feat(ci): add declarative downstream bundle profiles

[erichare]

What

• add a single declarative bundle-profile contract for the supported Enterprise UBI/hardened downstream image family
• list every included bundle distribution, extras selection, bounded version range, provider owner, target Langflow/LFX range, package index, profile owners, and update cadence
• generate and check in a deterministic exact-version lock plus release inventory artifact for the profile
• validate unknown distributions/extras, unbounded or incompatible ranges, duplicate providers, application dependency drift, runtime profile selection, and stale locks
• provide a build-time installed-image verifier that rejects missing, undeclared, duplicated, or version-drifted bundles/providers and emits a reviewable JSON inventory
• run profile validation and artifact generation in the existing release inventory gate
• document downstream Docker integration, provider changes, ownership, update cadence, emergency pins, and rollback

Why

The release-1.12.0 branch already contains the LE-1871 application-image tiers, LE-1872 release/version propagation, and LE-1873 package/image inventory gates. It did not yet contain LE-1874's downstream source of truth: Enterprise/hardened images still inherited the Langflow application's bundle dependencies without a named, exact, independently reviewable profile.

This change makes the current Enterprise/hardened bundle set explicit and fails closed when the application or installed image drifts from it. Profile selection and installation remain image-build concerns; the tooling performs no runtime package or registry mutation.

Downstream adoption

This PR establishes the release-branch contract that downstream builds consume. After it lands, the Enterprise release branch should update its immutable OSS pin, set LANGFLOW_BUNDLE_PROFILE=enterprise-hardened in its Dockerfile, install the generated exact requirements during the build, and retain the verify-installed JSON artifact. That companion change should follow the merged OSS commit so Enterprise does not pin an unmerged release-branch revision.

Validation

• 80 passed: complete scripts/ci/ test suite
• final focused bundle-profile and release-inventory regression suites passed
• Ruff check and format check
• actionlint for the reusable release inventory workflow
• Node syntax check for the docs sidebar
• profile/lock self-check and exact requirements rendering
• pre-commit hooks, detect-secrets, and IBM Block Secrets
• git diff --check

Summary by CodeRabbit

• New Features

  • Added support for downstream bundle profiles for hardened container images.
  • Added deterministic dependency locks and installed-environment verification.
  • Added release validation that checks profiles and publishes bundle inventory artifacts.

• Documentation

  • Added deployment guidance for selecting, updating, verifying, and rolling back bundle profiles.

• Tests

  • Added comprehensive validation for profile configuration, dependency locks, provider ownership, and inventory consistency.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a45c999a-fa63-4fb7-b356-7fbb3448eb55

📥 Commits

Reviewing files that changed from the base of the PR and between f8c5f9c and fa20e92.

📒 Files selected for processing (8)

• .github/workflows/release-inventory-gate.yml
• docs/docs/Deployment/downstream-bundle-profiles.mdx
• docs/sidebars.js
• scripts/ci/bundle_profile_locks/enterprise-hardened.lock.json
• scripts/ci/bundle_profiles.json
• scripts/ci/manage_bundle_profiles.py
• scripts/ci/test_bundle_profiles.py
• scripts/ci/test_release_inventory.py

---

Walkthrough

Adds declarative downstream bundle profiles with validation, deterministic lockfiles, installed-image verification, release-gate artifact generation, tests, and deployment documentation for the enterprise-hardened image family.

Changes

Downstream bundle profiles

Layer / File(s)	Summary
Profile contract and locked inventory scripts/ci/bundle_profiles.json, scripts/ci/bundle_profile_locks/...	Defines the enterprise-hardened profile, bundle ownership, version constraints, image-family mapping, and pinned lock inventory.
Validation, compilation, and installed verification scripts/ci/manage_bundle_profiles.py	Discovers bundle metadata, validates profiles, compiles and checks deterministic locks, verifies installed inventories, and exposes CLI commands.
Contract and inventory validation tests scripts/ci/test_bundle_profiles.py	Covers valid profiles, deterministic compilation, stale locks, invalid constraints, provider drift, installed inventory mismatches, and validation immutability.
Release gate and deployment guidance .github/workflows/release-inventory-gate.yml, scripts/ci/test_release_inventory.py, docs/docs/Deployment/..., docs/sidebars.js	Runs profile checks and compilation in the release gate, uploads lock inventories, and documents profile selection, updates, and rollback procedures.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant ProfileManager
  participant BundleCatalog
  participant DownstreamImage
  ReleaseWorkflow->>ProfileManager: run check and compile
  ProfileManager->>BundleCatalog: discover and validate bundles
  ProfileManager->>ReleaseWorkflow: upload lock inventories
  DownstreamImage->>ProfileManager: run verify-installed
  ProfileManager->>DownstreamImage: emit inventory and validation result

Loading

Possibly related PRs

• langflow-ai/langflow#14203: Introduces the release inventory gate workflow and test coverage extended by this change.

Suggested reviewers: adam-aghili

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/le-1874-downstream-bundle-profiles

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/release-inventory-gate.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

scripts/ci/bundle_profile_locks/enterprise-hardened.lock.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

scripts/ci/bundle_profiles.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.