fix: fix publshing

[drobnikj]

I need to do some changes to the release flow as the release pipeline was failing. Please check.

[apify-factory]

AI review — PR #36 fix: fix publshing

Verdict: does not deliver as-is — release-blocking. The PR's stated goal is to fix the failing release pipeline by centralizing all "latest openclaw" resolution into one module, scripts/openclaw-version.mjs, and pointing three consumers at it. The refactor of the three consumers (and the matching CLAUDE.md docs) is internally consistent and correct — but the new module itself was never committed to the branch. It exists neither in the working tree, on this branch, nor on main (git ls-files scripts/ → only bump-openclaw.mjs, migrate-id.mjs). Every consumer is now a dangling reference, so the change makes the release pipeline more broken, not less:

• node scripts/openclaw-version.mjs check → Error: Cannot find module — the publish version gate can never pass, so no release can be cut.
• import { ... } from "./openclaw-version.mjs" in bump-openclaw.mjs → ERR_MODULE_NOT_FOUND at load — npm run bump:openclaw dies immediately.
• node scripts/openclaw-version.mjs matrix 3 in the version-test matrix → errors, leaving the discover job's versions output empty on every PR and schedule.

Both failures were reproduced by execution, not just inspection. The required export/CLI surface is fully specified by the consumers and CLAUDE.md: exports REPO_ROOT, compareVersions, currentDevVersion, isReleaseVersion, latestOpenclawVersion, pinnedVersions (array of { raw, label }), stripRange; CLI subcommands latest / matrix <n> / check. Once that file is added, the version-comparison inversion (X.Y.Z-N sorts above X.Y.Z) and the matrix respin-collapsing logic will need their own review, since that code is absent here.

The rest of the diff looks good: the actions/checkout@v4 added to the discover job is now required (it runs a repo script); the npm-major pin (12) is consistent across ci.yml, publish.yml, and RELEASE_NPM in bump-openclaw.mjs; the npm install → npm ci switch and setMetadata/applyBump split are sound.

#	Severity	Location	Finding
1	Critical	scripts/openclaw-version.mjs (missing) + 3 consumers	Central new module never committed — publish gate, bump script, and version matrix all fail with module-not-found

This is a non-blocking automated review; a human makes the final call.

[apify-factory]

AI Staff Review — PR #36

Verdict: This PR delivers what it set out to do. It fixes the failing release flow by extracting OpenClaw version resolution into a single shared module (scripts/openclaw-version.mjs) consumed by the publish gate, the bump script, and the version-test matrix; pins npm to major 12 everywhere that writes package-lock.json; and switches ci.yml to npm ci + npm run build. The core logic is correct — the X.Y.Z-N respin ordering (sorting -N above X.Y.Z), release-vs-prerelease detection, latestPerPatchLine collapsing, and the "ahead is fine, only behind fails" gate semantics all check out, and the three npm-major pins are in sync. No correctness or security defects found. Two minor, optional findings below.

#	File:line	Issue	Severity
1	scripts/openclaw-version.mjs:86	Redundant npm view round-trip on the common path	low
2	scripts/bump-openclaw.mjs:228	Cryptic error on malformed devDependencies.openclaw	nit

Non-blocking — a human makes the final call.

Note (not anchored to the diff)

The test job in openclaw_version_tests.yml still uses plain npm install (runner default npm ~10) rather than the pinned npm 12 this PR establishes as an invariant. It only produces a pack tarball (not lockfile-sensitive) and the line is unchanged by this PR, so it is not a defect — just the one install site that diverges from the "same npm major everywhere" rule the PR documents.

[apify-factory]

Nit: latestOpenclawVersion() calls openclawReleaseVersions() (a full npm view openclaw versions --json) unconditionally, then fetches dist-tags separately. On the common path the latest dist-tag is a valid release and is returned immediately, so the whole versions list is fetched and discarded — two network round-trips where one suffices. Moving openclawReleaseVersions() into the fallback branch (where the list and empty-list assertion are actually needed) removes the waste. CI-only path, so impact is small.

[apify-factory]

Nit: current comes straight from stripRange(devDependencies.openclaw), so a malformed field (not X.Y.Z[-N]) makes compareVersions → parseVersion throw Not an openclaw release version: <x> rather than a message naming the offending field. The check gate and staleFields() both guard with isReleaseVersion() before comparing; this is the one path that doesn't. Fail-fast is arguably an improvement over the old compareSemver (which silently produced NaN) — only the message clarity is the nit.