Skip to content
Langflow Migration Test: Latest → Nightly

Langflow Migration Test: Latest → Nightly #125

Sign in to view logs

Langflow Migration Test: Latest → Nightly

Langflow Migration Test: Latest → Nightly #125

Workflow file for this run

.github/workflows/migration-test.yml at 00b8f63
name: "Langflow Migration Test: Latest → Nightly"
on:
schedule:
- cron: "0 7 * * *" # 04:00 BRT (UTC-3)
workflow_dispatch:
env:
LANGFLOW_PORT: 7860
LANGFLOW_URL: http://localhost:7860
PG_USER: langflow
PG_PASSWORD: langflow_test_pw
PG_DB: langflow
STATE_FILE: /tmp/migration-test-state.json
REPORT_FILE: /tmp/migration-report.md
LANGFLOW_DATABASE_URL: "postgresql://langflow:langflow_test_pw@localhost:5432/langflow"
LANGFLOW_AUTO_LOGIN: "true"
LANGFLOW_SKIP_AUTH_AUTO_LOGIN: "true"
LANGFLOW_SUPERUSER: "langflow"
LANGFLOW_SUPERUSER_PASSWORD: "langflow123"
LANGFLOW_STORE: "false"
permissions:
contents: read
issues: write
jobs:
migration-test:
runs-on: ubuntu-latest
timeout-minutes: 30
services:
postgres:
image: postgres:16
env:
POSTGRES_USER: langflow
POSTGRES_PASSWORD: langflow_test_pw
POSTGRES_DB: langflow
ports:
- 5432:5432
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- uses: actions/checkout@v7
- name: Setup Python
uses: actions/setup-python@v7
with:
python-version: "3.12"
# Presence is not usability, and this step used to check only the former (#1295).
# Run #124 passed a non-empty-secret check, spent 1 min 40 s installing the
# Playwright browser and another minute installing Langflow, and then died on a
# drained OpenAI account — reported as a *migration* failure, on the
# `migration-test` tracker, in a run that never executed the witness flow at all.
#
# One token answers it here, before the job installs anything. Fail-open by
# design: only a billing / key-rot verdict aborts (exit 1); a network blip or an
# unrecognised response warns and lets the run reach its own conclusion — the
# authoritative verdict on a migration is the migration. It also drops the
# marker the report and the issue-routing steps below read.
#
# First step after `Setup Python` on purpose: every step it precedes is one a
# drained key would have wasted. Stdlib only, so it needs no `pip install`.
- name: Verify OPENAI_API_KEY is usable (not just present)
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
python tests/github-workflows/migration/provider_credentials.py \
--probe --phase "pre-flight/pip" --job api
- name: Install uv
uses: astral-sh/setup-uv@v7
- name: Install test dependencies
run: |
pip install requests playwright pytest pytest-playwright
# System (apt) deps: run WITHOUT a timeout — interrupting apt
# mid-transaction can leave dpkg half-configured and break the retries.
playwright install-deps chromium
# Browser binary: per-attempt timeout + retry so a stalled
# cdn.playwright.dev download cannot burn the whole job budget. This
# workflow uses the Python toolchain and cannot reuse the Node
# composite action at .github/actions/setup-playwright. See issue #344.
for attempt in 1 2 3; do
if timeout --kill-after=30s 5m playwright install chromium; then
exit 0
fi
echo "::warning::playwright install attempt $attempt failed or stalled; retrying in 5s..."
