Add GitHub Actions workflow for NodeJS with Webpack

[samhiotisiddn-jpg]

What Problem This Solves

User Impact

Why This Change Was Made

Evidence

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 15, 2026, 7:42 AM ET / 11:42 UTC.

ClawSweeper review

What this changes

Adds a GitHub Actions workflow that runs npm install and Webpack on Node 18, 20, and 22 for pushes and pull requests targeting main.

Merge readiness

⛔ Blocked before merge - 11 items remain

Not ready to merge: existing CI already covers supported Node builds, while this additional workflow uses an unrelated build tool and bypasses dependency safeguards. The repository's conservative closure policy does not permit closing this as an exact implemented change.

Priority: P2
Reviewed head: f0801ab057ab2ecfc2144d09f1e148cb3730c002

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The patch does not match the repository's build contract and supplies no execution evidence.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The new workflow owns the Node matrix and build invocation, but the complete supplied body and discussion provide no after-change execution showing those jobs build the CLI. Redacted Actions logs or terminal output from the actual retained build path would be relevant proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦪 silver shellfish (2/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The new workflow owns the Node matrix and build invocation, but the complete supplied body and discussion provide no after-change execution showing those jobs build the CLI. Redacted Actions logs or terminal output from the actual retained build path would be relevant proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	7 items	Verified introduced workflow: The pinned base-to-head delta adds only this 28-line workflow; its matrix and install/build commands are introduced by this PR. Actual build and runtime contract: The package builds with tsc, publishes dist/cli.js, requires Node >=22, and pins pnpm. Neither package.json nor pnpm-lock.yaml declares Webpack; the tracked source has no Webpack configuration or default src/index entry. Existing main and release coverage: Read ci.yml on fetched main and v0.8.1: both already run frozen pnpm installs, TypeScript builds, and package smoke checks on Node 22, 24, and 26. This establishes overlapping coverage, not an implementation of the proposed Webpack path.
Findings	4 actionable findings	[P1] Extend the existing CI instead of adding a competing build path [P2] Invoke the repository's TypeScript build [P2] Preserve the locked pnpm dependency installation
Security	Needs attention	Dependency installation bypasses repository safeguards: npm install does not enforce pnpm-lock.yaml or the release-age and override settings in pnpm-workspace.yaml; the following npx command also requests tooling absent from the declared dependencies.

How this fits together

Clawpatch is a TypeScript CLI compiled into dist using TypeScript. Its GitHub Actions CI installs locked dependencies, checks the source, and verifies builds and installed-package behavior on supported Node versions.

flowchart TD
  A[Push or pull request] --> B[Existing CI]
  B --> C[Locked pnpm dependencies]
  C --> D[TypeScript build and package checks]
  A --> E[Proposed Node matrix]
  E --> F[npm install and Webpack]
  F --> G[Unconfigured build path]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The new workflow owns the Node matrix and build invocation, but the complete supplied body and discussion provide no after-change execution showing those jobs build the CLI. Redacted Actions logs or terminal output from the actual retained build path would be relevant proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Extend the existing CI instead of adding a competing build path (P1) - Every matching push and pull request already runs .github/workflows/ci.yml, which builds and checks the installed package on Node 22, 24, and 26. This adds another build definition with different dependencies and tooling without identifying missing coverage, creating conflicting CI results and maintenance drift. Put any demonstrated additional coverage in the existing workflow.
• Invoke the repository's TypeScript build (P2) - package.json builds this CLI with tsc -p tsconfig.build.json; Webpack and webpack-cli are not declared, and there is no Webpack configuration or default entry point. npx webpack therefore cannot validate the published CLI build and may attempt to obtain undeclared tooling. Use the existing pnpm build path.
• Preserve the locked pnpm dependency installation (P2) - npm install ignores the committed pnpm lockfile and pnpm-workspace.yaml, including its 2880-minute release-age safeguard and dependency overrides. This lets CI install and execute a different dependency graph from the one reviewed and used by existing CI. Set up the pinned pnpm version and use pnpm install --frozen-lockfile.
• Keep the matrix within the supported Node versions (P2) - Node 18 and 20 are below package.json's Node >=22 requirement and the documented development-toolchain floor. These jobs cannot provide valid compatibility coverage for the current package and can fail on toolchain requirements. Use the supported versions already represented in CI.
• Resolve security concern: Dependency installation bypasses repository safeguards - npm install does not enforce pnpm-lock.yaml or the release-age and override settings in pnpm-workspace.yaml; the following npx command also requests tooling absent from the declared dependencies.
• Resolve merge risk (P1) - The additional CI path can resolve and execute dependencies outside the repository's lockfile, release-age policy, and overrides.
• Resolve merge risk (P1) - No execution evidence establishes that any of the proposed matrix jobs completes the intended build.
• Complete next step (P2) - Replace the duplicate workflow with a justified CI change, resolve the build and dependency-policy findings, and provide redacted after-change execution evidence before merge.
• Improve patch quality - Identify a concrete CI gap and address it in the existing workflow while preserving supported runtimes and dependency safeguards.
• Improve patch quality - Add after-change execution logs, redacting credentials and private details; updating the PR body should trigger review, or a maintainer can comment @clawsweeper re-review.

Findings

• [P1] Extend the existing CI instead of adding a competing build path — .github/workflows/webpack.yml:3-7
• [P2] Invoke the repository's TypeScript build — .github/workflows/webpack.yml:28
• [P2] Preserve the locked pnpm dependency installation — .github/workflows/webpack.yml:27
• [medium] Dependency installation bypasses repository safeguards — .github/workflows/webpack.yml:27

Agent review details

Security

Needs attention: The workflow adds dependency execution outside the repository's existing resolution and supply-chain safeguards.

