEN to a fine-grained PAT for this repo with the same permissions.
2. Image/chart namespace, either:
   • keep ghcr.io/paperclipinc (no change for users, Artifact Hub's verified oci://ghcr.io/paperclipinc/charts repo, or the OperatorHub CSV): set the secret GHCR_PUSH_TOKEN to a classic PAT with write:packages from a member of paperclipinc, and the variable GHCR_PUSH_USER to that login. Or:
   • move to ghcr.io/stubbi: set the variable IMAGE_NAMESPACE=stubbi and, in the same release, change charts/openclaw-operator/values.yaml image.repository, hack/check-chart-image-repository.sh EXPECTED, the bundle CSV image, and operatorhub.yaml IMG. Then make the new packages public and re-register the chart repository on Artifact Hub, including the verified-publisher metadata artifact. The release preflight blocks a partial switch.

🤖 Generated with Claude Code

[stubbi]

Merge order note (maintenance pass, 2026-10-11). The open stubbi PRs are stacked so they apply cleanly in this order: #623 → #627 → #620 → #618 → #617 → #628 → #629. This is position 2 of 7. This branch has #623 (and everything below it) merged in, so until those land the diff here also shows their changes; once they are squash-merged, "Update branch" reduces it to this PR's own changes without conflicts. #623 is at the bottom because the required E2E check cannot pass without its sticky /tmp fix (OpenClaw >= 2026.9.6 crash-loops otherwise). Branch protection requires an up-to-date branch, so after each merge click "Update branch" on the next PR and let CI re-run before merging it.

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. If this PR is still relevant, please push updates or leave a comment.

[jtatum]

Not stale