fix: await definitive ClawHub publication

[goldmar]

Summary

• update the pinned ClawHub CLI from 0.23.1 to 0.23.3, which exposes authoritative publish-attempt polling
• wait up to ClawHub's supported 40-minute publication bound before treating a submission as published
• verify the exact retained tarball after definitive publication and remove fixed-delay public-version probes
• add focused workflow contract coverage

Root cause

ClawHub package publication is two-phase. CLI 0.23.1 returned after upload acceptance with a releaseId, before pre-publication security checks finalized the version. package verify reads the public version endpoint, so the existing 5/10/20/40/60 loop repeatedly saw Version not found (and rate-limit reset metadata) while the exact publication attempt was still pending. ClawHub 0.23.3 adds authenticated --wait polling of that exact attempt and fails closed on blocked, failed, expired, or timed-out states.

Verification

• pnpm test:file tests/release-workflow.test.ts
• pnpm verify
• pnpm check-plugin-security
• pnpm validate:release-metadata -- 4.7.10
• pnpm audit:prod
• pnpm verify:npm-consumer
• actionlint
• git diff --check

No local plugin installation or Gateway restart is included.

[github-actions]

Bundle Size Report

Runtime file	Size
dist/chunks/agent-pr.js	0.6 KB
dist/chunks/chunk.js	112.9 KB
dist/chunks/npm-release-client.js	0.2 KB
dist/index.js	427.0 KB
Total	540.8 KB

Limit	Status
600.0 KB	✅ Within limit

Complete bundle is within the 600.0 KB limit.

[greptile-apps]

Greptile Summary

The PR updates the pinned ClawHub CLI and changes the release workflow to await the definitive publication-attempt result before verifying the retained tarball.

• Pins ClawHub CLI 0.23.3.
• Replaces fixed-delay verification retries with package publish --wait --wait-timeout 2400.
• Adds workflow contract tests covering the wait-and-verify sequence and removal of fixed sleeps.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defects identified.

The workflow now waits for ClawHub’s definitive publication result and verifies the same retained artifact afterward, while the added tests cover the intended release-workflow contract.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Pins ClawHub 0.23.3 and waits for the exact publication attempt to reach a definitive state before verifying the artifact.
tests/release-workflow.test.ts	Adds focused, CI-discovered text-contract tests for the CLI pin, publication wait sequence, and removal of fixed sleeps.

Sequence Diagram

sequenceDiagram
    participant Workflow as Release workflow
    participant CLI as ClawHub CLI 0.23.3
    participant Hub as ClawHub
    Workflow->>CLI: package publish --wait --wait-timeout 2400
    CLI->>Hub: Upload artifact
    loop Poll exact publication attempt
        CLI->>Hub: Request publication state
        Hub-->>CLI: Pending or terminal state
    end
    CLI-->>Workflow: Published or non-zero terminal failure
    Workflow->>CLI: package verify exact tarball
    CLI->>Hub: Resolve published artifact metadata
    CLI-->>Workflow: Verification result

Loading

_{Reviews (1): Last reviewed commit: "fix: await definitive ClawHub publicatio..." | Re-trigger Greptile}