feat(ci): nightly → stable bundles via canonical pre-releases + decision record [gated] (#13528)

* docs: record nightly→stable bundle cutover plan (gated on lfx 1.10.0)

Add src/bundles/NIGHTLY.md documenting why langflow-nightly currently
renames the bundles (lfx and lfx-nightly ship the same lfx/ import, so a
stable bundle would co-install both and collide) and the deferred cutover
(Approach A: canonical pre-releases; B: lfx as a bundle extra), gated on
stable lfx 1.10.0 being published to PyPI.

Also expand two docstrings in scripts/ci/update_lfx_version.py to state
the deeper install-conflict reason, not just the resolve failure. No
behavior change.

* feat(ci): nightly Approach A — canonical pre-releases, drop nightly bundles [DRAFT/gated] (#13529)

feat(ci): nightly Approach A — canonical pre-releases, drop nightly bundles

DRAFT reference implementation of the nightly→stable-bundle cutover documented
in src/bundles/NIGHTLY.md. Publishes the nightly under CANONICAL package names as
.devN pre-releases instead of separate *-nightly distributions, so the stable
lfx-* bundles resolve against a single canonical lfx (no dual-lfx install
collision) and no nightly bundle packages are produced.

- tag scripts (pypi/lfx/sdk_nightly_tag.py): count .devN against the canonical
  PyPI histories instead of the *-nightly projects
- update scripts: stop renaming to *-nightly; set .devN versions; re-pin
  inter-package deps to exact canonical dev versions; delete the bundle
  rename/repin (update_lfx_dep_in_bundles, rename_bundles_for_nightly)
- release_nightly.yml: publish canonical pre-releases; remove bundle build,
  dist-nightly-bundles artifact, publish-nightly-bundles job + its gate; verify
  canonical names; main wheel glob dist/langflow-*.whl
- nightly_build.yml: drop the bundle git-add in the tag commit
- NIGHTLY.md: Approach A marked implemented + activation gate + A1/A2 follow-ups

Held as DRAFT: do not activate until stable lfx 1.10.0 is published AND the
nightly base is the next minor (release-1.11.0). A 1.10.0.devN core sorts below
1.10.0 and would fail the bundles' >=1.10.0 floor. Stacked on #13528.

(.secrets.baseline: incidental line-number shifts for the two workflows + prune
of pre-existing stale Pokédex Agent.json entries.)

* docs(ci): drop internal 'Approach A' label from nightly cutover comments

Comment- and docstring-only change across scripts/ci/* and the two nightly
workflows; no logic change. The two workflow edits stay single-line so
.secrets.baseline line numbers are unaffected. src/bundles/NIGHTLY.md keeps
its A/B decision-record framing intentionally.

* feat(ci): make nightly consumers work with canonical pre-releases

Follow-ups from the nightly cutover that are part of its blast radius (the
nightly now publishes canonical `.devN` pre-releases, not `*-nightly`
distributions):

- version.py: derive the "Nightly" label from the `.dev` version marker, since
  the canonical `langflow`/`langflow-base` distribution matches first in the
  lookup. Keeps the startup banner and telemetry `package` field identifying
  nightlies. Adds a canonical-dev test; updates the base-dev assertion.
- ci.yml check-nightly-status: query the canonical `langflow` project and pick
  the latest `.devN` release date instead of `langflow-nightly`'s `.info.version`.
- db-migration-validation.yml: install the nightly as `langflow[postgresql]==<dev>`
  (pre-release) instead of `langflow-nightly[...]`; verify via version("langflow").
- src/lfx/README.md: nightly install is `uv pip install --pre lfx`.
- NIGHTLY.md: rewrite the follow-ups section (these are addressed; Docker image,
  A2 meta-package, and website docs remain deferred by design).

The `langflowai/langflow-nightly` Docker image name is intentionally unchanged.

* fix(ci): correct nightly verify uv tree parsing + stale base-dep regex

Addresses review of #13528:

- release_nightly.yml LFX verify: `uv tree | grep lfx | head -n1` matches the
  bundle `lfx-ibm` first → 'Name lfx-ibm does not match lfx'. Root the tree with
  `uv tree --package lfx` so the first line is the lfx package itself.
- release_nightly.yml base verify: under canonical naming `langflow-base` prints
  as a top-level `langflow-base v<ver>` line, so the old $2/$3 field parse read
  name="v0.10.0" and version="". Use `uv tree --package langflow-base` and $1/$2.
- update_lf_base_dependency.py update_base_dep: regex only accepted ~=/==, so its
  CLI entry point couldn't match the current root dep `langflow-base[complete]>=0.10.0`.
  Add >= (parity with update_uv_dependency.py). The active nightly path uses
  update_uv_dependency.py and was unaffected.