sleep 5
done
echo "::error::playwright install failed after 3 attempts (see issue #344)"
exit 1
- name: Create virtual environment
run: uv venv .venv
- name: Generate ephemeral secret key for this run
run: |
python - <<'PY'
import base64, os
key = base64.urlsafe_b64encode(os.urandom(32)).decode()
with open(os.environ["GITHUB_ENV"], "a") as f:
f.write(f"LANGFLOW_SECRET_KEY={key}\n")
PY
# ── Phase 1: Langflow Latest ──────────────────────────────
- name: Install Langflow latest
run: |
uv pip install "langflow[postgresql]"
LATEST_VERSION=$(uv pip show langflow | grep ^Version | awk '{print $2}')
echo "LATEST_VERSION=$LATEST_VERSION" >> "$GITHUB_ENV"
echo "langflow==$LATEST_VERSION" > /tmp/latest-digest.txt
echo "Installed Langflow $LATEST_VERSION (latest stable)"
- name: Start Langflow latest
env:
# Langflow auto-imports OPENAI_API_KEY from the environment as a
# Credential-typed Global Variable at startup (see
# docs.langflow.org/configuration-global-variables). This is how
# starter-project flows get their credentials wired correctly.
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
uv run langflow run --host 0.0.0.0 --port "$LANGFLOW_PORT" \
> /tmp/langflow-latest.log 2>&1 &
echo $! > /tmp/langflow.pid
echo "Langflow PID: $(cat /tmp/langflow.pid)"
- name: Wait for Langflow latest
run: python tests/github-workflows/migration/wait_for_langflow.py
# `id`s on the three verification steps feed `steps.<id>.outcome` to the report
# below. That is what lets the report reconcile "what the runner observed"
# against "what the phase recorded", instead of inferring success from the
# absence of a failure record — see the Generate report step (#1120).
- name: Create flow, configure and execute on latest
id: phase_latest
run: python tests/github-workflows/migration/setup_latest.py
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
- name: Stop Langflow latest
run: |
kill "$(cat /tmp/langflow.pid)" 2>/dev/null || true
sleep 3
# ── Phase 2: Upgrade to Nightly ───────────────────────────
- name: Resolve nightly version from PyPI
run: |
NIGHTLY_VERSION=$(python - <<'PY'
import urllib.request, json
data = json.loads(urllib.request.urlopen("https://pypi.org/pypi/langflow/json").read())
pre = [
v for v in data["releases"]
if data["releases"][v] and any(c in v for c in ("dev", "a", "b", "rc"))
]
pre.sort(key=lambda v: data["releases"][v][0]["upload_time"])
print(pre[-1] if pre else "")
PY
)
if [ -z "$NIGHTLY_VERSION" ]; then
echo "ERROR: Could not determine nightly version from PyPI"
exit 1
fi
echo "NIGHTLY_VERSION=$NIGHTLY_VERSION" >> "$GITHUB_ENV"
echo "langflow==$NIGHTLY_VERSION" > /tmp/nightly-digest.txt
echo "Nightly version: $NIGHTLY_VERSION"
- name: Install Langflow nightly
run: |
# The nightly is the latest pre-release of the `langflow` PyPI package
# (e.g. 1.11.0.dev26). That release pins its transitive dependency
# `langflow-base[complete]==<same dev version>`. uv does NOT consider
# pre-release versions for transitive dependencies by default, so the
# exact-pinned dev `langflow-base` is reported as "no version found"
# and resolution fails ("No solution found … requirements are
# unsatisfiable"). `--prerelease=allow` lets uv consider pre-releases
# for the whole resolution; stable deps are still preferred where a
# stable version satisfies the constraint.
uv pip install --prerelease=allow "langflow[postgresql]==$NIGHTLY_VERSION"
echo "Installed Langflow $NIGHTLY_VERSION (nightly)"
- name: Start Langflow nightly (same database)
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
uv run langflow run --host 0.0.0.0 --port "$LANGFLOW_PORT" \
> /tmp/langflow-nightly.log 2>&1 &
echo $! > /tmp/langflow.pid
echo "Langflow PID: $(cat /tmp/langflow.pid)"
- name: Wait for Langflow nightly (includes migration)
