$ ~/registry/skill/openclaw-agents-skills-release-openclaw-mac

SKILL

release-openclaw-mac

Run or recover OpenClaw macOS signing, notarization, and release promotion.

Stars

★ 382,582

Source

GitHub

Updated

2026-07-15

// securityLow risk

Prompt only, no code
Open source
Community-trusted· 382.6k

Running security audit…

Credentials
Network egress
Code execution
Data access
Supply chain

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "release-openclaw-mac" skill from askskill:
1. Download https://raw.githubusercontent.com/openclaw/openclaw/main/.agents/skills/release-openclaw-mac/SKILL.md
2. Save it as ~/.claude/skills/release-openclaw-mac/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Recover from a failed mac release notarization

Prompt

Based on the OpenClaw Mac Release process, help me troubleshoot a macOS release notarization that immediately returns 401. Give me a safe check order covering ASC credentials, notarytool history, and GitHub Secrets precautions.

Expected

An ordered troubleshooting checklist covering credential validation, key consistency, and notarization settings.

Run a private preflight release

Prompt

Generate execution guidance for an OpenClaw private mac preflight. Use the release branch as source_ref, keep the stable tag on the original commit, and explain how preflight and validation SHAs must match.

Expected

Maintainer-facing instructions explaining the relationship between source_ref, tag, and validation requirements.

Check 1Password authentication prerequisites

Prompt

Summarize the 1Password prerequisites in the OpenClaw mac release flow: tmux session usage, service token checks, op whoami, and what to do when Touch ID is unavailable.

Expected

A concise prerequisite checklist for safely preparing secret access and authentication.

// use cases

Mac recovery after a stable release

Developers or release maintainers can use it when a stable tag is already live but macOS-only packaging fixes still need to be shipped. It is especially useful for recovery cases where the branch variation differs from the original tagged commit.

Troubleshooting signing and notarization issues

When macOS artifacts sign successfully but notarization fails, or notarytool returns 401, this skill helps troubleshoot ASC credentials, consistent secret sourcing, and the Apple notarization submission flow. It also highlights upload flags that can cause misleading errors.

Configuring the private release environment

Maintainers can use it when setting GitHub Secrets in the private release repository to confirm which ASC fields are required and when they should be updated. It emphasizes that all three fields must come from the same 1Password item and be locally validated first.

// docs

AI summary

The document outlines the OpenClaw macOS release and recovery flow. It covers how to obtain ASC credentials from private configuration and 1Password, how to safely set GitHub Secrets in the private release environment, and how preflight, validation, tags, and source_ref must align. It also highlights notarization troubleshooting tips, including 401 causes and the recommended submission flags, plus example workflow dispatch commands.

Show full docs ▾

OpenClaw Mac Release

Use with $release-openclaw-maintainer, $release-openclaw-ci, $one-password, and $release-private if it exists when stable macOS assets, private mac preflight, notarization, appcast promotion, or mac release recovery is involved.

Credentials

Resolve Peter-owned ASC item refs, key ids, issuer ids, and service-token provenance from $release-private.
Fields: private_key_p8, key_id, issuer_id.
Stale/revoked key symptom: xcrun notarytool submit fails with HTTP status code: 401. Unauthenticated.
Validate candidate ASC credentials with xcrun notarytool history before setting GitHub secrets.

1Password

Use $one-password: all op work inside one persistent tmux session, no secret output.
Use the service-token guidance from $release-private when available.
If a service token fails, run status-only checks: token present/length and op whoami; never print token values.
If desktop app auth is needed but Touch ID is unavailable, set OP_BIOMETRIC_UNLOCK_ENABLED=false for the manual op account add --signin path.

GitHub Secrets

Target private repo environment: openclaw/releases-private, env mac-release.

Set only after local notary auth validation:

APP_STORE_CONNECT_API_KEY_P8
APP_STORE_CONNECT_KEY_ID
APP_STORE_CONNECT_ISSUER_ID

Do not update these from mixed sources. All three ASC fields must come from the same 1Password item.

Workflow Shape

Public release branch may carry mac-only packaging fixes after the stable tag/npm are already live.
Use source_ref=release/YYYY.M.D for private mac preflight/validation when building that branch variation.
Keep tag=vYYYY.M.D pointing at the original stable release commit.
Real mac publish must reuse:
- a successful private mac preflight run for the same tag/source SHA
- a successful private mac validation run for the same tag/source SHA
If preflight source SHA differs from tag SHA, validation must also use the same source_ref; promotion rejects mismatched proof.

Notarization

OpenClaw uses scripts/notarize-mac-artifact.sh.
xcrun notarytool submit should use --no-s3-acceleration; accelerated upload can surface misleading 401s even when notarytool history succeeds.
If signing succeeds but notarization fails immediately with 401, check ASC key freshness first.
If notarization stays in progress for several minutes after key-file write, that is normal Apple wait time; do not edit blindly.

Dispatch

Private preflight:

gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
  -f tag=vYYYY.M.D \
  -f source_ref=release/YYYY.M.D \
  -f preflight_only=true \
  -f smoke_test_only=false \
  -f allow_late_calver_recovery=false \
  -f public_release_branch=release/YYYY.M.D

Private validation for a branch-variation preflight:

gh workflow run openclaw-macos-validate.yml --repo openclaw/releases-private --ref main \
  -f tag=vYYYY.M.D \
  -f source_ref=release/YYYY.M.D

Real publish:

gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
  -f tag=vYYYY.M.D \
  -f preflight_only=false \
  -f smoke_test_only=false \
  -f preflight_run_id=<successful-preflight-run> \
  -f validate_run_id=<successful-validation-run> \
  -f allow_late_calver_recovery=false \
  -f public_release_branch=release/YYYY.M.D

Verify

gh release view vYYYY.M.D --repo openclaw/openclaw shows zip, dmg, dSYM zip, not draft, not prerelease.
Public main appcast.xml points at OpenClaw-YYYY.M.D.zip.
Appcast entry has sparkle:version, sparkle:shortVersionString, length, and sparkle:edSignature.

// FAQ

What is this skill mainly used for?

It is used to run or recover the OpenClaw macOS release process, including signing, notarization, private preflight, validation, and asset promotion. The docs also indicate it works alongside related skills and private configuration.

What credentials or prerequisites does it need?

The docs show it depends on ASC fields: private_key_p8, key_id, and issuer_id, which should be resolved from private configuration and 1Password. `op` work should be done inside a persistent tmux session, and secret values must not be printed.

If notarization returns 401, what should be checked first?

First check whether the ASC key is stale or revoked, and validate candidate credentials with `xcrun notarytool history`. The docs also say to use `--no-s3-acceleration`, because accelerated uploads can produce misleading 401 errors.

Choose and run the safest, cheapest OpenClaw test and validation path.

openclawGet→

$ loading_