Putting OpenClaw in CI boils down to three questions: who triggers it, where it runs, and how it authenticates. GitHub-hosted macOS runners and self-hosted runners on MacCloud can coexist—the former for light steps, the latter when you care about disk, kexts, or long-lived services.
1. Triggers: do not run the full pipeline on every push
Use workflow_dispatch or schedules for long jobs; filter paths on pull requests to avoid burning minutes. Keep OpenClaw steps in a dedicated job so they are not constantly interrupted inside a generic lint matrix.
2. Secrets, tokens, and audit
Store production secrets in GitHub Environments with required reviewers. For MacCloud APIs or ticket APIs, use short-lived tokens on a rotation schedule—never hard-code them in the repo. Audit logs should answer “which run used which credential”.
3. Self-hosted runners on MacCloud
After registering a runner on a dedicated Mac, tag OpenClaw jobs explicitly (for example runs-on: [self-hosted, macOS, openclaw]) and isolate them from generic iOS build queues. Before OS maintenance, disable the runner in GitHub so a half-upgraded machine does not pick up work.
4. Cache, artifacts, and logs
Use Actions cache or an internal artifact registry for large dependencies; upload logs and reports as artifacts so they line up with OpenClaw-side events. Cache keys should include lockfile hashes so you do not “hit” stale dependencies while thinking you are current.
5. Shrinking blast radius on failure
Set timeouts and retry ceilings on OpenClaw steps; unrecoverable errors (auth failure, quota exhausted) should fail fast and label the run instead of retrying forever and clogging the queue. Match backoff rules with automation scenarios.
6. Self-check list
- Do triggers cover default branch, PRs, and manual flows?
- Do environment protection rules block unreviewed fork PRs?
- Do runner tags map one-to-one to job matrices without leaks?
- Do artifacts include logs at a useful verbosity for triage?
When long-lived processes share the machine with runners, re-read MacCloud in practice for disk, graceful shutdown, and billing boundaries.
