ci: add core/full release inventory gates - #14203
Merged
Merged
Conversation
Contributor
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughAdds release inventory contracts and validation for Python artifacts and Docker images, gates release publication on those checks, and introduces a ChangesRelease inventory and bundle release flow
Estimated code review effort: 5 (Critical) | ~90 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant InventoryGate
participant InventoryChecker
participant DockerImages
ReleaseWorkflow->>InventoryGate: Invoke gate with artifacts and versions
InventoryGate->>InventoryChecker: Validate wheel inventories
InventoryGate->>DockerImages: Build and run image targets
DockerImages->>InventoryChecker: Run containerized inventory checks
InventoryGate-->>ReleaseWorkflow: Return inventory result
ReleaseWorkflow->>ReleaseWorkflow: Gate publishing and Docker builds
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 8 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (8 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
erichare
force-pushed
the
fix/le-1873-inventory-release-gates
branch
from
July 22, 2026 00:21
66fae52 to
68eac7e
Compare
erichare
force-pushed
the
fix/le-1873-inventory-release-gates
branch
from
July 22, 2026 00:23
68eac7e to
ee50705
Compare
This comment has been minimized.
This comment has been minimized.
erichare
marked this pull request as ready for review
July 22, 2026 00:25
Contributor
✅ Test Coverage AdvisorNo source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉
|
This comment has been minimized.
This comment has been minimized.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-inventory-gate.yml:
- Around line 57-60: Set persist-credentials to false in the with configuration
of both actions/checkout steps: the python-inventory checkout at
.github/workflows/release-inventory-gate.yml lines 57-60 and the image-inventory
checkout at lines 196-199. Neither checkout pushes changes, so disable token
persistence for both sites.
- Around line 212-221: Update the workflow step’s docker build arguments to
receive the main and core versions through an env block, then reference the
corresponding shell variables in common_args instead of interpolating inputs
directly in run. Preserve the existing build targets and image tags.
In @.github/workflows/release.yml:
- Around line 1601-1633: Add a least-privilege permissions block to the
release-inventory job before its reusable workflow invocation, granting only the
read access required by release-inventory-gate.yml, such as contents: read, and
no broader token permissions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 0e3973a6-9930-4439-87b3-edd24113d4f3
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (12)
.github/workflows/docker-build-v2.yml.github/workflows/release-inventory-gate.yml.github/workflows/release.ymldocker/build_and_push.Dockerfiledocs/docs/Components/components-bundles.mdxdocs/docs/Lfx/lfx-compatibility.mdxdocs/docs/_partial-bundle-lfx-bundles-install.mdxpyproject.tomlscripts/ci/check_release_inventory.pyscripts/ci/core_extension.Dockerfilescripts/ci/release_inventory_contract.jsonscripts/ci/test_release_inventory.py
Comment on lines
+57
to
+60
| - name: Check out release contract | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ inputs.ref }} |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on both checkouts. Both actions/checkout steps persist the GITHUB_TOKEN in .git/config, and later steps run downloaded wheels and docker build, so the token is reachable by executed code; disable persistence since neither step pushes.
.github/workflows/release-inventory-gate.yml#L57-L60: addpersist-credentials: falseunder thewith:of the python-inventory checkout..github/workflows/release-inventory-gate.yml#L196-L199: addpersist-credentials: falseunder thewith:of the image-inventory checkout.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 57-60: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/release-inventory-gate.yml#L57-L60(this comment).github/workflows/release-inventory-gate.yml#L196-L199
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-inventory-gate.yml around lines 57 - 60, Set
persist-credentials to false in the with configuration of both actions/checkout
steps: the python-inventory checkout at
.github/workflows/release-inventory-gate.yml lines 57-60 and the image-inventory
checkout at lines 196-199. Neither checkout pushes changes, so disable token
persistence for both sites.
