From 45fd3352ba683a062c773baf5d02c8a377cece1e Mon Sep 17 00:00:00 2001
From: RoboClaw <services+roboclaw@openclaw.org>
Date: Fri, 2 Oct 2026 04:35:24 -0700
Subject: [PATCH] fix(release): recognize 2026.9.8 plugin scan policy (#163464)

Co-authored-by: roboclaw-bot <309084314+roboclaw-bot@users.noreply.github.com>
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
---
 scripts/lib/plugin-npm-security-scan.mts      | 1 +
 test/scripts/plugin-npm-security-scan.test.ts | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/lib/plugin-npm-security-scan.mts b/scripts/lib/plugin-npm-security-scan.mts
index c1ee1b336f2d..a43fb76602f0 100644
--- a/scripts/lib/plugin-npm-security-scan.mts
+++ b/scripts/lib/plugin-npm-security-scan.mts
@@ -438,6 +438,7 @@ const FROZEN_RELEASE_SECURITY_INVENTORY_POLICIES = new Map<string, PluginSecurit
       requiredSourceFindingCounts: RELEASE_2026_9_7_REQUIRED_REVIEWED_SOURCE_FINDING_COUNTS,
     },
   ],
+  ["release/2026.9.8", CURRENT_SECURITY_INVENTORY_POLICY],
   [
     "extended-stable/2026.6.33",
     {
diff --git a/test/scripts/plugin-npm-security-scan.test.ts b/test/scripts/plugin-npm-security-scan.test.ts
index 561abed58ff9..e57025fb2688 100644
--- a/test/scripts/plugin-npm-security-scan.test.ts
+++ b/test/scripts/plugin-npm-security-scan.test.ts
@@ -262,12 +262,13 @@ describe("scripts/lib/plugin-npm-security-scan.mts", () => {
       "release/2026.9.5",
       "release/2026.9.6",
       "release/2026.9.7",
+      "release/2026.9.8",
     ]) {
       expect(resolveReviewedSourceLayout(current, context)?.id, context).toBe("current");
     }
     expect(resolveReviewedSourceLayout(frozenLegacy, "release/2026.9.1")).toBeUndefined();
     expect(resolveReviewedSourceLayout(current, "release/2099.1.1")).toBeUndefined();
-    expect(resolveReviewedSourceLayout(current, "release/2026.9.8")).toBeUndefined();
+    expect(resolveReviewedSourceLayout(current, "release/2026.9.9")).toBeUndefined();
     expect(resolveReviewedSourceLayout(frozenLegacy)).toBeUndefined();
     expect(resolveReviewedSourceLayout(frozenLegacy, "extended-stable/2026.6.33")?.id).toBe(
       "extended-stable-2026.6.33",
@@ -801,6 +802,7 @@ describe("scripts/lib/plugin-npm-security-scan.mts", () => {
             context === "" ||
             context === "release/2026.9.6" ||
             context === "release/2026.9.7" ||
+            context === "release/2026.9.8" ||
             (context === "release/2026.9.5" && reviewedIn95);
           const label = `${context || "current"}: ${count ?? "absent"}`;
           const scanned = await scanPublishablePluginPackages([artifact.artifact], context);