2026 OpenClaw on Rented Mac Mini: GitHub repository_dispatch API — Chained Night Tasks, Silent Windows & Backoff Alerts

PAT minimal permissions

Creating a dispatch uses POST https://api.github.com/repos/OWNER/REPO/dispatches. For a fine-grained PAT, limit the repository to the automation repo, enable Metadata read, and grant Contents read and write on that repo. That combination satisfies the REST contract without handing every script Actions: write, which you would need for workflow_dispatch in the sibling guide.

Prefer a GitHub App installation token with the same repository contents scope if you rotate credentials monthly. Store secrets in the login keychain or a root-owned plist environment, and align rotations with gateway upgrade checkpoints.

• Never reuse a PAT that also manages org admin or package publishing.
• Split repos if infra and app code must stay isolated; dispatch across repos only when a second token is unavoidable.

Payload conventions

Treat client_payload as a versioned contract. Automation engineers should agree on required keys up front so every workflow step can assert them with a tiny JSON schema check or jq guard.

Example workflow header that listens for two segments:

on:
  repository_dispatch:
    types: [openclaw_night_a, openclaw_night_b]

Chained task state machine

Model the batch as a small explicit machine: QUEUED (Mac accepted schedule) → SEGMENT_A (first dispatch delivered) → SEGMENT_B (second dispatch) → COMPLETED or FAILED. Persist the last successful batch_id and segment under /var/db or the service home so reboots do not replay side effects.

The chain can advance three ways: a concluding job uses curl with the PAT, a reusable workflow calls gh api, or the Mac polls the Checks API then fires the next event—pick one owner for the clock to avoid races. For broader orchestration diagrams see multi-scenario OpenClaw orchestration.

1. Emit openclaw_night_a with payload containing next_event_type=openclaw_night_b as a hint, not as an automatic trigger, until validation passes.
2. On validation failure, transition to FAILED and call the alert path once.
3. On success, POST openclaw_night_b with the same correlation_id.

Silent windows

Keep APFS-heavy work inside a local quiet band (for example 01:00–05:00). The launchd plist should only invoke the trigger script inside that band; the script should exit zero without calling GitHub when outside the window. Optionally add a workflow guard that reads TZ from the payload and fails fast if someone dispatches manually during business hours.

When marketing or support schedules overlap, let OpenClaw buffer skipped attempts: append JSON lines to a queue file and let the gateway emit a single suppressed fires summary when the window opens, mirroring the digest style in daemon healthcheck webhooks.

Failure alerts

Wrap every HTTP call with exponential backoff on 429 and 5xx responses. Respect Retry-After when present. Cap total attempts (for example five) before escalating. Escalation should be a signed webhook carrying batch_id, last HTTP status, and truncated body—never the PAT.

OpenClaw can subscribe to that webhook, enrich it with tail snippets from the Mini, and open a ticket only when the backoff budget is exhausted, which keeps night tasks from paging on transient GitHub faults.

Reproducible curl and gh examples

Export GITHUB_TOKEN or use a fine-grained PAT in GH_TOKEN for gh. Replace owner, repo, and IDs.

curl -sS -X POST \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/OWNER/REPO/dispatches \
  -d '{"event_type":"openclaw_night_a","client_payload":{"batch_id":"20260424","segment":"a","correlation_id":"'"$(uuidgen)"'","issuer":"launchd"}}'

gh api -X POST repos/OWNER/REPO/dispatches --input - <<'JSON'
{
  "event_type": "openclaw_night_b",
  "client_payload": {
    "batch_id": "20260424",
    "segment": "b",
    "correlation_id": "REPLACE_WITH_UUID",
    "issuer": "openclaw_gateway"
  }
}
JSON

Dry-run from your laptop first, confirm the workflow appears under the Actions tab, then move the same command into a root-owned launchd wrapper on the rented Mac Mini.

FAQ

Why not use workflow_dispatch for everything?

workflow_dispatch optimizes for operator-selected workflows and typed inputs. repository_dispatch optimizes for machine-generated event_type streams and smaller tokens when Actions write is not required from the Mini.

Can repository_dispatch target a specific branch?

Workflows trigger on the default branch unless you structure separate repos or use branch-specific workflow files; plan accordingly when testing on feature branches.

How does OpenClaw fit without owning GitHub?

OpenClaw remains the edge orchestrator: it decides when to fire the first dispatch, stores checkpoints, and aggregates webhook results so humans read one summary per batch.

Closing. Dedicated Apple Silicon for chained GitHub API automation is a few clicks away: open Pricing, complete Purchase with login-free checkout, and keep Help Center SSH notes beside your plist.