chore: keep OpenClaw dependency in lockstep

[willkill07]

Overview

Keep the OpenClaw plugin package dependency on nemo-flow-node aligned with the package version emitted by repository versioning and packaging workflows.

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Change nemo-flow-openclaw to depend on the exact checked-in nemo-flow-node version.
• Add a justfile helper that updates package dependency versions in both package.json and package-lock.json.
• Wire the dependency update into set-version, package-node, and package-openclaw so prerelease package builds keep the Node and OpenClaw versions together.
• Align OpenClaw non-tag CI package version suffixing with the Node package workflow.

Validation run:

• just set-version 0.2.0-alpha.20260514, verified OpenClaw's nemo-flow-node dependency updated without dependency success logs, then restored with just set-version 0.2.0.
• npm install --workspace=nemo-flow-node --ignore-scripts
• npm install --workspace=nemo-flow-openclaw --ignore-scripts
• npm run typecheck --workspace=nemo-flow-openclaw
• npm run pack:check --workspace=nemo-flow-openclaw
• just --list
• git diff --check
• Commit-time pre-commit hooks passed for the staged files.

Where should the reviewer start?

Start with justfile, especially the new package dependency version helper and its calls from set_node_package_versions, package-node, and package-openclaw.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to: none

Summary by CodeRabbit

Release Notes

• Chores
  • Refined OpenClaw package versioning format for improved clarity
  • Pinned nemo-flow-node dependency to a stable version for enhanced reliability
  • Improved build and packaging tooling to ensure consistent dependency alignment

[coderabbitai]

Walkthrough

Updates OpenClaw packaging to synchronize nemo-flow-node dependency version with the computed package version. Adds a helper function to update npm package dependencies, changes CI version format from hyphenated to semantic build metadata syntax, pins the initial dependency version, and integrates the helper into packaging recipes.

Changes

OpenClaw nemo-flow-node dependency synchronization

Layer / File(s)	Summary
CI version format and dependency pin .github/workflows/ci_openclaw.yml, integrations/openclaw/package.json	CI workflow version for non-tag refs now uses semantic build metadata syntax (+ format). OpenClaw package.json pins nemo-flow-node from range to fixed version 0.2.0.
Dependency version update helper justfile	New set_npm_package_dependency_version shell function validates and updates a specific dependency version in both package.json and optional package-lock.json entries.
Packaging recipe integration justfile	set_node_package_versions, package-node, and package-openclaw recipes now use the helper to propagate the computed package version into the nemo-flow-node dependency within integrations/openclaw.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• NVIDIA/NeMo-Flow#95: Both PRs extend justfile tooling to keep integrations/openclaw versioning aligned with Node/OpenClaw packaging workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows Conventional Commits format with type 'chore', concise imperative summary, no breaking change marker needed, and is well under 72 characters.
Description check	✅ Passed	Description includes all required template sections: Overview with confirmation checkboxes, Details explaining changes and validation, Where to start guidance, and Related Issues acknowledgment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@justfile`:
- Around line 316-383: The set_npm_package_dependency_version helper updates
manifest and lock but doesn't report when it actually writes changes; add
concise logging after the writeJson calls to mirror set_npm_package_version
behavior: log a message when manifest was updated (after writeJson(pkgPath,
manifest)) mentioning dependencyName, version and pkgPath, and log a message
when lock was updated (after writeJson(lockPath, lock)) mentioning
dependencyName, version and lockPath/lockPackagePath; locate these places around
manifestChanged handling and the lockChanged handling in the
set_npm_package_dependency_version function (references:
set_npm_package_dependency_version, manifest, lock, manifestChanged,
lockChanged, writeJson).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 836385e5-9b70-44cb-a7e8-ab1181e05d19

📥 Commits

Reviewing files that changed from the base of the PR and between 47e3414 and 758c8b2.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• .github/workflows/ci_openclaw.yml
• integrations/openclaw/package.json
• justfile

📜 Review details

🧰 Additional context used

📓 Path-based instructions (7)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)

