fix: unblock nightly bundle install resolution

Author: erichare

.github/workflows/release_bundles.yml

@@ -3,8 +3,8 @@ name: Release Bundles
 # Manually-triggered workflow for publishing stable `lfx-<name>` bundle wheels
 # from src/bundles/* to PyPI. Bundles change infrequently, so we release them
 # on demand rather than on a schedule. Re-running the workflow without a
-# version bump is a no-op (PyPI rejects the duplicate upload and we tolerate
-# the conflict).
+# version bump is a no-op; the publish job preflights PyPI and skips bundle
+# versions that are already present.
 
 on:
   workflow_dispatch:
@@ -182,6 +182,10 @@ jobs:
       needs.test-install.result == 'success'
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.release_tag || github.ref }}
       - name: Download bundles artifact
         uses: actions/download-artifact@v7
         with:
@@ -196,26 +200,122 @@ jobs:
         env:
           UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
         run: |
+          set -euo pipefail
           shopt -s nullglob
           wheels=(bundles-dist/*.whl)
           if [ ${#wheels[@]} -eq 0 ]; then
             echo "No bundle wheels to publish."
             exit 0
           fi
+
+          publish_plan="$(mktemp)"
+          uv run --with packaging --no-project python - "${wheels[@]}" > "$publish_plan" <<'PY'
+          import email
+          import json
+          import sys
+          import tomllib
+          import urllib.error
+          import urllib.request
+          import zipfile
+          from pathlib import Path
+
+          from packaging.requirements import Requirement
+          from packaging.utils import canonicalize_name
+          from packaging.version import InvalidVersion, Version
+
+          root_order = {}
+          root_dependencies = tomllib.loads(Path("pyproject.toml").read_text())["project"].get("dependencies", [])
+          for index, dependency in enumerate(root_dependencies):
+            try:
+              requirement = Requirement(dependency)
+            except Exception:
+              continue
+            root_order.setdefault(canonicalize_name(requirement.name), index)
+
+          def read_wheel_metadata(path: Path) -> tuple[str, Version]:
+            with zipfile.ZipFile(path) as wheel:
+              metadata_path = next(name for name in wheel.namelist() if name.endswith(".dist-info/METADATA"))
+              metadata = email.message_from_bytes(wheel.read(metadata_path))
+            return canonicalize_name(metadata["Name"]), Version(metadata["Version"])
+
+          plan = []
+          for wheel_arg in sys.argv[1:]:
+            wheel_path = Path(wheel_arg)
+            name, version = read_wheel_metadata(wheel_path)
+            url = f"https://pypi.org/pypi/{name}/json"
+            try:
+              with urllib.request.urlopen(url, timeout=30) as response:
+                project = json.load(response)
+            except urllib.error.HTTPError as exc:
+              if exc.code != 404:
+                raise
+              print(f"Will publish new PyPI project {name} {version}: {wheel_path}", file=sys.stderr)
+              plan.append((0, root_order.get(name, 9999), name, str(wheel_path)))
+              continue
+
+            published_versions = set()
+            for version_text in project.get("releases", {}):
+              try:
+                published_versions.add(Version(version_text))
+              except InvalidVersion:
+                continue
+
+            if version in published_versions:
+              print(f"Skipping {name} {version}: already published.", file=sys.stderr)
+              continue
+
+            print(f"Will publish new version {name} {version}: {wheel_path}", file=sys.stderr)
+            plan.append((1, root_order.get(name, 9999), name, str(wheel_path)))
+
+          for _, _, _, wheel_path in sorted(plan):
+            print(wheel_path)
+          PY
+
+          if [ ! -s "$publish_plan" ]; then
+            echo "No bundle wheels need publishing."
+            exit 0
+          fi
+
+          mapfile -t wheels < "$publish_plan"
           failed=0
+          pypi_publish_delay_seconds=60
+          pypi_publish_max_attempts=5
+          wheel_count=${#wheels[@]}
+          wheel_number=0
           for wheel in "${wheels[@]}"; do
+            wheel_number=$((wheel_number + 1))
             echo "Publishing $wheel"
-            # Capture stderr so we can tolerate "already exists" without failing
-            # the whole run — re-running this workflow without bumping a bundle
-            # version should be a no-op for that bundle.
-            if ! err=$(uv publish "$wheel" 2>&1); then
+            attempt=1
+            published=0
+            while true; do
+              # Capture stderr so we can tolerate "already exists" without failing
+              # the whole run — re-running this workflow without bumping a bundle
+              # version should be a no-op for that bundle.
+              if err=$(uv publish "$wheel" 2>&1); then
+                echo "$err"
+                published=1
+                break
+              fi
               echo "$err"
               if echo "$err" | grep -qiE 'already exists|file already exists|HTTP 400|duplicate'; then
                 echo "Skipping $wheel: already published."
-              else
-                echo "Publish failed for $wheel"
-                failed=1
+                break
+              fi
+              if echo "$err" | grep -qiE 'HTTP 429|429 Too Many Requests|Too many new projects created'; then
+                if [ "$attempt" -lt "$pypi_publish_max_attempts" ]; then
+                  echo "PyPI rate limited $wheel; sleeping ${pypi_publish_delay_seconds}s before retry $((attempt + 1))/${pypi_publish_max_attempts}."
+                  sleep "$pypi_publish_delay_seconds"
+                  attempt=$((attempt + 1))
+                  continue
+                fi
               fi
+              echo "Publish failed for $wheel"
+              failed=1
+              break
+            done
+            if [ "$published" = "1" ] && [ "$wheel_number" -lt "$wheel_count" ]; then
+              echo "Sleeping ${pypi_publish_delay_seconds}s before the next PyPI upload."
+              sleep "$pypi_publish_delay_seconds"
             fi
           done
           if [ "$failed" = "1" ]; then