* docs(nightly): point NIGHTLY.md status at the activation gate, not draft state

Per review of #13528: this file ships inside #13528 (#13529 was folded in), so
the 'stacked on prep #13528' + 'held as a draft' framing is stale and misleading.
Reword the status block to state the real guard is the activation gate (stable
lfx 1.10.0 published AND next-minor base), not merge/draft state. Also reword the
follow-ups heading 'decide before un-drafting' -> 'decide before activating'.

Author: erichare

.github/workflows/ci.yml

@@ -117,8 +117,11 @@ jobs:
           TODAY=$(date -u +"%Y-%m-%d")
           echo "Today's date: $TODAY"
 
-          # Query PyPI API for the langflow package
-          HTTP_STATUS=$(curl -s -o response.json -w "%{http_code}" https://pypi.org/pypi/langflow-nightly/json)
+          # Query PyPI for the canonical langflow project. The nightly now publishes as a `.devN`
+          # pre-release of `langflow` (not a separate `langflow-nightly` distribution), so inspect
+          # the most recent dev release rather than `.info.version` (which is the latest stable).
+          # See src/bundles/NIGHTLY.md.
+          HTTP_STATUS=$(curl -s -o response.json -w "%{http_code}" https://pypi.org/pypi/langflow/json)
 
           # Check HTTP status code first
           if [ "$HTTP_STATUS" -ne 200 ]; then
@@ -136,16 +139,16 @@ jobs:
             exit 0
           fi
 
-          # Extract the latest version
-          LATEST_VERSION=$(jq -r '.info.version // empty' response.json)
+          # Extract the most recent nightly (.devN pre-release), highest by version sort
+          LATEST_VERSION=$(jq -r '.releases | keys[]' response.json | grep -E '\.dev[0-9]+$' | sort -V | tail -n1)
 
           if [ -z "$LATEST_VERSION" ]; then
-            echo "Could not extract latest version"
+            echo "Could not find a nightly (.devN) release"
             echo "success=false" >> $GITHUB_OUTPUT
             exit 0
           fi
 
-          # Extract the release date of the latest version
+          # Extract the release date of that nightly version
           RELEASE_DATE=$(jq -r --arg ver "$LATEST_VERSION" '.releases[$ver][0].upload_time_iso_8601 // empty' response.json | cut -d'T' -f1)
 
           if [ -z "$RELEASE_DATE" ]; then

.github/workflows/db-migration-validation.yml

@@ -161,12 +161,12 @@ jobs:
           NIGHTLY_TAG="${{ inputs.nightly_tag || 'langflowai/langflow-nightly:latest' }}"
           echo "Upgrading to nightly version: $NIGHTLY_TAG"
 
-          # Remove stable distributions before installing nightly.
-          # langflow and langflow-nightly share langflow-base which writes to the
-          # same site-packages/langflow/ namespace. If stable stays installed,
-          # python -m langflow still boots the stable version and no real
-          # nightly migration is exercised (false-positive test).
-          echo "Removing stable langflow to avoid namespace collision with nightly..."
+          # Remove the stable install first. The nightly now publishes as a `.devN` pre-release of
+          # the canonical `langflow` (same distribution as stable, different version), so a clean
+          # uninstall avoids stale files and guarantees the dev version is what boots — otherwise
+          # `python -m langflow` could keep running the stable version and no real nightly migration
+          # is exercised (false-positive test).
+          echo "Removing stable langflow to force a clean install of the nightly dev version..."
           uv pip uninstall -y langflow langflow-base || true
 
