Add more providers and tighten permissions on config file #4

	name: Tag OpenClaw Version On Merge

	on:
	pull_request_target:
	types:
	- closed

	jobs:
	tag-merged-pr:
	if: >-
	github.event.pull_request.merged == true &&
	github.event.pull_request.base.ref == github.event.repository.default_branch &&
	contains(github.event.pull_request.labels.*.name, 'openclaw-update') &&
	startsWith(github.event.pull_request.head.ref, 'bot/openclaw-update-')
	runs-on: ubuntu-latest
	permissions:
	contents: write
	steps:
	- name: Checkout merge commit
	uses: actions/checkout@v4
	with:
	ref: ${{ github.event.pull_request.merge_commit_sha }}
	fetch-depth: 0

	- name: Read OpenClaw version from Dockerfile
	id: version
	shell: bash
	run: \|
	set -euo pipefail
	version=$(grep -oE 'openclaw@[0-9]+(\.[0-9]+)*' Dockerfile \| head -n1 \| cut -d'@' -f2)
	echo "version=${version}" >> "$GITHUB_OUTPUT"

	- name: Create tag if missing
	shell: bash
	run: \|
	set -euo pipefail
	version="${{ steps.version.outputs.version }}"

	git fetch --tags

	if git rev-parse -q --verify "refs/tags/${version}" >/dev/null; then
	echo "Tag ${version} already exists; nothing to do."
	exit 0
	fi

	git tag "${version}" "${{ github.event.pull_request.merge_commit_sha }}"
	git push origin "${version}"

Provide feedback