improve(ci): cache release channel builds

[vincentkoc]

What Problem This Solves

Release Channel RTT matrix jobs rebuilt both the historical OpenClaw release and the current QA harness from scratch for every channel/version entry, even though both builds already maintain validated native build caches. A cold job spent 4m59s building the release and 4m34s building the QA harness, or 9m33s before sampling, and the workflow did not persist those caches for later exact-source jobs.

Exact-head review then found a cache-safety blocker: the channel package was linked into ignored node_modules before both builds. That link could affect build output without participating in the cache identity, allowing an immutable v1 entry to contain channel-dependent output under a channel-independent key.

Why This Change Was Made

The workflow now restores and saves only each checkout's native .artifacts/build-all-cache around the existing full pnpm build commands.

Cache identity is exact and stable:

• release: runner OS, architecture, actual Node version, actual pnpm version, the full private-QA build profile, and release HEAD
• QA harness: the same runtime/build identity plus immutable QA HEAD and a digest of all compatibility-patched tracked and added files

There are no restore prefixes or cross-revision fallbacks. Cache saves run only after a primary-key miss and use the restore action's cache-primary-key, so concurrent cold jobs race safely on one immutable entry instead of uploading duplicate warm caches.

Both full builds and both cache saves now complete before the channel package link is created. The link step runs immediately before RTT sampling, so cached build output cannot capture channel-dependent node_modules state. The cache namespace is bumped from openclaw-release-channel-rtt-build-v1 to ...-v2; immutable v1 entries cannot hit and suppress repaired cache saves.

Manual benchmark dispatches can set publish_results=false. Measurement and evidence artifacts still run normally, while the privileged report job is skipped so benchmark runs cannot update RTT data or README state.

Dispatches can also set prepare_only=true to execute the existing checkout, install, compatibility patch, verification, full-build, and native cache-save path without linking a channel package or starting live RTT work. Prepare-only matrix jobs use a run-scoped concurrency group so they do not queue behind normal channel measurements, while max-parallel: 1 still lets the first matrix entry seed later exact-source entries in the same run. Normal runs retain the exact channel-rtt-measure-<channel> grouping and the qa-live-shared environment.

User Impact

Scheduled and normal manual Release Channel RTT runs retain their existing publication, credential, retry, channel, artifact, and full-build behavior. Exact-source matrix jobs can reuse validated build work instead of repeatedly paying the cold build cost.

Permissions remain split: measurement has actions: read and contents: read; only the report job has contents: write, and that job is skipped for non-publishing benchmarks. The cache excludes node_modules, QA evidence, workspace artifacts, RTT imports, and repository data.

Prepare-only mode skips channel linking, sampling, import preparation/upload, diagnostic upload, and the report job even though publish_results defaults to true. Both secret expressions remain confined to the skipped sample step, so prepare-only jobs do not materialize live credential environment variables.

Evidence

• Cold build baseline: 4m59s release + 4m34s QA harness = 9m33s.
• Compressed native cache evidence: 4.77 MB release cache and 4.80 MB QA harness cache.
• Exact-head v2 prepare-only benchmark: https://github.com/openclaw/openclaw-rtt/actions/runs/33867310272 at 95543e2818852edc8f8bd6e049f1e993026f77ff.
  • cold Slack leg: 317s release + 329s QA = 646s
  • warm cross-channel WhatsApp leg: 233s release + 213s QA = 446s
  • one observed serial hosted reduction: 200s saved, 31.0% reduction, 1.45x faster
• The warm leg restored both outer v2 caches and skipped both save steps. OpenClaw's native cache explicitly restored tsdown-ai, tsdown-packages, and startup metadata (write-cli-startup-metadata). The tsdown-unified and plugin-SDK declaration partitions rejected signature mismatches and rebuilt safely.
• Prepare-only behavior was observed end to end: channel linking, sampling, import preparation/upload, diagnostic upload, and the report job were all skipped.
• Benchmark verdict: this single serial hosted run observed a 31.0% reduction and clears the 15% performance gate. It is not a fully deterministic or fully cache-attributable result; long-run savings remain to be measured. The PR remains draft pending the final verdict.
• Run 33861186234 completed and remains the historical cold evidence. Current-task obsolete runs 33864851729, 33865306984, and 33866434154 were cancelled because they cannot provide exact-head evidence.
• Focused workflow tests: 24/24 pass.
• Full Node test suite: 200/200 pass.
• Actionlint: pass.
• Repository validators: 431 RTT rows, 645 Discord RTT rows, 2405 channel RTT rows, and 632 surface RTT rows.
• README generation is byte-stable.
• Workflow raw delta: +99/-27; discounting the pure 24-line link-step move, functional production/tooling delta is +75/-3. Tests: +181/-4.

Follow-Up

Named follow-up: investigate OpenClaw declaration signature instability in the tsdown-unified and plugin-SDK partitions, then bump the RTT cache namespace when fixed so repaired native cache records repopulate cleanly.

If build time remains a material share after cache reuse, split release and QA builds into independent artifact-producing jobs, then let credential-bound channel measurement consume those immutable build artifacts. That larger workflow change should be evaluated separately because it changes job topology, artifact transfer, and failure ownership.

[vincentkoc]

@clawsweeper review