           # Extract version from Docker tag (format: langflowai/langflow-nightly:v1.10.0.dev20260522)
@@ -179,20 +179,20 @@ jobs:
             echo "Version for PyPI: $VERSION"
 
             if [[ "$VERSION" == "latest" ]]; then
-              # Install latest nightly from PyPI
-              uv pip install --upgrade 'langflow-nightly[postgresql]'
+              # Install latest nightly (canonical pre-release) from PyPI
+              uv pip install --upgrade --prerelease=allow 'langflow[postgresql]'
             else
               # Install specific version
-              uv pip install --upgrade "langflow-nightly[postgresql]==$VERSION"
+              uv pip install --upgrade "langflow[postgresql]==$VERSION"
             fi
           else
             # Direct version string (strip 'v' prefix if present)
             VERSION="${NIGHTLY_TAG#v}"
-            uv pip install --upgrade "langflow-nightly[postgresql]==$VERSION"
+            uv pip install --upgrade "langflow[postgresql]==$VERSION"
           fi
 
           # Verify upgrade
-          python -c 'from importlib.metadata import version; print("Upgraded to Langflow Nightly version:", version("langflow-nightly"))'
+          python -c 'from importlib.metadata import version; print("Upgraded to Langflow Nightly version:", version("langflow"))'
 
       - name: Run migration and verify startup
         working-directory: migration-test

.github/workflows/nightly_build.yml

@@ -172,13 +172,9 @@ jobs:
           cd src/lfx && uv lock && cd ../..
 
           git add pyproject.toml src/backend/base/pyproject.toml src/lfx/pyproject.toml src/sdk/pyproject.toml uv.lock
-          # update_lfx_version.py re-pins each bundle's `lfx` dep to
-          # lfx-nightly==<dev>, so any modified bundle pyprojects need to
-          # ride the same commit/tag as the rest of the version bumps.
-          if compgen -G "src/bundles/*/pyproject.toml" > /dev/null; then
-            git add src/bundles/*/pyproject.toml
-          fi
-          git commit -m "Update version and project name"
+          # The nightly keeps canonical package names and the stable `lfx-*` bundles
+          # are not modified (see src/bundles/NIGHTLY.md), so no bundle pyprojects ride this commit.
+          git commit -m "Update version for nightly"
 
           echo "Tagging main with $RELEASE_TAG"
           if ! git tag -a $RELEASE_TAG -m "Langflow nightly $RELEASE_TAG"; then

.github/workflows/release_nightly.yml

@@ -81,8 +81,8 @@ jobs:
         run: |
           name=$(grep '^name = "' src/sdk/pyproject.toml | head -n 1 | sed 's/.*"\(.*\)".*/\1/')
           version=$(grep '^version = "' src/sdk/pyproject.toml | head -n 1 | sed 's/.*"\(.*\)".*/\1/')
-          if [ "$name" != "langflow-sdk-nightly" ]; then
-            echo "Name $name does not match langflow-sdk-nightly. Exiting the workflow."
+          if [ "$name" != "langflow-sdk" ]; then
+            echo "Name $name does not match langflow-sdk. Exiting the workflow."
             exit 1
           fi
           if [ "v$version" != "${{ inputs.nightly_tag_sdk }}" ]; then
@@ -94,10 +94,11 @@ jobs:
         id: verify
         run: |
           cd src/lfx
-          name=$(uv tree | grep 'lfx' | head -n 1 | awk '{print $1}')
-          version=$(uv tree | grep 'lfx' | head -n 1 | awk '{print $2}')
-          if [ "$name" != "lfx-nightly" ]; then
-            echo "Name $name does not match lfx-nightly. Exiting the workflow."
+          # Root the tree at lfx; a bare `grep lfx` matches bundles like `lfx-ibm` first.
+          name=$(uv tree --package lfx | head -n 1 | awk '{print $1}')
+          version=$(uv tree --package lfx | head -n 1 | awk '{print $2}')
+          if [ "$name" != "lfx" ]; then
+            echo "Name $name does not match lfx. Exiting the workflow."
             exit 1
           fi
           if [ "$version" != "${{ inputs.nightly_tag_lfx }}" ]; then
@@ -188,12 +189,14 @@ jobs:
       - name: Verify Nightly Name and Version
         id: verify
         run: |
-          name=$(uv tree | grep 'langflow-base' | awk '{print $2}' | head -n 1)
-          version=$(uv tree | grep 'langflow-base' | awk '{print $3}' | head -n 1)
-          # Strip extras from package name (e.g., "langflow-base-nightly[complete]" -> "langflow-base-nightly")
+          # Root the tree at langflow-base; it prints as a top-level `langflow-base v<ver>` line,
+          # so a bare `grep langflow-base` would read the version into $name and leave $version empty.
+          name=$(uv tree --package langflow-base | head -n 1 | awk '{print $1}')
+          version=$(uv tree --package langflow-base | head -n 1 | awk '{print $2}')
+          # Strip extras from package name (e.g., "langflow-base[complete]" -> "langflow-base")
           name_without_extras=$(echo $name | sed 's/\[.*\]//')
-          if [ "$name_without_extras" != "langflow-base-nightly" ]; then
-            echo "Name $name_without_extras does not match langflow-base-nightly. Exiting the workflow."
+          if [ "$name_without_extras" != "langflow-base" ]; then
+            echo "Name $name_without_extras does not match langflow-base. Exiting the workflow."
             echo "skipped=true" >> $GITHUB_OUTPUT
             exit 1
           fi
@@ -297,10 +300,10 @@ jobs:
       - name: Verify Nightly Name and Version
         id: verify
         run: |
-          name=$(uv tree | grep -E '^langflow(-nightly)?[[:space:]]' | awk '{print $1}')
-          version=$(uv tree | grep -E '^langflow(-nightly)?[[:space:]]' | awk '{print $2}')
-          if [ "$name" != "langflow-nightly" ]; then
-            echo "Name $name does not match langflow-nightly. Exiting the workflow."
+          name=$(uv tree | grep -E '^langflow[[:space:]]' | awk '{print $1}')
+          version=$(uv tree | grep -E '^langflow[[:space:]]' | awk '{print $2}')
+          if [ "$name" != "langflow" ]; then
+            echo "Name $name does not match langflow. Exiting the workflow."
             exit 1
           fi
           if [ "$version" != "${{ inputs.nightly_tag_release }}" ]; then
@@ -337,33 +340,19 @@ jobs:
       - name: Prepare Langflow Main artifact
         run: |
           shopt -s nullglob
-          MAIN_WHEELS=(dist/langflow_nightly-*.whl)
+          MAIN_WHEELS=(dist/langflow-*.whl)
           if [ ${#MAIN_WHEELS[@]} -ne 1 ]; then
-            echo "Expected exactly one langflow-nightly wheel in dist/, found ${#MAIN_WHEELS[@]}"
+            echo "Expected exactly one langflow wheel in dist/, found ${#MAIN_WHEELS[@]}"
             ls -la dist/
             exit 1
           fi
           rm -rf main-dist
           mkdir -p main-dist
           cp "${MAIN_WHEELS[0]}" main-dist/
 
