[Repo Assist] chore(deps): bundle NuGet updates – GitVersion 6.4.0→6.7.0, Test.Sdk 18.4.0→18.6.0

[github-actions]

🤖 This is an automated pull request from Repo Assist.

Summary

Bundles three NuGet/tool updates into a single PR:

Package	From	To	File
GitVersion.MsBuild	6.4.0	6.7.0	src/Directory.Build.props
gitversion.tool	6.4.0	6.7.0	.config/dotnet-tools.json
Microsoft.NET.Test.Sdk	18.4.0	18.6.0	tests/Directory.Build.props

Supersedes Dependabot PRs #621 and #622 (GitVersion), and the Test.Sdk bump in PR #578 (which has a merge conflict — can be closed after this merges).

All are minor/patch bumps with no API-breaking changes expected.

Test Status

• ⚠️ dotnet test OpenClaw.Shared.Tests — 2037 passed, 29 skipped, 8 pre-existing infrastructure failures (MCP policy path tests — unrelated to this change, same failures on master)
• ✅ dotnet test OpenClaw.Tray.Tests — 932 passed, 2 skipped, 0 failures

Generated by 🌈 Repo Assist. Workflow run

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• .config/dotnet-tools.json

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 26954721300 -n agent -D /tmp/agent-26954721300

# Create a new branch
git checkout -b repo-assist/eng-bundle-nuget-updates-2026-06-04-392851d929eecc19 master

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-26954721300/aw-repo-assist-eng-bundle-nuget-updates-2026-06-04.patch

# Push the branch and create the pull request
git push origin repo-assist/eng-bundle-nuget-updates-2026-06-04-392851d929eecc19
gh pr create --title '[Repo Assist] chore(deps): bundle NuGet updates – GitVersion 6.4.0→6.7.0, Test.Sdk 18.4.0→18.6.0' --base master --head repo-assist/eng-bundle-nuget-updates-2026-06-04-392851d929eecc19 --repo openclaw/openclaw-windows-node

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed June 4, 2026, 9:47 AM ET / 13:47 UTC.

Summary
Keep open: current main still declares all three old dependency/tool versions, and the related open PRs are only partial or conflicted rather than a landed canonical fix.

Reproducibility: not applicable. as a bug reproduction; this is a dependency maintenance request. Source inspection gives a high-confidence state check that all three old versions remain on current main.

Ways to help us reproduce this

• Add a screenshot or short recording showing the behavior.
• Add expected vs actual behavior.

Next step
This is a safe focused repair candidate because the requested files, versions, and validation commands are explicit and no product decision is required.

Review details

Best possible solution:

Create a narrow PR that updates only the three requested versions, validates the repo build and shared/tray tests, then close or supersede the individual dependency PRs after merge.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction; this is a dependency maintenance request. Source inspection gives a high-confidence state check that all three old versions remain on current main.

Is this the best way to solve the issue?

Yes, the narrow bundled dependency PR described by the issue is the maintainable path. The existing related PRs are partial or conflicted, so they do not replace this exact bundle before merge.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• The GitVersion package/tool pair affects build and version metadata, so the eventual PR needs full build and test validation rather than issue-only cleanup.
• The bundled PR should stay narrow; PR [Repo Assist] chore(deps): bump NuGet packages (test SDK, ProtectedData, Zeroconf) #578 includes additional ProtectedData and Zeroconf bumps that are separate from this issue's stated three updates.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 85445c78066b.

Label changes

Label changes:

• add P3: This is a low-risk dependency/tooling maintenance chore with no current runtime user breakage reported.
• add impact:other: The issue affects repository build and dependency maintenance rather than a runtime problem class covered by the specific impact labels.
• add issue-rating: 🌊 off-meta tidepool: Current issue advisory state selects this label.
• add clawsweeper:queueable-fix: Current issue advisory state selects this label.
• add clawsweeper:fix-shape-clear: Current issue advisory state selects this label.

Label justifications:

• P3: This is a low-risk dependency/tooling maintenance chore with no current runtime user breakage reported.
• impact:other: The issue affects repository build and dependency maintenance rather than a runtime problem class covered by the specific impact labels.

Evidence reviewed

Acceptance criteria:

• ./build.ps1
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore

What I checked:

• Repository policy read: AGENTS.md was read fully; its validation guidance is relevant to any future dependency PR but no validation was run because this review is read-only and made no changes. (AGENTS.md:1, 85445c78066b)
• GitVersion.MsBuild still old on current main: Current main still declares GitVersion.MsBuild Version="6.4.0", so the requested 6.7.0 package bump is not implemented. (src/Directory.Build.props:16, 85445c78066b)
• gitversion.tool still old on current main: Current main still declares gitversion.tool version 6.4.0 in the dotnet tool manifest, so the requested 6.7.0 tool bump is not implemented. (.config/dotnet-tools.json:6, 85445c78066b)
• Microsoft.NET.Test.Sdk still old on current main: Current main still declares Microsoft.NET.Test.Sdk Version="18.4.0", so the requested 18.6.0 test SDK bump is not implemented. (tests/Directory.Build.props:29, 85445c78066b)
• Latest release also has old versions: The latest release tag v0.6.0 still has GitVersion 6.4.0 and Microsoft.NET.Test.Sdk 18.4.0 in the same files, so there is no shipped implementation to close against. (src/Directory.Build.props:16, 7d9152f427a3)
• Related PR context: Provided GitHub context shows open PRs for parts of the work: Bump GitVersion.MsBuild from 6.4.0 to 6.7.0 #621 updates only GitVersion.MsBuild, Bump gitversion.tool from 6.4.0 to 6.7.0 #622 updates only gitversion.tool, and [Repo Assist] chore(deps): bump NuGet packages (test SDK, ProtectedData, Zeroconf) #578 is conflicted and includes extra package bumps.

Likely related people:

• Scott Hanselman: Commit f8e6ac4 added GitVersion.MsBuild and the dotnet tool manifest, and commit 645856d added shared analyzer/audit props in src/Directory.Build.props. (role: introduced build/versioning surface; confidence: high; commits: f8e6ac4d0995, 645856d1d665; files: src/Directory.Build.props, .config/dotnet-tools.json)
• Vincent Koc: Commit 7485ce2 recently changed both shared source and test Directory.Build.props files for dependency/runtime packaging. (role: recent area contributor; confidence: medium; commits: 7485ce2af9da; files: src/Directory.Build.props, tests/Directory.Build.props)
• Keith Mahoney: Commit 9106725 made a substantial recent change to tests/Directory.Build.props, which is one of the requested dependency update files. (role: adjacent test-build contributor; confidence: medium; commits: 9106725567af; files: tests/Directory.Build.props)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.