Source: Linters/SAST tools
Comment on lines
+212
to
+221
| run: | | ||
| set -euo pipefail | ||
| common_args=( | ||
| --build-arg "MAIN_VERSION=${{ inputs.main-version }}" | ||
| --build-arg "CORE_VERSION=${{ inputs.core-version }}" | ||
| -f docker/build_and_push.Dockerfile | ||
| ) | ||
| docker build "${common_args[@]}" --target core -t "langflow-inventory:core-${{ matrix.arch }}" . | ||
| docker build "${common_args[@]}" --target full -t "langflow-inventory:default-${{ matrix.arch }}" . | ||
| docker build "${common_args[@]}" --target full-bundles -t "langflow-inventory:full-${{ matrix.arch }}" . |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the workflow and inspect the relevant section with line numbers.
file=".github/workflows/release-inventory-gate.yml"
wc -l "$file"
sed -n '180,240p' "$file" | cat -nRepository: langflow-ai/langflow
Length of output: 2985
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find how these inputs are defined and used elsewhere in the workflow.
rg -n "main-version|core-version|persist-credentials|docker build|build-arg" .github/workflows/release-inventory-gate.ymlRepository: langflow-ai/langflow
Length of output: 803
Avoid interpolating workflow inputs directly in run.
${{ inputs.main-version }} and ${{ inputs.core-version }} are expanded into the script before the shell runs, so pass them through env: and reference shell variables instead.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 215-215: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 216-216: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-inventory-gate.yml around lines 212 - 221, Update
the workflow step’s docker build arguments to receive the main and core versions
through an env block, then reference the corresponding shell variables in
common_args instead of interpolating inputs directly in run. Preserve the
existing build targets and image tags.
Source: Linters/SAST tools
Comment on lines
+1601
to
+1633
| release-inventory: | ||
| name: Validate release inventories | ||
| needs: | ||
| [ | ||
| build-base, | ||
| build-bundles, | ||
| build-core, | ||
| build-lfx, | ||
| build-main, | ||
| build-sdk, | ||
| determine-core-version, | ||
| determine-main-version, | ||
| test-cross-platform, | ||
| ] | ||
| if: | | ||
| always() && | ||
| !cancelled() && | ||
| (needs.test-cross-platform.result == 'success' || needs.test-cross-platform.result == 'skipped') && | ||
| (needs.build-core.result == 'success' || | ||
| needs.build-main.result == 'success' || | ||
| inputs.build_docker_core || | ||
| inputs.build_docker_main) | ||
| uses: ./.github/workflows/release-inventory-gate.yml | ||
| with: | ||
| ref: ${{ inputs.release_tag }} | ||
| main-version: ${{ needs.determine-main-version.outputs.version }} | ||
| core-version: ${{ needs.determine-core-version.outputs.version || needs.determine-main-version.outputs.version }} | ||
| sdk-artifact-name: ${{ needs.build-sdk.result == 'success' && 'dist-sdk' || '' }} | ||
| lfx-artifact-name: ${{ needs.build-lfx.result == 'success' && 'dist-lfx' || '' }} | ||
| base-artifact-name: ${{ needs.build-base.result == 'success' && 'dist-base' || '' }} | ||
| core-artifact-name: ${{ needs.build-core.result == 'success' && 'dist-core' || '' }} | ||
| main-artifact-name: ${{ needs.build-main.result == 'success' && 'dist-main' || '' }} | ||
| bundles-artifact-name: ${{ needs.build-bundles.result == 'success' && needs.build-bundles.outputs.bundles-found == '1' && 'dist-bundles' || '' }} |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Add a least-privilege permissions: block for the reusable gate call.
The release-inventory job (and the gate it calls) runs with the workflow's default token permissions since no permissions: is declared. The gate only reads artifacts and builds/validates images, so it can be constrained (e.g. contents: read).