.github/workflows/**/*.{yml,yaml}: Put permissions: on each job that needs token access in GitHub Actions workflows
Avoid workflow-level permissions unless the repository intentionally centralizes them and the inheritance tradeoff is documented
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA
Prefer action-native or ecosystem-native caching over generic actions/cache in GitHub Actions workflows
Use lockfiles or dependency manifests to drive cache invalidation in GitHub Actions workflows
Keep deploy and publish permissions isolated to the jobs that need them
Read both caller and callee when a workflow uses workflow_call in GitHub Actions
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior
Keep release-tag policy aligned with RELEASING.md: raw SemVer tags only, no leading v
contents: read is the default minimum for checkout-based build, test, docs, and packaging jobs
pull-requests: read is required for PR metadata lookup jobs in GitHub Actions workflows
pages: write and id-token: write should be limited to Pages deployment jobs and any caller that invokes them through a reusable workflow
For reusable workflows, the caller must grant every permission the called jobs require and the callee cannot elevate beyond what the caller provides
Prefer astral-sh/setup-uv cache support with cache-dependency-glob anchored to uv.lock for Python dependency caching
Prefer Swatinem/rust-cache with explicit shared-key and workspaces instead of ad hoc target-directory caching
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately
Ensure each job has the minimum permissions it needs during GitHub Actions CI review
Ensure reusable workflow callers grant only the scopes their callees require
Ensure every external action is pinned to a full SHA in GitHub Actions workflows
Ensure cache ...

Files:

• .github/workflows/ci_openclaw.yml

{.github/**/*.{yml,yaml},*.patch,scripts/**/*,*.sh,*.bat,Dockerfile*}

📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)

Update CI configuration, patch files, and build scripts with new functional identifiers after rename operations

Files:

• .github/workflows/ci_openclaw.yml

{.github/workflows/*.{yml,yaml},.gitlab-ci.yml}

📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)

Ensure CI workflow references match local package names and installation methods

Files:

• .github/workflows/ci_openclaw.yml

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}

⚙️ CodeRabbit configuration file

{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.

Files:

• .github/workflows/ci_openclaw.yml
• justfile

**/{integrations,integration,*-integration}/**

📄 CodeRabbit inference engine (.agents/skills/contribute-integration/SKILL.md)

**/{integrations,integration,*-integration}/**: Keep NeMo Flow optional in framework integrations
Preserve the framework's original behavior when NeMo Flow is absent
Wrap tool and LLM paths at the correct framework boundary
Integration pattern must follow docs/integrate-frameworks/adding-scopes.md

Files:

• integrations/openclaw/package.json

integrations/openclaw/package.json

📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)

Keep integrations/openclaw/package.json version aligned with the workspace-root package-lock.json under packages["integrations/openclaw"].version

Files:

• integrations/openclaw/package.json

justfile

📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)

When editing helper code, keep set_project_version, set_cargo_workspace_version, and set_node_package_versions aligned with version-update fields; maintain set_node_package_version as a compatibility alias and set_npm_package_version as the reusable npm JSON helper

Files:

• justfile

🧠 Learnings (1)

📚 Learning: 2026-05-03T04:23:07.497Z

Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 46
File: .github/workflows/ci_rust.yml:31-64
Timestamp: 2026-05-03T04:23:07.497Z
Learning: In GitHub Actions workflow YAML, it’s valid to conditionally disable a service container by setting the service container’s `image` to an empty string (`''`) via a matrix variable (e.g., `redis_service_image: ''`). This intentionally makes the runner skip service initialization for that matrix entry rather than failing the job. When reviewing workflows, don’t flag this as an error if the workflow uses an empty `image` to disable the service on specific matrix entries (e.g., OS-specific setups); verify the `image` is sourced from the matrix variable and that the service is only expected to be available when a non-empty image is provided.

Applied to files:

• .github/workflows/ci_openclaw.yml

🔇 Additional comments (5)

integrations/openclaw/package.json (1)

61-61: LGTM!

justfile (3)

513-513: LGTM!

---

1065-1065: LGTM!

Also applies to: 1070-1070

---

1103-1111: Version format change is semantically correct.

The change from -${sha} to +${sha} correctly uses SemVer build metadata syntax rather than prerelease syntax. Both packaging branches now keep the OpenClaw package version and its nemo-flow-node dependency in lockstep.

.github/workflows/ci_openclaw.yml (1)

79-79: LGTM!

[Salonijain27]

Approved from a dependency point of view

[willkill07]

/merge