-      - name: Build bundle wheels for cross-platform test
-        run: |
-          shopt -s nullglob
-          bundles=(src/bundles/*/pyproject.toml)
-          if [ ${#bundles[@]} -eq 0 ]; then
-            echo "No bundles found under src/bundles/*/"
-            exit 1
-          fi
-          rm -rf bundles-dist
-          mkdir -p bundles-dist
-          BUNDLES_DIST="$PWD/bundles-dist"
-          for bundle_pyproject in "${bundles[@]}"; do
-            bundle_dir=$(dirname "$bundle_pyproject")
-            echo "Building wheel for $bundle_dir"
-            (cd "$bundle_dir" && uv build --wheel --out-dir "$BUNDLES_DIST")
-          done
-          ls -la bundles-dist/
+      # Bundles are NOT rebuilt/republished for nightly. The stable `lfx-*` bundles on
+      # PyPI work as-is against the canonical `lfx` pre-release (see src/bundles/NIGHTLY.md). The
+      # cross-platform test self-builds the bundles from src/bundles for install coverage.
 
       # PyPI publishing moved to after cross-platform testing
 
@@ -373,12 +362,6 @@ jobs:
           name: dist-nightly-main
           path: main-dist
 
-      - name: Upload bundles artifact
-        uses: actions/upload-artifact@v6
-        with:
-          name: dist-nightly-bundles
-          path: bundles-dist
-
   test-cross-platform:
     name: Test Cross-Platform Installation
     needs: [build-nightly-lfx, build-nightly-base, build-nightly-main]
@@ -388,7 +371,6 @@ jobs:
       main-artifact-name: "dist-nightly-main"
       lfx-artifact-name: "dist-nightly-lfx"
       sdk-artifact-name: "dist-nightly-sdk"
-      bundles-artifact-name: "dist-nightly-bundles"
 
   publish-nightly-lfx:
     name: Publish LFX Nightly to PyPI
@@ -475,60 +457,10 @@ jobs:
         run: |
           make publish base=true
 