id: nightly_start
run: python tests/github-workflows/migration/wait_for_langflow.py --timeout 180
# ── Phase 3: Verify Migration ─────────────────────────────
- name: Verify migration via API
id: phase_nightly_api
run: python tests/github-workflows/migration/verify_migration_api.py
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
# Deliberately NOT `continue-on-error`: that would mark the step's conclusion
# as success and the job would stop failing, which is what the issue-opening
# condition below keys on. The report step reads `steps.*.outcome` under
# `if: always()`, which is available for a failed step anyway (#1120).
- name: Verify migration via UI (Playwright)
id: phase_nightly_ui
run: pytest tests/github-workflows/migration/test_ui_migration.py -v --tracing=retain-on-failure --output=test-results
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
# ── Phase 4: Report ───────────────────────────────────────
- name: Stop Langflow nightly
if: always()
run: kill "$(cat /tmp/langflow.pid)" 2>/dev/null || true
# The outcomes are what stop the report inferring success from silence
# (#1120): a phase the runner saw fail, that recorded no failing step, is
# reported as a crash rather than rendered as `Result: PASSED`. Run #115
# opened an issue titled "Failed" whose body said PASSED for exactly that
# reason — `test_05_execute_flow_ui` died on a Playwright timeout before it
# could write its own verdict.
#
# `JOB_STATUS` closes the other half (#1141): only these three steps carry an
# `id`, so a failure in the steps BETWEEN them — resolving/installing/booting
# the nightly, or the alembic migration timing out — left phases 2 and 3
# unrun, their outcomes empty, and the report saying PASSED on a red job. The
# job's own status covers those steps, and any step added here later.
- name: Generate report
if: always()
env:
PHASE_OUTCOME_latest: ${{ steps.phase_latest.outcome }}
PHASE_OUTCOME_nightly_api: ${{ steps.phase_nightly_api.outcome }}
PHASE_OUTCOME_nightly_ui: ${{ steps.phase_nightly_ui.outcome }}
JOB_STATUS: ${{ job.status }}
run: python tests/github-workflows/migration/generate_report.py
- name: Print report
if: always()
run: cat /tmp/migration-report.md
- name: Generate migration summary
if: always()
run: |
LATEST_DIGEST=$(cat /tmp/latest-digest.txt 2>/dev/null || echo "(unavailable)")
NIGHTLY_DIGEST=$(cat /tmp/nightly-digest.txt 2>/dev/null || echo "(unavailable)")
OUTCOME="${{ job.status }}"
DATE=$(date -u +%Y-%m-%d)
{
echo "# Langflow Migration — Run Summary"
echo ""
echo "**Outcome:** \`${OUTCOME}\` · Run #${{ github.run_number }} (${DATE}, ${{ github.event_name }})"
echo ""
echo "## Scenario"
echo ""
echo "| Field | Value |"
echo "|---|---|"
echo "| Workflow | \`${{ github.workflow }}\` |"
echo "| Job | \`${{ github.job }}\` (pip-based) |"
echo "| Source | \`langflow==${LATEST_VERSION:-?}\` via \`uv pip install \"langflow[postgresql]\"\` |"
echo "| Target | \`langflow==${NIGHTLY_VERSION:-?}\` via \`uv pip install --prerelease=allow \"langflow[postgresql]==<version>\"\` |"
echo "| Database | PostgreSQL 16 (GHA service) |"
echo "| OPENAI_API_KEY | auto-imported as Credential on each Langflow startup |"
echo ""
echo "## What this run verified"
echo ""
echo "- Langflow latest installs via \`uv pip install \"langflow[postgresql]\"\` (psycopg2 driver present)."
echo "- Langflow latest boots against the GHA Postgres service."
echo "- Simple Agent witness flow created on latest with OPENAI_API_KEY auto-imported."
echo "- Witness flow executes successfully on latest."
echo "- Langflow nightly resolved from PyPI and installed against the same DB."
echo "- Nightly boot completes (alembic migration runs)."
echo "- Migration verified via API (\`verify_migration_api.py\`)."
echo "- Migration verified via UI (Playwright \`test_ui_migration.py\`)."