🔒 Suggested constraint
release-inventory:
name: Validate release inventories
+ permissions:
+ contents: read
needs:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| release-inventory: | |
| name: Validate release inventories | |
| needs: | |
| [ | |
| build-base, | |
| build-bundles, | |
| build-core, | |
| build-lfx, | |
| build-main, | |
| build-sdk, | |
| determine-core-version, | |
| determine-main-version, | |
| test-cross-platform, | |
| ] | |
| if: | | |
| always() && | |
| !cancelled() && | |
| (needs.test-cross-platform.result == 'success' || needs.test-cross-platform.result == 'skipped') && | |
| (needs.build-core.result == 'success' || | |
| needs.build-main.result == 'success' || | |
| inputs.build_docker_core || | |
| inputs.build_docker_main) | |
| uses: ./.github/workflows/release-inventory-gate.yml | |
| with: | |
| ref: ${{ inputs.release_tag }} | |
| main-version: ${{ needs.determine-main-version.outputs.version }} | |
| core-version: ${{ needs.determine-core-version.outputs.version || needs.determine-main-version.outputs.version }} | |
| sdk-artifact-name: ${{ needs.build-sdk.result == 'success' && 'dist-sdk' || '' }} | |
| lfx-artifact-name: ${{ needs.build-lfx.result == 'success' && 'dist-lfx' || '' }} | |
| base-artifact-name: ${{ needs.build-base.result == 'success' && 'dist-base' || '' }} | |
| core-artifact-name: ${{ needs.build-core.result == 'success' && 'dist-core' || '' }} | |
| main-artifact-name: ${{ needs.build-main.result == 'success' && 'dist-main' || '' }} | |
| bundles-artifact-name: ${{ needs.build-bundles.result == 'success' && needs.build-bundles.outputs.bundles-found == '1' && 'dist-bundles' || '' }} | |
| release-inventory: | |
| name: Validate release inventories | |
| permissions: | |
| contents: read | |
| needs: | |
| [ | |
| build-base, | |
| build-bundles, | |
| build-core, | |
| build-lfx, | |
| build-main, | |
| build-sdk, | |
| determine-core-version, | |
| determine-main-version, | |
| test-cross-platform, | |
| ] | |
| if: | | |
| always() && | |
| !cancelled() && | |
| (needs.test-cross-platform.result == 'success' || needs.test-cross-platform.result == 'skipped') && | |
| (needs.build-core.result == 'success' || | |
| needs.build-main.result == 'success' || | |
| inputs.build_docker_core || | |
| inputs.build_docker_main) | |
| uses: ./.github/workflows/release-inventory-gate.yml | |
| with: | |
| ref: ${{ inputs.release_tag }} | |
| main-version: ${{ needs.determine-main-version.outputs.version }} | |
| core-version: ${{ needs.determine-core-version.outputs.version || needs.determine-main-version.outputs.version }} | |
| sdk-artifact-name: ${{ needs.build-sdk.result == 'success' && 'dist-sdk' || '' }} | |
| lfx-artifact-name: ${{ needs.build-lfx.result == 'success' && 'dist-lfx' || '' }} | |
| base-artifact-name: ${{ needs.build-base.result == 'success' && 'dist-base' || '' }} | |
| core-artifact-name: ${{ needs.build-core.result == 'success' && 'dist-core' || '' }} | |
| main-artifact-name: ${{ needs.build-main.result == 'success' && 'dist-main' || '' }} | |
| bundles-artifact-name: ${{ needs.build-bundles.result == 'success' && needs.build-bundles.outputs.bundles-found == '1' && 'dist-bundles' || '' }} |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 1601-1633: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 1601 - 1633, Add a
least-privilege permissions block to the release-inventory job before its
reusable workflow invocation, granting only the read access required by
release-inventory-gate.yml, such as contents: read, and no broader token
permissions.
Source: Linters/SAST tools
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-1.12.0 #14203 +/- ##
==================================================
- Coverage 61.31% 61.14% -0.18%
==================================================
Files 2342 2339 -3
Lines 237006 236909 -97
Branches 33341 33297 -44
==================================================
- Hits 145330 144864 -466
- Misses 89879 90248 +369
Partials 1797 1797
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
This comment has been minimized.
This comment has been minimized.
Contributor
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
Contributor
|
Build successful! ✅ |
This was referenced Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
langflow[bundles]as the supported torch-free full install and buildlangflow-allfrom the same reviewed Dockerfile via the explicitfull-bundlestargetWhy
The existing release checks validated versions and basic installation health, but they could not detect package, component, starter-flow, or image-tier drift before publication. This makes those tier boundaries version-controlled and release-blocking.
Validation
18 passed:scripts/ci/test_release_inventory.py+scripts/ci/test_release_workflow.pyuv lock --checklangflow[bundles]emits exactlylfx-bundles[all-no-torch]metadataJira: LE-1873
Summary by CodeRabbit
New Features
bundlesinstallation option for including reviewed, torch-free bundle providers.Bug Fixes
Documentation