Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

test/scripts/check-composite-action-input-interpolation.test.ts

@@ -0,0 +1,84 @@
+// Check Composite Action Input Interpolation tests cover check composite action input interpolation script behavior.
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { createScriptTestHarness } from "./test-helpers.js";
+
+const { createTempDir } = createScriptTestHarness();
+const scriptPath = path.resolve("scripts/check-composite-action-input-interpolation.py");
+
+function writeAction(rootDir: string, name: string, source: string): void {
+  const actionPath = path.join(rootDir, ".github", "actions", name, "action.yml");
+  fs.mkdirSync(path.dirname(actionPath), { recursive: true });
+  fs.writeFileSync(actionPath, source, "utf8");
+}
+
+function runCheck(cwd: string) {
+  return spawnSync("python3", [scriptPath], {
+    cwd,
+    encoding: "utf8",
+  });
+}
+
+describe("check-composite-action-input-interpolation", () => {
+  it("rejects direct inputs interpolation inside composite run blocks", () => {
+    const rootDir = createTempDir("openclaw-composite-action-inputs-");
+    writeAction(
+      rootDir,
+      "unsafe",
+      [
+        "name: unsafe",
+        "runs:",
+        "  using: composite",
+        "  steps:",
+        "    - shell: bash",
+        "      run: |",
+        '        echo "${{ inputs.token }}"',
+      ].join("\n"),
+    );
+
+    const result = runCheck(rootDir);
+
+    expect(result.status).toBe(1);
+    expect(result.stdout).toContain("Disallowed direct inputs interpolation");
+    expect(result.stdout).toContain(".github/actions/unsafe/action.yml:7");
+    expect(result.stdout).toContain("Use env: and reference shell variables instead.");
+  });
+
+  it("allows env indirection and ignores non-composite actions", () => {
+    const rootDir = createTempDir("openclaw-composite-action-inputs-");
+    writeAction(
+      rootDir,
+      "safe",
+      [
+        "name: safe",
+        "runs:",
+        "  using: composite",
+        "  steps:",
+        "    - shell: bash",
+        "      env:",
+        "        TOKEN: ${{ inputs.token }}",
+        "      run: |",
+        '        echo "$TOKEN"',
+      ].join("\n"),
+    );
+    writeAction(
+      rootDir,
+      "non-composite",
+      [
+        "name: non-composite",
+        "runs:",
+        "  using: node24",
+        "  main: dist/index.js",
+        "  steps:",
+        '    - run: echo "${{ inputs.token }}"',
+      ].join("\n"),
+    );
+
+    const result = runCheck(rootDir);
+
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("No direct inputs interpolation found");
+  });
+});