CI/CD Pipeline API & Skill Testing Reference

Pipeline API

The ClawProd pipeline runs automatically on every git push via a GitHub Action. In this local preview, the dashboard uses the pipeline endpoints below.

Trigger a Build

Run Evidence Gate

Get Build Status

List Builds

Pipeline Stages

Every build runs five stages in order. A failure at the evidence gate blocks publish.

1. Lint — Validates skill manifest, metadata fields, and file structure against the OpenClaw skill spec.
2. Test — Runs your test suite in an isolated sandbox. If no custom tests exist, runs the default test suite (manifest validation, permission checks, basic execution).
3. Build — Packages the workspace and prepares the release artifact for scanning.
4. Evidence Gate — Runs the shared @claw/evidence scanner against OpenClaw artifacts and emits JSON control evidence.
5. Publish — On pass, bumps version, generates changelog, and publishes to ClawHub. Only runs if publish: true.

Skill Testing Framework

ClawProd includes a built-in testing framework for OpenClaw skills. Tests run in a sandboxed environment with a real OpenClaw instance.

Test File Structure

Default Test Suite

Skills without custom tests still get checked against the default suite:

• Manifest schema validation (required fields, correct types)
• Permission scope verification (no unnecessary permissions)
• Basic execution test (skill loads and responds without error)
• Dependency version check (no known-vulnerable packages)

Security Scanning Reference

The security scanner runs five checks on every build:

• CVE scan — Checks all dependencies against the National Vulnerability Database.
• Permission analysis — Flags skills requesting more permissions than their functionality requires.
• Data exfiltration detection — Identifies patterns like unauthorized network calls, file system reads outside scope, or credential harvesting.
• Prompt injection vectors — Scans for common injection patterns in skill prompts and input handling.
• Custom policies — Enterprise users can define organization-specific security rules.

GitHub Action Setup

The first release gate is the shared OpenClaw evidence scanner. It reads an AGENTS.md, SOUL.md, or skill config and emits a JSON artifact that CI can fail on.