Bump openclaw/clawhub/.github/workflows/package-publish.yml from 0.12.0 to 0.22.0

[dependabot]

Bumps openclaw/clawhub/.github/workflows/package-publish.yml from 0.12.0 to 0.22.0.

Release notes

Sourced from openclaw/clawhub/.github/workflows/package-publish.yml's releases.

clawhub 0.22.0

0.22.0 - 2026-06-15

Changes

• CLI: remove the clawhub sync command. clawhub skill publish <path> now skips unchanged content, defaults new skills to 1.0.0, defaults changed skills to the next patch version, and supports dry-run/JSON output.
• GitHub Actions: preserve catalog publishing through the reusable skill-publish.yml workflow, which invokes ordinary skill publish once per skill folder.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.22.0
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.22.0.tgz
• integrity: sha512-Bnx99NQQ046fZ51X3zVsZHDkEMKAKRqiaqL9MqhQnLkma2LXbGEakjIpnqnuYRDKSbKpvia8pxKxkuGTylM8NA==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/27587652504
• npm publish: https://github.com/openclaw/clawhub/actions/runs/27587697385

clawhub 0.21.0

0.21.0 - 2026-06-11

Changes

• CLI/API: add public clawhub package trusted-publisher set and clawhub package trusted-publisher delete commands so package managers can configure or remove GitHub Actions OIDC trusted publishing for existing packages.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.21.0
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.21.0.tgz
• integrity: sha512-lzmSRUpTtzMM41pOvc05VR8eKwRf0yNI4Csp/188wypQ3TWuLdohW7FZ5qB2DNtAaTbPHnWPvJUE5R8EP2/C4A==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/27387481040
• npm publish: https://github.com/openclaw/clawhub/actions/runs/27387524961

clawhub 0.20.2

0.20.2 - 2026-06-11

Changes

• CLI packages now require Node.js 22 or newer, dropping the EOL Node 20 runtime floor.
• CLI: add clawhub package validate <source> for local plugin validation with author-facing Plugin Inspector findings, remediation text, and report artifacts.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.20.2
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.20.2.tgz
• integrity: sha512-IuWNpjahm9Uxd/zq/Q3lX7RNi3IfZtxntJz9GzVHCvcLyFK9ISzBQz37pyop2enqH6qovse9mYO1nUt0Ty790w==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/27365750065
• npm publish: https://github.com/openclaw/clawhub/actions/runs/27365833849

clawhub 0.20.0

0.20.0 - 2026-06-06

... (truncated)

Changelog

Sourced from openclaw/clawhub/.github/workflows/package-publish.yml's changelog.

0.22.0 - 2026-06-15

Changes

• CLI: remove the clawhub sync command. clawhub skill publish <path> now skips unchanged content, defaults new skills to 1.0.0, defaults changed skills to the next patch version, and supports dry-run/JSON output.
• GitHub Actions: preserve catalog publishing through the reusable skill-publish.yml workflow, which invokes ordinary skill publish once per skill folder.

0.21.0 - 2026-06-11

Changes

• CLI/API: add public clawhub package trusted-publisher set and clawhub package trusted-publisher delete commands so package managers can configure or remove GitHub Actions OIDC trusted publishing for existing packages.

0.20.2 - 2026-06-11

Changes

• CLI packages now require Node.js 22 or newer, dropping the EOL Node 20 runtime floor.
• CLI: add clawhub package validate <source> for local plugin validation with author-facing Plugin Inspector findings, remediation text, and report artifacts.

0.20.0 - 2026-06-06

Changes

• CLI/API: replace local clawhub scan uploads with stored submitted-version scan report downloads, including owner-authorized clawhub scan download <name> --version <version> support for blocked skill and plugin submissions.

0.19.2 - 2026-06-05

Fixes

• CLI: accept the legacy clawhub skill verify --json flag as a hidden compatibility no-op while continuing to print JSON by default.

0.19.1 - 2026-06-05

Fixes

• CLI: install source-backed GitHub skills from the deployed /api/v1/skills/:slug/install resolver so clawhub install works for skills without hosted ClawHub versions.

0.19.0 - 2026-06-03

Changes

• CLI/API: add authenticated clawhub scan submit/poll support for ephemeral local skill bundles and owner-authorized published skill scans, including JSON output and report ZIP downloads (#2479).

Fixes

• Auth/Ops: keep GitHub account-age lookups on immutable numeric IDs, retry without auth when a configured GitHub token is rejected, and add an operator backfill for missing cached account ages.
• API/CLI: report Skill Card verification with flattened skill/version metadata, ClawScan verdict fields at security.*, and supporting scanner evidence under security.signals.

0.18.0 - 2026-05-25

... (truncated)

Commits

• e3e5705 feat(cli)!: remove sync command (#2669)
• 69dd3b5 Polish content rights email workflow (#2670)
• 44f4ab0 fix: set GitHub scan upload content type
• 4efbf01 fix: floor skill stat drain batch size
• f366269 feat: add owner version deletion
• 1622a74 fix: recover forced GitHub scan requests
• 455f4ea fix: serialize skill stat event drain
• 5256b9e fix(agents): sync autoreview scope guard
• 76638de feat: run full ClawScan for GitHub skills
• 89bb8fe feat: add content rights case tooling (#2657)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.