echo ""
echo "## Related artifacts in this run"
echo ""
echo "- \`migration-report.md\` — detailed phase-by-phase report from \`generate_report.py\`"
echo "- \`migration-test-state.json\` — machine-readable state file"
echo "- \`langflow-latest.log\` / \`langflow-nightly.log\` — Langflow process logs"
echo "- \`test-results/\` — Playwright traces (on failure)"
echo "- \`latest-digest.txt\` / \`nightly-digest.txt\` — exact PyPI versions tested"
} > /tmp/migration-summary.md
echo "::group::Generated summary"
cat /tmp/migration-summary.md
echo "::endgroup::"
- name: Upload test artifacts
if: always()
uses: actions/upload-artifact@v7
with:
name: migration-test-${{ github.run_number }}
path: |
test-results/
/tmp/migration-summary.md
/tmp/migration-report.md
/tmp/langflow-latest.log
/tmp/langflow-nightly.log
/tmp/migration-test-state.json
/tmp/latest-digest.txt
/tmp/nightly-digest.txt
/tmp/credential-verdict.json
# Scoped to the default branch (#1145). This step used to fire on ANY green
# run, so a `workflow_dispatch` on a branch closed the issue that tracks a bug
# still present on `main`. It happened for real: run #117, dispatched on the
# #1143 fix branch, closed #1143 while the fix was still unmerged and `main`
# still carried the racy assertion. Dispatching on a branch is the recommended
# way to prove changes to this workflow — #1139, #1141 and #1143 could only be
# proven that way — so the practice that produces the best evidence must not
# silently write to the tracker.
- name: Close issue on success
if: success() && github.ref == 'refs/heads/main'
uses: actions/github-script@v9
with:
script: |
// A green run proves two separate things, so it closes two separate
// trackers (#1295) — each with wording about what it actually proved. The
// old version said "Migration test passed" on whatever open
// `migration-test` issue it found, which is how a billing outage filed
// there would have been closed as a fixed migration bug.
//
// The credential label is THIS job's own (`-api`), never the compose job's:
// the two run in parallel, and closing the other one's issue is the
// collision PR #793 found on run #101. The `migration-test` half keeps its
// existing (shared) behaviour — that is #793's scope, not this PR's.
const CLOSING = {
'migration-test': 'Migration test passed. Closing this issue.',
'provider-credentials-api':
'This run reached the model provider and executed the witness flow, so the ' +
'credential that blocked it is usable again. Closing.',
};
for (const [label, message] of Object.entries(CLOSING)) {
const { data: existing } = await github.rest.issues.listForRepo({
owner: context.repo.owner,
repo: context.repo.repo,
labels: label,
state: 'open',
});
if (existing.length === 0) continue;
const issue = existing[0];
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issue.number,
body: [
`## ✅ Run #${context.runNumber} — ${new Date().toISOString().split('T')[0]}`,
'',
message,
'',
`[Workflow Run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`,
].join('\n'),
});
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issue.number,
state: 'closed',
});
}
# Deliberately NOT scoped to the default branch (#1145): a red branch run is
# worth filing — that is exactly how #1143 was found, by dispatching on a
# branch. The body names the ref and the event instead, so a reader can tell a
# branch experiment from a `main` failure rather than assuming the latter.
- name: Create or update issue on failure
if: failure()
uses: actions/github-script@v9
with:
script: |
const fs = require('fs');
let report = 'Migration test failed. See workflow artifacts for details.';
try {
report = fs.readFileSync('/tmp/migration-report.md', 'utf8');
} catch (e) {
console.log('Report not available:', e.message);
}
// #1295: a run the provider's billing state stopped carries NO migration
// signal — the witness flow never executed, so nothing about alembic or the
// Fernet round-trip was measured. Filing that on the `migration-test`
// tracker is what run #124 did, and the next green run would have closed it
// with "Migration test passed", leaving a Langflow bug in the history that
// never existed. The marker is written by
// tests/github-workflows/migration/provider_credentials.py; its ABSENCE is
// the normal case and keeps this step exactly as it was.
