feat: make langflow-core the shared bundle-free distribution#14100
Open
erichare wants to merge 28 commits into
Open
feat: make langflow-core the shared bundle-free distribution#14100erichare wants to merge 28 commits into
erichare wants to merge 28 commits into
Conversation
Contributor
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThis pull request adds the ChangesLangflow Core distribution
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant BuildCore
participant PublishCore
participant DockerBuild
ReleaseWorkflow->>BuildCore: determine version and build core wheel
BuildCore->>PublishCore: upload dist-core artifact
PublishCore->>ReleaseWorkflow: publish langflow-core
ReleaseWorkflow->>DockerBuild: dispatch core image build
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 5❌ Failed checks (1 warning, 4 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…w-core-distribution-1.11 # Conflicts: # .github/workflows/cross-platform-test.yml # .github/workflows/release.yml # .secrets.baseline
github-actions
Bot
added
enhancement
Contributor
✅ Test Coverage AdvisorNo source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉
|
github-actions
Bot
added
enhancement
This comment has been minimized.
This comment has been minimized.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-1.11.0 #14100 +/- ##
==================================================
- Coverage 61.13% 61.05% -0.09%
==================================================
Files 2427 2384 -43
Lines 238928 236870 -2058
Branches 37114 35445 -1669
==================================================
- Hits 146066 144617 -1449
+ Misses 91108 90498 -610
- Partials 1754 1755 +1
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
github-actions
Bot
added
enhancement
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/docker-build-v2.yml (1)
10-42: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftValidate reusable-workflow inputs before shell expansion.
workflow_call.release_typeis unconstrained, whileversion_overrideandrelease_typeare inserted directly into Bash. A caller can inject shell syntax. Pass inputs throughenvand validate the release type allowlist and Docker-safe version before use.Based on learnings,
workflow_callstring inputs require runtime validation; descriptions and dispatch choices do not constrain reusable-workflow callers.Also applies to: 147-150, 758-759
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docker-build-v2.yml around lines 10 - 42, Harden the workflow inputs used by the release script: in the relevant shell step(s), pass workflow_call values such as release_type and version_override through the step environment rather than interpolating them directly into Bash, then validate release_type against the documented allowlist and version_override against a Docker-safe version pattern before use. Apply the same protection to the referenced input usages near the workflow dispatch and later shell sections, preserving the existing release behavior for valid values.Sources: Learnings, Linters/SAST tools
🧹 Nitpick comments (2)
src/lfx/tests/unit/test_langflow_core_distribution.py (1)
66-69: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRename test to accurately reflect its assertion.
The test name implies it is inspecting the contents of a built wheel, but it actually asserts the presence of the
__init__.pymarker file in the source tree. Consider renaming it for clarity.♻️ Proposed fix
- def test_langflow_core_wheel_contains_a_nonempty_marker_package(): + def test_langflow_core_source_contains_a_nonempty_marker_package(): marker = CORE_ROOT / "src" / "langflow_core" / "__init__.py"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lfx/tests/unit/test_langflow_core_distribution.py` around lines 66 - 69, Rename test_langflow_core_wheel_contains_a_nonempty_marker_package to describe that it verifies a non-empty source-tree __init__.py marker, without changing the assertion or test behavior.docker/build_and_push_core.Dockerfile (1)
98-101: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin
NODE_VERSIONfor reproducibility and alignment.This Dockerfile dynamically fetches the latest Node 22.x version during the build. This can lead to non-repeatable builds and unexpected failures if the remote index format changes. Furthermore, the main
build_and_push.DockerfilehardcodesNODE_VERSION="22.14.0". Pinning the version here aligns the core image with the main image build constraints.♻️ Proposed fix
- && NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \ - | sed -nE "s/.*node-v([0-9]+\.[0-9]+\.[0-9]+)-linux-${NODE_ARCH}\.tar\.xz.*/\1/p" \ - | head -1) \ - && if [ -z "$NODE_VERSION" ]; then echo "ERROR: Could not determine Node.js version" && exit 1; fi \ + && NODE_VERSION="22.14.0" \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docker/build_and_push_core.Dockerfile` around lines 98 - 101, Replace the dynamic NODE_VERSION lookup from the latest Node.js 22.x index with the pinned value 22.14.0, matching the NODE_VERSION setting used by the main build Dockerfile; remove the associated curl, sed, validation, and failure logic.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cross-platform-test.yml:
- Line 1100: Update the conditional in the cross-platform workflow to consume
langflow-version from an environment variable rather than interpolating the
input directly into Bash source; define or pass the environment value through
the workflow step and compare that variable while preserving the existing
empty-value and core_result checks.
In @.github/workflows/docker-build-v2.yml:
- Around line 151-170: Update the Docker Hub tag lookup logic in the
release-version calculation branches to fail closed: enable pipeline/status
checking, fetch the response with retries while requiring HTTP 200, store it in
a temporary file, and validate/parse that file as JSON before deriving tag
lists. Ensure any network, HTTP, or JSON failure exits the workflow instead of
treating the lookup as empty, preserving the existing release-skip comparison.
- Around line 330-341: Guard both registry login steps, “Login to Docker Hub”
and “Login to GitHub Container Registry,” with the existing push_to_registry
condition so authentication runs only for builds that publish images. Ensure
no-push builds neither access registry secrets nor require them.
