Run the macOS portion of an OpenClaw stable release, including signing, Apple notarization, asset publication, and appcast updates for automatic updates. The skill also covers prerequisite validation, recovery from failed runs, and verification of published files.
Run or recover OpenClaw macOS release signing, notarization, appcast, and asset promotion.
release-openclaw-mac handles validation, signing, Apple notarization, and publication checks for OpenClaw stable releases on macOS. Notarization is Apple's process for checking distribution files. It checks tag and source consistency during preflight and production publication, then adds verified distribution files to GitHub Release. It also handles publication of the appcast, which supplies information for automatic updates, and checks signatures and version information.
Use it when responsible for a macOS stable release or when recovering work that failed during signing, notarization, or packaging. It supports resuming from checkpoints left by failed runs and investigating authentication errors.
appcast.xml.”This skill covers regular stable releases and does not apply to extended-stable. It requires related release skills, 1Password credentials, an App Store Connect API key, and access to the restricted release environment. Credentials must come from the same 1Password item, and notarization authentication must be validated before configuration. Follow the GitHub environment's approval rules. Production publication requires successful preflight and validation records for the same tag and source.
This overview was written by AI (OpenAI Codex) from the public SKILL.md. Check the original below for the exact behavior.
AI rated this skill on four points using only the contents of its SKILL.md. Stars and popularity are not taken into account.
The total counts each point as A = 25, B = 15, C = 5. Rated by AI (OpenAI Codex) as of Oct 19, 2026. Treat it as a guide and read the original before installing.
Review the instructions the agent will receive before you install.
Use with $release-openclaw-maintainer, $release-openclaw-ci, $one-password, and $release-private if it exists when stable macOS assets, release-ops mac preflight, notarization, appcast promotion, or mac release recovery is involved.
This is a regular stable-release skill. Do not invoke it for extended-stable; that track's GitHub Release carries shared validation evidence but does not inherit macOS assets or appcast promotion.
An explicit stable or full release request includes macOS publication unless the operator limits its scope. Continue through validation, signing, notarization, promotion, and verification without asking for separate macOS consent. Keep the exact release identity and all artifact checks. macOS publication runs in parallel with npm and never blocks it; a mac failure does not hold the npm/ClawHub release, GitHub release finalization, or main closeout. Fix it in parallel.
Follow the current owner-configured environment policy. Do not invent an extra reviewer requirement or recreate an obsolete one. If GitHub still enforces an approval, report the actual rule and resolve it through its owner; policy changes require explicit organization-owner direction and verified active admin membership. Never impersonate a reviewer, fabricate approval, or use another signing path to bypass an enforced rule.
$release-private.private_key_p8, key_id, issuer_id.xcrun notarytool submit fails with HTTP status code: 401. Unauthenticated.xcrun notarytool history before setting GitHub secrets.$one-password: all op work inside one persistent tmux session, no secret output.$release-private when available.op whoami; never print token values.OP_BIOMETRIC_UNLOCK_ENABLED=false for the manual op account add --signin path.Target release-ops repo environment: openclaw/releases, env mac-release.
Set only after local notary auth validation:
APP_STORE_CONNECT_API_KEY_P8APP_STORE_CONNECT_KEY_IDAPP_STORE_CONNECT_ISSUER_IDDo not update these from mixed sources. All three ASC fields must come from the same 1Password item.
openclaw/openclaw is the public product repo. Its GitHub Releases page is
where macOS assets are ultimately attached.openclaw/openclaw macos-release.yml is public handoff validation only.
It never signs, notarizes, or uploads macOS assets, regardless of
preflight_only.openclaw/releases is the restricted release-ops repo. Its macOS workflows
sign, notarize, validate, and promote assets onto the
openclaw/openclaw GitHub release.source_ref=release/YYYY.M.PATCH for release-ops mac preflight/validation when building that branch variation.tag=vYYYY.M.PATCH pointing at the original stable release commit.mac-release environment for
signing and promotion secrets and its main-only deployment policy. The
authorized release operator continues under that environment's current rules.source_ref; promotion rejects mismatched proof.scripts/notarize-mac-artifact.sh.xcrun notarytool submit should use --no-s3-acceleration; accelerated upload can surface misleading 401s even when notarytool history succeeds.The public handoff workflow validates the tag, source, build, and package metadata before publication. It does not require a GitHub release page because it does not upload assets. Keep this validation before the real publish workflow. The core publisher owns GitHub release finalization; macOS promotion attaches its verified assets to that release whether it is still a draft or already public, so it never waits for the npm flip.