let credential = null;
try {
credential = JSON.parse(fs.readFileSync('/tmp/credential-verdict.json', 'utf8'));
} catch (e) {
console.log('No credential verdict for this run:', e.message);
}
const blocked = credential && ['billing', 'key-rot'].includes(credential.verdict);
const label = blocked ? credential.label : 'migration-test';
const title = blocked
? credential.title
: 'Langflow Migration Test Failed (latest → nightly)';
if (blocked) {
// Self-provisioning so a drained account does not also need a manual
// label; idempotent, and a failure here must not lose the report.
try {
await github.rest.issues.createLabel({
owner: context.repo.owner,
repo: context.repo.repo,
name: label,
color: 'd93f0b',
description: `Provider credential/billing state blocked the migration test's ${credential.job} job (no product signal)`,
});
} catch (e) {
console.log(`Label ${label} already exists or could not be created:`, e.message);
}
}
const { data: existing } = await github.rest.issues.listForRepo({
owner: context.repo.owner,
repo: context.repo.repo,
labels: label,
state: 'open',
});
const preamble = blocked
? [
`> **This is not a migration verdict.** The witness flow could not reach the`,
`> model provider (\`${credential.verdict}\`, at \`${credential.phase}\`), so`,
`> **nothing about the migration was measured** in this run.`,
'',
`**Reason:** ${credential.reason}`,
'',
`**What to do:** ${credential.action}`,
'',
]
: [];
const body = [
`## Run #${context.runNumber} — ${new Date().toISOString().split('T')[0]}`,
'',
`**Ref:** \`${context.ref}\` · **Event:** \`${context.eventName}\``,
'',
...preamble,
report,
'',
`[Workflow Run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`,
'',
'/cc @lice-reis',
].join('\n');
if (existing.length > 0) {
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: existing[0].number,
body,
});
} else {
await github.rest.issues.create({
owner: context.repo.owner,
repo: context.repo.repo,
title,
body,
labels: [label, 'automated'],
});
}
# ─────────────────────────────────────────────────────────────────
# Companion job: same source → target migration via docker-compose,
# using the OFFICIAL compose file from langflow-ai/langflow's
# docker_example/docker-compose.yml (fetched at runtime). Catches
# bugs that only manifest in the user-facing deployment path:
# named volumes for Postgres, service-name DNS resolution,
# depends_on ordering, restart-on-recreate semantics.
# ─────────────────────────────────────────────────────────────────
migration-test-compose:
name: Migration via docker-compose (Postgres + named volumes)
runs-on: ubuntu-latest
timeout-minutes: 30
env:
LF_URL: http://localhost:7860
COMPOSE_DIR: /tmp/migration-compose
OFFICIAL_COMPOSE_URL: https://raw.githubusercontent.com/langflow-ai/langflow/main/docker_example/docker-compose.yml
steps:
- uses: actions/checkout@v7
# Same pre-flight as the API job above (#1295) — see the long comment there. This
# job is the cheaper half to protect and the more expensive one to waste: run #124
# pulled 941 MB of images before reaching the same drained-account 429. No
# `setup-python` here on purpose: the module is stdlib-only, so the runner's
# `python3` is enough.
- name: Verify OPENAI_API_KEY is usable (not just present)
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
python3 tests/github-workflows/migration/provider_credentials.py \
--probe --phase "pre-flight/compose" --job compose
- name: Generate ephemeral SECRET_KEY
run: |
python3 - <<'PY' >> "$GITHUB_ENV"
import base64, os
print(f"LANGFLOW_SECRET_KEY={base64.urlsafe_b64encode(os.urandom(32)).decode()}")
PY
- name: Fetch official docker-compose.yml from langflow-ai/langflow
run: |
mkdir -p "$COMPOSE_DIR" /tmp/logs
curl -fsSL "$OFFICIAL_COMPOSE_URL" -o "$COMPOSE_DIR/docker-compose.yml"
echo "=== Fetched official compose ($(wc -l < "$COMPOSE_DIR/docker-compose.yml") lines) ==="
cat "$COMPOSE_DIR/docker-compose.yml"