-  publish-nightly-bundles:
-    name: Publish Langflow Bundles Nightly to PyPI
-    # langflow-nightly pins each `lfx-<name>-nightly==<dev>` exactly, so the
-    # bundles must be on PyPI before main is published (publish-nightly-main
-    # gates on this job). They depend on `lfx-nightly`, so gate on the lfx
-    # publish too (or skip it when lfx isn't being rebuilt).
-    needs: [build-nightly-main, test-cross-platform, publish-nightly-lfx]
-    if: ${{ always() && needs.build-nightly-main.result == 'success' && needs.test-cross-platform.result == 'success' && (needs.publish-nightly-lfx.result == 'success' || inputs.build_lfx == false) }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download bundles artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: dist-nightly-bundles
-          path: bundles-dist
-      - name: Setup Environment
-        uses: astral-sh/setup-uv@v6
-        with:
-          enable-cache: false
-          python-version: "3.13"
-      - name: Publish bundles to PyPI
-        env:
-          POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_API_TOKEN }}
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
-        run: |
-          shopt -s nullglob
-          wheels=(bundles-dist/*.whl)
-          if [ ${#wheels[@]} -eq 0 ]; then
-            echo "No bundle wheels to publish."
-            exit 1
-          fi
-          failed=0
-          for wheel in "${wheels[@]}"; do
-            echo "Publishing $wheel"
-            # Capture stderr so a re-run without a version bump is a no-op for
-            # an already-published bundle instead of failing the whole job.
-            if ! err=$(uv publish "$wheel" 2>&1); then
-              echo "$err"
-              if echo "$err" | grep -qiE 'already exists|file already exists|HTTP 400|duplicate'; then
-                echo "Skipping $wheel: already published."
-              else
-                echo "Publish failed for $wheel"
-                failed=1
-              fi
-            fi
-          done
-          if [ "$failed" = "1" ]; then
-            exit 1
-          fi
-
   publish-nightly-main:
     name: Publish Langflow Main Nightly to PyPI
-    needs: [build-nightly-main, test-cross-platform, publish-nightly-base, publish-nightly-bundles]
-    if: ${{ always() && needs.build-nightly-main.result == 'success' && needs.test-cross-platform.result == 'success' && needs.publish-nightly-base.result == 'success' && needs.publish-nightly-bundles.result == 'success' }}
+    needs: [build-nightly-main, test-cross-platform, publish-nightly-base]
+    if: ${{ always() && needs.build-nightly-main.result == 'success' && needs.test-cross-platform.result == 'success' && needs.publish-nightly-base.result == 'success' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

.secrets.baseline

@@ -133,7 +133,7 @@
         "filename": ".github/workflows/nightly_build.yml",
         "hashed_secret": "3e26d6750975d678acb8fa35a0f69237881576b0",
         "is_verified": false,
-        "line_number": 304,
+        "line_number": 308,
         "is_secret": false
       }
     ],
@@ -153,7 +153,7 @@
         "filename": ".github/workflows/release_nightly.yml",
         "hashed_secret": "3e26d6750975d678acb8fa35a0f69237881576b0",
         "is_verified": false,
-        "line_number": 565,
+        "line_number": 497,
         "is_secret": false
       }
     ],
@@ -2352,29 +2352,6 @@
         "line_number": 774
       }
     ],
-    "src/backend/base/langflow/initial_setup/starter_projects/Pok\u00e9dex Agent.json": [
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Pok\u00e9dex Agent.json",
-        "hashed_secret": "54ed260e3bc31bc77ee06754dff850981d39a66c",
-        "is_verified": false,
-        "line_number": 115
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Pok\u00e9dex Agent.json",
-        "hashed_secret": "d6e6d7b4b115cd3b9d172623199f8c403055fecc",
-        "is_verified": false,
-        "line_number": 394
-      },
-      {
-        "type": "Hex High Entropy String",
-        "filename": "src/backend/base/langflow/initial_setup/starter_projects/Pok\u00e9dex Agent.json",
-        "hashed_secret": "ecdbe30d19e36761df3620b37270f23c8e3eaa4c",
-        "is_verified": false,
-        "line_number": 774
-      }
-    ],
     "src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json": [
       {
         "type": "Hex High Entropy String",
@@ -9310,5 +9287,5 @@
       }
     ]
   },
-  "generated_at": "2026-06-05T18:07:39Z"
+  "generated_at": "2026-06-08T16:38:06Z"
 }