Review metrics

Metric	Value	Why it matters
Additional matrix jobs	3 added; 2 below the supported Node floor	Every matching event would schedule Node 18 and 20 alongside Node 22 despite the documented Node >=22 requirement.

Merge-risk options

Maintainer options:

1. Narrow to missing CI coverage (recommended)
   Replace the parallel workflow with a justified addition to existing CI that preserves its build and dependency safeguards.
2. Pause the additional workflow
   Leave this unmerged until a concrete coverage gap warrants another CI path.

Technical review

Best possible solution:

Keep one authoritative CI workflow and add only demonstrated missing coverage using supported Node versions, frozen pnpm installs, and the existing TypeScript build.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes the workflow mismatch: it invokes Webpack without a declared dependency, configuration, or matching entry point, and selects runtimes below the package requirement. No workflow or target code was executed in this read-only review.

Is this the best way to solve the issue?

No. Existing CI already provides supported-runtime build coverage; a justified extension of that workflow would avoid a competing build and dependency-install path.

Full review comments:

• [P1] Extend the existing CI instead of adding a competing build path — .github/workflows/webpack.yml:3-7
  Every matching push and pull request already runs .github/workflows/ci.yml, which builds and checks the installed package on Node 22, 24, and 26. This adds another build definition with different dependencies and tooling without identifying missing coverage, creating conflicting CI results and maintenance drift. Put any demonstrated additional coverage in the existing workflow.
  Confidence: 0.98
• [P2] Invoke the repository's TypeScript build — .github/workflows/webpack.yml:28
package.json builds this CLI with tsc -p tsconfig.build.json; Webpack and webpack-cli are not declared, and there is no Webpack configuration or default entry point. npx webpack therefore cannot validate the published CLI build and may attempt to obtain undeclared tooling. Use the existing pnpm build path.
  Confidence: 0.99
• [P2] Preserve the locked pnpm dependency installation — .github/workflows/webpack.yml:27
npm install ignores the committed pnpm lockfile and pnpm-workspace.yaml, including its 2880-minute release-age safeguard and dependency overrides. This lets CI install and execute a different dependency graph from the one reviewed and used by existing CI. Set up the pinned pnpm version and use pnpm install --frozen-lockfile.
  Confidence: 0.99
• [P2] Keep the matrix within the supported Node versions — .github/workflows/webpack.yml:15
  Node 18 and 20 are below package.json's Node >=22 requirement and the documented development-toolchain floor. These jobs cannot provide valid compatibility coverage for the current package and can fail on toolchain requirements. Use the supported versions already represented in CI.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4d3dad28a600.

Labels

Label changes:

• add P2: This is a bounded CI proposal with no established urgent user-facing regression.
• add merge-risk: 🚨 security-boundary: The new install path bypasses committed dependency resolution and pnpm supply-chain safeguards.
• add merge-risk: 🚨 automation: The introduced workflow invokes an unconfigured build tool and schedules unsupported runtimes.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The new workflow owns the Node matrix and build invocation, but the complete supplied body and discussion provide no after-change execution showing those jobs build the CLI. Redacted Actions logs or terminal output from the actual retained build path would be relevant proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded CI proposal with no established urgent user-facing regression.
• merge-risk: 🚨 automation: The introduced workflow invokes an unconfigured build tool and schedules unsupported runtimes.
• merge-risk: 🚨 security-boundary: The new install path bypasses committed dependency resolution and pnpm supply-chain safeguards.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The new workflow owns the Node matrix and build invocation, but the complete supplied body and discussion provide no after-change execution showing those jobs build the CLI. Redacted Actions logs or terminal output from the actual retained build path would be relevant proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Dependency installation bypasses repository safeguards — .github/workflows/webpack.yml:27
  npm install does not enforce pnpm-lock.yaml or the release-age and override settings in pnpm-workspace.yaml; the following npx command also requests tooling absent from the declared dependencies.
  Confidence: 0.99

What I checked:

• Verified introduced workflow: The pinned base-to-head delta adds only this 28-line workflow; its matrix and install/build commands are introduced by this PR. (.github/workflows/webpack.yml:15, f0801ab057ab)
• Actual build and runtime contract: The package builds with tsc, publishes dist/cli.js, requires Node >=22, and pins pnpm. Neither package.json nor pnpm-lock.yaml declares Webpack; the tracked source has no Webpack configuration or default src/index entry. (package.json:21, 4d3dad28a600)
• Existing main and release coverage: Read ci.yml on fetched main and v0.8.1: both already run frozen pnpm installs, TypeScript builds, and package smoke checks on Node 22, 24, and 26. This establishes overlapping coverage, not an implementation of the proposed Webpack path. (.github/workflows/ci.yml:46, 4d3dad28a600)
• Dependency safeguards: pnpm-workspace.yaml sets minimumReleaseAge to 2880 minutes and overrides nanoid and vite. npm install does not apply this pnpm policy or consume the committed pnpm lockfile. (pnpm-workspace.yaml:1, 4d3dad28a600)
• Merged CI direction: GitHub verifies chore: update dependencies and verify supported Node runtimes in CI #209 as merged. Its body explicitly establishes supported-runtime CI, immutable Action references, frozen installs, and the dependency release-age policy. (.github/workflows/ci.yml:46, b979f94701be)
• Area history and routing: Recent CI history includes Peter Steinberger's runtime and tooling work and Sebastien Tardif's Windows execution coverage. Exact line-introduction attribution remains unverified: blame and a historical patch read failed when missing objects could not be retrieved. (.github/workflows/ci.yml, 4d3dad28a600)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.