feat: add automated OpenClaw upgrade pipeline with CI verification and Copilot-assisted fixes

[vhrahulkumar]

Summary

Adds a fully automated upgrade pipeline that detects new OpenClaw releases, tests them against Docker smoke tests and App Platform E2E, and either opens a PR (if tests pass) or creates an issue with Copilot auto-assigned to investigate (if tests fail).

This replaces the manual process of checking for new versions, bumping the Dockerfile, testing locally, and creating PRs by hand.

How it works

Weekly cycle (every Monday at 2pm UTC)

1. check-version — Compares OPENCLAW_VERSION in Dockerfile against latest stable release. Checks for known upstream regressions.
2. docker-tests — Bumps Dockerfile, builds image, runs 14 smoke checks (04-upgrade-verify.sh)
3. push-e2e-image — Pushes tested image to GHCR with e2e-{run_id} tag
4. app-platform-e2e — Deploys image to App Platform, runs live health checks, tears down
5. open-pr — If all tests pass: creates upgrade PR with test results + release notes
6. open-issue — If tests fail: creates issue with failure details, assigns Copilot to investigate

Copilot auto-fix flow

When tests fail, the workflow:

• Creates a detailed issue with test output, release notes, and known regressions
• Auto-assigns Copilot via COPILOT_TRIGGER_TOKEN (fine-grained PAT)
• Copilot reads .github/copilot-instructions.md for architecture rules and constraints
• Copilot applies minimal fix, opens PR → CI validates → human reviews and merges

Manual trigger

Can be triggered via workflow_dispatch with optional inputs:

• force_version — Force upgrade to a specific version
• image_tag — Skip build, use existing GHCR image for E2E

Files added (7 files, +1790 lines)

File	Purpose
.github/workflows/openclaw-upgrade-check.yml	Main workflow: 6 jobs covering detection → test → PR/issue
.github/copilot-instructions.md	Architecture docs, upgrade rules, anti-patterns, test integrity policy
.github/prompts/openclaw-upgrader.prompt.md	Copilot agent prompt for investigating failed upgrades
tests/minimal/04-upgrade-verify.sh	Docker smoke tests: 14 checks (version, config, gateway, plugins, etc.)
tests/e2e/deploy-and-test.sh	App Platform E2E: deploy, health check via HTTP + logs, teardown
tests/e2e/app-spec-template.yaml	App Platform spec template for E2E test apps
tests/e2e/cleanup-stale-apps.sh	Janitor script for leaked E2E test apps

What the Docker smoke tests verify (14 checks)

• ✅ Version matches Dockerfile
• ✅ Config is valid JSON with correct defaults
• ✅ tools.profile set to coding (not upstream default messaging)
• ✅ Config owned by openclaw user (not root)
• ✅ Gateway auth mode is token
• ✅ Gateway process running + HTTP 200
• ✅ Tailscale binary present
• ✅ Config writable by openclaw user
• ✅ Channel plugins loaded (discord, signal, telegram, whatsapp)
• ✅ Backup config valid + pnpm store excluded
• ✅ openclaw doctor completes
• ✅ Telegram channel probe (optional, if TELEGRAM_BOT_TOKEN set)

What the E2E tests verify

• ✅ App deploys successfully to App Platform
• ✅ Deployment reaches ACTIVE phase
• ✅ Gateway HTTP responds on public URL
• ✅ Config generation completed (from logs)
• ✅ s6 services started (from logs)
• ✅ No fatal errors in logs

Security considerations

• Release notes and regression lists are injected via quoted heredocs (<<'EOF') to prevent shell expansion of upstream content containing $(), backticks, etc.
• Issue bodies use --body-file instead of inline --body to prevent secret leaking
• Copilot triggering uses a separate fine-grained PAT (COPILOT_TRIGGER_TOKEN) scoped to issues only

Required secrets

Secret	Purpose	Required?
DOCTL_TOKEN	Deploy/delete test apps on App Platform	For E2E tests
COPILOT_TRIGGER_TOKEN	Fine-grained PAT (issues:write) to auto-assign Copilot	For auto-fix flow
TELEGRAM_BOT_TOKEN	Telegram channel probe	Optional

Validated against

• 2026.2.9 → 2026.3.11 upgrade — Full pipeline tested: version detection → Docker test failure → issue creation → Copilot auto-fix → PR with passing CI
• 2026.3.11 → 2026.3.22 upgrade — Correctly identified known upstream regression (Control UI assets missing), created issue with regression warnings
• Copilot produced fixes matching the manual upgrade commit (84bf7e8) without modifying test files

No existing files modified

This PR only adds new files. No changes to Dockerfile, rootfs, or existing tests.