# Save raw copy as artifact for traceability
cp "$COMPOSE_DIR/docker-compose.yml" /tmp/logs/official-compose-snapshot.yml
- name: Write override + .env
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
# Workaround: langflow:latest images built before langflow-ai/langflow#13212
# did not pre-create /app/langflow in the Dockerfile, so Docker seeded the
# named volume as root:root and uid 1000 (the container user) could not
# write secret_key — crashing the container on startup.
# Fix: replace the named volume with a world-writable bind mount so the
# container can always write to LANGFLOW_CONFIG_DIR regardless of image age.
# Remove the volumes override once langflow:latest ships with #13212.
mkdir -p /tmp/langflow-data
chmod 777 /tmp/langflow-data
# Override file: pin the langflow image via env var substitution and
# inject our auth + credential env vars. Default LANGFLOW_IMAGE is
# the upstream `langflow:latest`; we'll flip it to nightly between
# phases.
cat > "$COMPOSE_DIR/docker-compose.override.yml" <<'YAML'
services:
langflow:
image: ${LANGFLOW_IMAGE:-langflowai/langflow:latest}
environment:
- LANGFLOW_SECRET_KEY=${LANGFLOW_SECRET_KEY}
- OPENAI_API_KEY=${OPENAI_API_KEY}
- LANGFLOW_AUTO_LOGIN=true
# Since v1.5 the auto_login token is rejected by /run endpoints unless
# LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true is set in the SERVER environment.
# The GHA top-level env: block only reaches the runner, not the container.
- LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true
- LANGFLOW_SUPERUSER=langflow
- LANGFLOW_SUPERUSER_PASSWORD=langflow123
- LANGFLOW_STORE=false
volumes:
- /tmp/langflow-data:/app/langflow
YAML
# .env consumed by docker compose for variable substitution
cat > "$COMPOSE_DIR/.env" <<EOF
LANGFLOW_IMAGE=langflowai/langflow:latest
LANGFLOW_SECRET_KEY=${LANGFLOW_SECRET_KEY}
OPENAI_API_KEY=${OPENAI_API_KEY}
EOF
chmod 600 "$COMPOSE_DIR/.env"
echo "=== docker-compose.override.yml ==="
cat "$COMPOSE_DIR/docker-compose.override.yml"
echo "=== docker compose config (merged, secrets redacted) ==="
(cd "$COMPOSE_DIR" && OPENAI_API_KEY=REDACTED LANGFLOW_SECRET_KEY=REDACTED docker compose config) || true
# ── Phase 1: Source (latest) via docker compose ──────────────
- name: "[SOURCE] docker compose up -d (langflowai/langflow:latest)"
working-directory: ${{ env.COMPOSE_DIR }}
run: docker compose up -d
- name: "[SOURCE] Wait for /health_check"
run: |
for i in $(seq 1 72); do
sleep 5
if curl -fsS "${LF_URL}/health_check" >/dev/null 2>&1; then
echo "Source up after $((i*5))s"
break
fi
if [[ $i -eq 72 ]]; then
echo "::error::Source did not become healthy in 360s"
(cd "$COMPOSE_DIR" && docker compose logs --tail=120)
exit 1
fi
done
- name: "[SOURCE] Create witness flow + execute (Simple Agent)"
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
set -e
TOKEN=$(curl -s "${LF_URL}/api/v1/auto_login" | jq -r '.access_token // empty')
[[ -z "$TOKEN" ]] && { echo "::error::auto_login failed on source"; exit 1; }
# Confirm Langflow auto-imported OPENAI_API_KEY as a Credential
VAR_COUNT=$(curl -s -H "Authorization: Bearer $TOKEN" \
"${LF_URL}/api/v1/variables/" \
| jq '[.[] | select(.name == "OPENAI_API_KEY")] | length')
if [[ "$VAR_COUNT" -ne "1" ]]; then
echo "::error::Expected 1 auto-imported OPENAI_API_KEY Variable on source, got ${VAR_COUNT}"
exit 1
fi
echo "Auto-imported Credential confirmed on source"
