build(deps): refresh eligible tooling and add release validation

.github/workflows/codeql.yml

@@ -66,13 +66,13 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ matrix.config_file }}
 
       - name: Analyze
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: "/codeql/${{ matrix.category }}"

.github/workflows/release.yml

@@ -10,12 +10,17 @@ on:
         description: "Existing release tag to publish, for example v0.5.1"
         required: true
         type: string
+      dry_run:
+        description: "Validate the selected ref without publishing"
+        required: false
+        default: true
+        type: boolean
 
 permissions: {}
 
 jobs:
   release:
-    name: Publish npm and GitHub release
+    name: Validate or publish release
     runs-on: ubuntu-latest
     environment: npm-release
     timeout-minutes: 20
@@ -37,12 +42,12 @@ jobs:
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
           echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
 
-      - name: Check out release tag
+      - name: Check out release source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: ${{ steps.release.outputs.tag }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run && github.sha || steps.release.outputs.tag }}
 
       - name: Verify release metadata
         env:
@@ -86,6 +91,7 @@ jobs:
           pnpm pack:smoke
 
       - name: Publish npm package with trusted publishing
+        if: ${{ github.event_name != 'workflow_dispatch' || !inputs.dry_run }}
         run: npm publish --access public --provenance
 
       - name: Build release notes
@@ -100,6 +106,7 @@ jobs:
           ' CHANGELOG.md > release-notes.md
 
       - name: Publish GitHub release
+        if: ${{ github.event_name != 'workflow_dispatch' || !inputs.dry_run }}
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ steps.release.outputs.tag }}

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## 0.8.3 - Unreleased
 
+- Updated Zod to 4.6.7, Vitest and V8 coverage to 5.0.5, Oxfmt to 0.73.0, Oxlint to 1.88.0, and CodeQL to 4.39.0 within the 48-hour dependency release-age policy, thanks @dependabot[bot].
+- Added a no-publish release workflow dry run that validates the selected ref and defaults on for manual dispatch.
 - Fixed provider JSON extraction to recover structured results after unmatched braces in leading prose, thanks @goutamadwant and @notlakshitha.
 - Updated Node setup to 7.1.0, CodeQL to 4.38.3, and both the TruffleHog action and scanner to 3.99.2, thanks @dependabot[bot].
 - Updated Oxfmt to 0.72.0 and Oxlint to 1.87.0 for repository formatting and linting, thanks @dependabot[bot].

docs/release-prep.md

@@ -40,6 +40,19 @@ npm pack --dry-run --json --ignore-scripts
 
 ## Manual Checks
 
+To validate the release pipeline against the current default branch without
+publishing, dispatch the Release workflow with the current package version:
+
+```bash
+gh workflow run release.yml --repo openclaw/clawpatch --ref main -f tag_name=v0.8.2 -F dry_run=true
+```
+
+Manual dispatch defaults to `dry_run: true`. It checks out the selected workflow
+ref, validates the package version and dated changelog entry, and runs the same
+build and package checks while skipping both npm and GitHub publication. An
+authorized manual publication must explicitly set `dry_run: false`; tag pushes
+retain the release behavior.
+
 - Confirm npm Trusted Publisher is bound to GitHub repository
   `openclaw/clawpatch`, workflow filename `release.yml`, environment
   `npm-release`, and the `npm publish` action.

package.json

@@ -44,7 +44,7 @@
     "@types/node": "^22.20.4",
     "@types/proper-lockfile": "^4.1.4",
     "@vitest/coverage-v8": "^5.0.1",
-    "oxfmt": "^0.72.0",
+    "oxfmt": "^0.73.0",
     "oxlint": "^1.86.0",
     "typescript": "^7.0.2",
     "vitest": "^5.0.1"