Outcome: webhook triggers git fetch, npm ci, npm audit, and OpenClaw gateway status JSON merged for one build summary.
Links: blog, help, gateway status gate.
Why SourceHut builds still feel flaky on shared remote Mac pools
- Cold npm. Manifest churn re-downloads large tarballs unless a hook warms cache first.
- Lock drift. package.json moves without package-lock.json so green CI hides broken releases.
- Log noise. Raw npm logs hide signal without one JSON bundle keyed by commit SHA.
Decision matrix: sr.ht image concurrency, Git retries, disk watermarks
Pick one lane per pool and document it beside your manifest.
| Signal | Conservative | Aggressive |
|---|---|---|
| Concurrent sr.ht images on one Mac | One job; file lock around prefetch | Two jobs max; split NPM_CONFIG_CACHE by job id |
| Git fetch retries | Three tries; two second base backoff plus jitter | Five tries; forty second cap then fail with network code |
| Disk watermark | Abort prefetch below twenty five GB free | Warn at thirty GB; LRU prune cache near twenty GB free |
Reproducible Node twenty four and OpenClaw install snippets
OpenClaw here assumes Node twenty four or newer.
# Official Node.js macOS arm64 tarball (replace version as needed)
VER=24.11.1
curl -fsSL "https://nodejs.org/dist/v${VER}/node-v${VER}-darwin-arm64.tar.xz" -o /tmp/node.tar.xz
tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components 1
node -v # must print v24.x
# Global OpenClaw from the public registry
npm install -g openclaw@latest
command -v openclaw
openclaw --version
Use a system prefix launchd can see; avoid nvm-only PATH in daemons.
Chained acceptance after prefetch: npm ci, audit, gateway JSON
Run in the webhook workspace before uploading summaries.
export CI=true
git fetch origin --depth=50 --prune
npm ci --prefer-offline --no-audit
npm install --package-lock-only --ignore-scripts
git diff --exit-code package-lock.json || { echo package_lock_drift; exit 1; }
npm audit --json > npm-audit.json || true
openclaw gateway status --json > gateway-status.json
openclaw doctor 2>&1 | tail -n 80 > doctor-tail.txt
jq -s '{audit:.[0],gateway:.[1]}' npm-audit.json gateway-status.json > merged-ci.json
Operational checklist from builds.sr.ht hook to CI summary
- Add HTTPS webhook URL with shared secret; terminate TLS on a public reverse proxy.
- Verify signature or secret; drop replays older than five minutes.
- Prefetch shell: fetch with matrix backoff, then npm ci warm path.
- Run the chain block; redact tokens in merged-ci.json and doctor-tail.txt.
- Upload artifacts or POST trimmed JSON; append one grep friendly status line to sr.ht logs.
Citable facts for architecture reviews
- Node gate: automation must run Node twenty four before OpenClaw.
- Disk: keep twenty GB free where npm cache and git objects share APFS.
- Latency: aim under ninety seconds for prefetch plus audit on medium repos.
Frequently asked questions
Tokens. Vault sr.ht PATs, inject at runtime, rotate quarterly, least scope.
TLS. Public CA, full chain on nginx or caddy, disable weak TLS at the edge.
Port 18789 conflicts. Use lsof first; pick a smoke port or read JSON from an existing daemon.
Idempotency. Key work by commit SHA plus build id so duplicate hooks do not double npm ci.
Latency. Co-locate Mac pools with git primary or bundles so fetch retries stay rare.
Summary and public next steps
Prefetch on webhook, enforce lockfiles, merge audit and gateway JSON, publish one summary. Browse the blog, pricing, help, or home.
NVMe remote Mac for sr.ht plus OpenClaw
Keep hooks, npm cache, and gateways in one region.