.github/workflows/release_nightly.yml

@@ -350,9 +350,32 @@ jobs:
           mkdir -p main-dist
           cp "${MAIN_WHEELS[0]}" main-dist/
 
-      # Bundles are NOT rebuilt/republished for nightly. The stable `lfx-*` bundles on
-      # PyPI work as-is against the canonical `lfx` pre-release (see src/bundles/NIGHTLY.md). The
-      # cross-platform test self-builds the bundles from src/bundles for install coverage.
+      - name: Build bundle wheels for cross-platform test
+        id: build-bundles
+        run: |
+          shopt -s nullglob
+          bundles=(src/bundles/*/pyproject.toml)
+          if [ ${#bundles[@]} -eq 0 ]; then
+            echo "No bundles found under src/bundles/*/"
+            echo "bundles-found=0" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          mkdir -p bundles-dist
+          BUNDLES_DIST="$PWD/bundles-dist"
+          for bundle_pyproject in "${bundles[@]}"; do
+            bundle_dir=$(dirname "$bundle_pyproject")
+            echo "Building wheel for $bundle_dir"
+            (cd "$bundle_dir" && uv build --wheel --out-dir "$BUNDLES_DIST")
+          done
+          echo "bundles-found=1" >> "$GITHUB_OUTPUT"
+          ls -la bundles-dist/
+
+      - name: Upload Bundles Artifact
+        if: steps.build-bundles.outputs.bundles-found == '1'
+        uses: actions/upload-artifact@v6
+        with:
+          name: dist-nightly-bundles
+          path: bundles-dist
 
       # PyPI publishing moved to after cross-platform testing
 
@@ -371,6 +394,8 @@ jobs:
       main-artifact-name: "dist-nightly-main"
       lfx-artifact-name: "dist-nightly-lfx"
       sdk-artifact-name: "dist-nightly-sdk"
+      bundles-artifact-name: "dist-nightly-bundles"
+      pre_release: true
 
   publish-nightly-lfx:
     name: Publish LFX Nightly to PyPI
@@ -457,11 +482,90 @@ jobs:
         run: |
           make publish base=true
 
-  publish-nightly-main:
-    name: Publish Langflow Main Nightly to PyPI
+  check-nightly-main-pypi-dependencies:
+    name: Check Main Nightly PyPI Dependencies
     needs: [build-nightly-main, test-cross-platform, publish-nightly-base]
     if: ${{ always() && needs.build-nightly-main.result == 'success' && needs.test-cross-platform.result == 'success' && needs.publish-nightly-base.result == 'success' }}
     runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.nightly_tag_release }}
+          persist-credentials: true
+      - name: Setup Environment
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: false
+          python-version: "3.13"
+      - name: Check direct bundle dependencies on PyPI
+        run: |
+          uv run --with packaging --no-project python - <<'PY'
+          import json
+          import sys
+          import tomllib
+          import urllib.error
+          import urllib.request
+          from pathlib import Path
+
+          from packaging.requirements import Requirement
+          from packaging.utils import canonicalize_name
+          from packaging.version import InvalidVersion, Version
+
+          data = tomllib.loads(Path("pyproject.toml").read_text())
+          requirements = []
+          for dependency in data["project"].get("dependencies", []):
+            requirement = Requirement(dependency)
+            name = canonicalize_name(requirement.name)
+            if name.startswith("lfx-"):
+              requirements.append(requirement)
+
+          if not requirements:
+            print("No direct lfx-* dependencies found.")
+            sys.exit(0)
+
+          missing = []
+          unsatisfied = []
+          for requirement in requirements:
+            name = canonicalize_name(requirement.name)
+            url = f"https://pypi.org/pypi/{name}/json"
+            try:
+              with urllib.request.urlopen(url, timeout=30) as response:
+                project = json.load(response)
+            except urllib.error.HTTPError as exc:
+              if exc.code == 404:
+                missing.append(name)
+                continue
+              raise
+
+            matching_versions = []
+            for version_text in project.get("releases", {}):
+              try:
+                version = Version(version_text)
+              except InvalidVersion:
+                continue
+              if version in requirement.specifier:
+                matching_versions.append(version)
+
+            if not matching_versions:
+              unsatisfied.append(f"{name}{requirement.specifier}")
+            else:
+              latest = max(matching_versions)
+              print(f"{name}{requirement.specifier}: available, latest matching {latest}")
+
+          if missing or unsatisfied:
+            if missing:
+              print("Missing PyPI projects: " + ", ".join(missing), file=sys.stderr)
+            if unsatisfied:
+              print("No published version satisfies: " + ", ".join(unsatisfied), file=sys.stderr)
+            sys.exit(1)
+          PY
+
+  publish-nightly-main:
+    name: Publish Langflow Main Nightly to PyPI
+    needs: [build-nightly-main, test-cross-platform, publish-nightly-base, check-nightly-main-pypi-dependencies]
+    if: ${{ always() && needs.build-nightly-main.result == 'success' && needs.test-cross-platform.result == 'success' && needs.publish-nightly-base.result == 'success' && needs.check-nightly-main-pypi-dependencies.result == 'success' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v6

.secrets.baseline

@@ -153,7 +153,7 @@
         "filename": ".github/workflows/release_nightly.yml",
         "hashed_secret": "3e26d6750975d678acb8fa35a0f69237881576b0",
         "is_verified": false,
-        "line_number": 497,
+        "line_number": 601,
         "is_secret": false
       }
     ],
@@ -9287,5 +9287,5 @@
       }
     ]
   },
-  "generated_at": "2026-06-23T23:00:36Z"
+  "generated_at": "2026-06-24T03:30:55Z"
 }