Public handoff validation:
gh workflow run macos-release.yml --repo openclaw/openclaw \
--ref release/YYYY.M.PATCH \
-f tag=vYYYY.M.PATCH \
-f preflight_only=true \
-f public_release_branch=release/YYYY.M.PATCH
release/YYYY.M.PATCH, matching prior stable macOS handoff runs.--ref main or --ref vYYYY.M.PATCH for this public handoff
validation. The workflow checks out the tag from the tag input internally.Release-ops preflight:
gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
-f tag=vYYYY.M.PATCH \
-f source_ref=release/YYYY.M.PATCH \
-f preflight_only=true \
-f smoke_test_only=false \
-f allow_late_calver_recovery=false \
-f public_release_branch=release/YYYY.M.PATCH
Follow the run through signing and notarization under the configured environment policy. Record the successful preflight run id; an approval pause is not a successful preflight.
Resume is the default. Re-dispatching the same preflight command after a
failure (notary outage, DMG packaging, collector) resumes every variant from
the newest checkpoint left by a failed or cancelled main dispatch for the same
tag and source SHA; only variants without a checkpoint rebuild. The run log
prints Resuming <variant> from run <id> attempt <n> or Building <variant>.
ignore_checkpoints=true forces fresh builds. Pass resume_notarization_run_id,
resume_notarization_run_attempt, and resume_notarization_variant only to pin
one specific run, or for checkpoints made before the resume index existed
(macos-resume-<tag>-<variant>-<sha> artifacts). Prefer
gh run rerun <run-id> --failed --repo openclaw/releases when the failed job is
still in the current run.
Release-ops validation for a branch-variation preflight:
gh workflow run openclaw-macos-validate.yml --repo openclaw/releases --ref main \
-f tag=vYYYY.M.PATCH \
-f source_ref=release/YYYY.M.PATCH
Record the successful validation run id.
Real publish:
gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
-f tag=vYYYY.M.PATCH \
-f preflight_only=false \
-f smoke_test_only=false \
-f preflight_run_id=<successful-preflight-run> \
-f validate_run_id=<successful-validation-run> \
-f allow_late_calver_recovery=false \
-f public_release_branch=release/YYYY.M.PATCH
Follow promotion through asset upload and appcast publication under the same release authorization and current environment policy.
openclaw/releases publish/validate workflows run from their own
trusted main workflow ref. Real publish has a guard that rejects any other
workflow ref. That displayed main ref is expected; the public OpenClaw
source is selected by tag and optional source_ref.gh release view vYYYY.M.PATCH --repo openclaw/openclaw shows zip, dmg, dSYM zip; once the npm publisher has flipped it: not draft, not prerelease.main appcast.xml points at OpenClaw-YYYY.M.PATCH.zip.sparkle:version, sparkle:shortVersionString, length, and sparkle:edSignature.No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Set up and authenticate the 1Password CLI, then supply stored passwords and API keys to commands or configuration. The skill covers desktop integration, service accounts, and interactive sign-in while keeping secrets out of chat and logs.
Route requests from OpenClaw to external coding agents such as Claude Code or Cursor. Start or continue sessions using ACP, a protocol for connecting agents, or relay prompts directly through acpx while preserving conversation context.
Add a model provider to OpenClaw and verify it with a real response. The skill validates configuration, keeps credentials in environment or file references, and reports test results and any default model changes.
Prepare an agent activity transcript for a GitHub pull request or issue. Extract relevant prompts, decisions, and results from local logs, remove sensitive material, and preview the edited record before separately authorized publication.
Manage Apple Notes on macOS through memo, a command-line tool. Create, browse, search, edit, delete, and move notes between folders, or export selected notes to HTML or Markdown for use outside the app.
Manage Apple Reminders from your Mac with remindctl, a terminal tool. View tasks by date, add or edit reminders, organize lists, and mark tasks complete or delete them, including personal to-dos that sync to iOS.