In @.github/workflows/release.yml:
- Around line 178-182: Update the release validation around the
release_package_core/release_package_base check to allow core-only publication
when a compatible Langflow Base release is already available on PyPI or has been
selected for the current run. Reuse the existing base-resolution logic from the
release flow and the publish-base skip handling near the referenced sections;
reject only when neither condition is satisfied.
In `@docker/build_and_push_core.Dockerfile`:
- Around line 45-47: Replace npm install with npm ci in the Docker build RUN
command, preserving the existing PUPPETEER_SKIP_DOWNLOAD setting, cache mount,
and subsequent build command so dependencies are installed strictly from the
lockfile.
In `@docs/docs/Get-Started/get-started-installation.mdx`:
- Around line 188-200: Capitalize direct references to Langflow Components
consistently: in docs/docs/Get-Started/get-started-installation.mdx lines
188-200, update the heading and body references from “components”/“component” to
“Components”/“Component”; in docs/docs/Deployment/deployment-docker.mdx lines
33-38, change “core components” to “core Components”; and in
docs/docs/Develop/install-custom-dependencies.mdx lines 8-11 and 32-33, change
“component catalog” to “Component catalog” and “core components” to “core
Components.”
---
Outside diff comments:
In @.github/workflows/docker-build-v2.yml:
- Around line 10-42: Harden the workflow inputs used by the release script: in
the relevant shell step(s), pass workflow_call values such as release_type and
version_override through the step environment rather than interpolating them
directly into Bash, then validate release_type against the documented allowlist
and version_override against a Docker-safe version pattern before use. Apply the
same protection to the referenced input usages near the workflow dispatch and
later shell sections, preserving the existing release behavior for valid values.
---
Nitpick comments:
In `@docker/build_and_push_core.Dockerfile`:
- Around line 98-101: Replace the dynamic NODE_VERSION lookup from the latest
Node.js 22.x index with the pinned value 22.14.0, matching the NODE_VERSION
setting used by the main build Dockerfile; remove the associated curl, sed,
validation, and failure logic.
In `@src/lfx/tests/unit/test_langflow_core_distribution.py`:
- Around line 66-69: Rename
test_langflow_core_wheel_contains_a_nonempty_marker_package to describe that it
verifies a non-empty source-tree __init__.py marker, without changing the
assertion or test behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: d87727df-a2b8-4f4f-8003-b140fd87c352
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (25)
.github/changes-filter.yaml.github/workflows/cross-platform-test.yml.github/workflows/docker-build-v2.yml.github/workflows/docker_test.yml.github/workflows/release.yml.secrets.baselineMakefileREADME.mddocker/build_and_push.Dockerfiledocker/build_and_push_base.Dockerfiledocker/build_and_push_core.Dockerfiledocker/build_and_push_ep.Dockerfiledocker/build_and_push_with_extras.Dockerfiledocs/docs/Components/components-bundles.mdxdocs/docs/Deployment/deployment-docker.mdxdocs/docs/Develop/install-custom-dependencies.mdxdocs/docs/Get-Started/get-started-installation.mdxpyproject.tomlsrc/backend/base/langflow/utils/version.pysrc/backend/tests/unit/utils/test_version.pysrc/langflow-core/README.mdsrc/langflow-core/pyproject.tomlsrc/langflow-core/src/langflow_core/__init__.pysrc/lfx/tests/unit/test_langflow_core_distribution.pysrc/lfx/tests/unit/test_patch_regexes.py
Contributor
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
Collaborator
Author
|
Addressed the review-body items in
|
github-actions
Bot
added
enhancement
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
github-actions
Bot
added
enhancement
erichare
marked this pull request as ready for review
July 16, 2026 17:40
github-actions
Bot
added
enhancement
…-1.11' into fix/langflow-core-distribution-1.11 # Conflicts: # docs/docs/Deployment/deployment-docker-core.mdx # docs/docs/Deployment/deployment-docker.mdx
github-actions
Bot
added
enhancement
Contributor
|
Build successful! ✅ |
github-actions
Bot
added
enhancement
Adam-Aghili
reviewed
Jul 16, 2026
Adam-Aghili
left a comment
Adam-Aghili
left a comment
Collaborator
There was a problem hiding this comment.
Looks okay but I would want to see a release dry-run from this PR before I am comfortable with it being merged. Then once merged attempting to create an RC to see what happens
github-actions
Bot
added
enhancement
Contributor
✅ Test Coverage AdvisorNo source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉
|
github-actions
Bot
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rework the package boundary so
langflow-coreis the shared, usable, bundle-free Langflow distribution rather than a sibling wrapper aroundlangflow-base.langflow-baseas the modular infrastructure package; its bare install stays intentionally minimallangflow-coredepend onlangflow-base[complete], own both thelangflowandlangflow-coreCLIs, and expose the matchingaudioandpostgresqlextraslangflowpackage depend onlangflow-coreplus the curated provider bundlesRelease and image topology
full → core → basedevelopment pinscoreandfullfrom one multi-target Dockerfile, withfullremaining the default targetExisting
pip install langflowand full-image users keep the full distribution.pip install langflow-coreandlangflowai/langflow:core-*provide the service-complete instance without provider bundles.Validation
fullRC image build and runtime smoke test verified matching full/core versions andLANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK=falseactionlint,uv lock --check, Ruff,git diff --check, and the repository pre-commit suiteTargeting note
This is temporarily based on
release-1.11.0because that release line has not yet been merged forward tomain; the intended landing target is 1.12. Retarget it tomainafter the 1.11 forward merge.