# Template selection strategy:
# Starter-projects come pre-configured with a model (e.g. Basic Prompting has
# ChatOpenAI wired in and ready to run). Flows from /api/v1/flows/ (e.g. Simple
# Agent) may require manual model selection and fail with HTTP 500
# "No model selected". So: use starter-projects FIRST, /api/v1/flows/ as fallback.
# NOTE: Langflow gzip-encodes large responses → always use --compressed.
STARTERS_JSON=$(curl -s --compressed -H "Authorization: Bearer $TOKEN" "${LF_URL}/api/v1/starter-projects/")
echo "DEBUG /api/v1/starter-projects/ names:"
echo "$STARTERS_JSON" | jq -r '[.[] | .name] | join(", ")' 2>/dev/null || echo "(parse failed — raw first 200: ${STARTERS_JSON:0:200})"
# Prefer Basic Prompting (simplest flow that uses OPENAI_API_KEY and runs without config)
TEMPLATE=$(echo "$STARTERS_JSON" | \
jq -c '[.[] | select((.name // "" | ascii_downcase) | contains("basic prompting") or contains("prompting"))][0]' \
2>/dev/null || echo "")
# If not found, take the first available starter (any pre-configured LLM flow works)
if [[ -z "$TEMPLATE" || "$TEMPLATE" == "null" ]]; then
TEMPLATE=$(echo "$STARTERS_JSON" | jq -c '.[0]' 2>/dev/null || echo "")
echo "Basic Prompting not found — using first available starter"
fi
# Last resort: fall back to /api/v1/flows/ for any prompting-style flow
if [[ -z "$TEMPLATE" || "$TEMPLATE" == "null" ]]; then
echo "No starters available — falling back to /api/v1/flows/"
FLOWS_JSON=$(curl -s --compressed -H "Authorization: Bearer $TOKEN" "${LF_URL}/api/v1/flows/")
echo "DEBUG /api/v1/flows/ names:"
echo "$FLOWS_JSON" | jq -r '[.[] | .name] | join(", ")' 2>/dev/null || echo "(parse failed — raw first 200: ${FLOWS_JSON:0:200})"
TEMPLATE=$(echo "$FLOWS_JSON" | \
jq -c '[.[] | select((.name // "" | ascii_downcase) | contains("basic prompting") or contains("memory chatbot"))][0]' \
2>/dev/null || echo "")
fi
[[ -z "$TEMPLATE" || "$TEMPLATE" == "null" ]] && {
echo "::error::No witness template found — /api/v1/flows/ and /api/v1/starter-projects/ both returned nothing usable"; exit 1; }
# Select a model on the witness (#1004). Starters ship the model
# component with NO selection, so the source smoke below used to die on
# "A model selection is required" — every run since 2026-07-23.
# Since 1.11.1 the selection lives in the required `model` field
# (`type: model`); `provider`/`model_name` are only advanced OVERRIDES of
# it, and writing them while `model` is empty is rejected with "Model
# name/provider overrides require a built-in model selection". So set
# `model` as a plain string when the field exists, and fall back to the
# legacy pair for older builds. Verified against langflow:1.11.1 and
# langflow-nightly 1.12.0.dev9: unpatched 500, patched 200 on both.
# `api_key` takes the NAME of the Credential Langflow auto-imports from
# the OPENAI_API_KEY env var (asserted a few lines above).
TEMPLATE=$(echo "$TEMPLATE" | jq --arg m "${WITNESS_MODEL:-gpt-4o-mini}" --arg key "OPENAI_API_KEY" '
(.data.nodes[]?
| select((.data.type // "") | test("^(LanguageModelComponent|OpenAIModel)$"))
| .data.node.template) |= (
(if has("model") then
(if ((.model.value // "") == "") then .model.value = $m else . end)
else
(if ((.model_name.value // "") == "") then .model_name.value = $m else . end)
| (if ((.provider.value // "") == "") then .provider.value = "OpenAI" else . end)
end)
| (if (has("api_key") and ((.api_key.value // "") == "")) then .api_key.value = $key else . end)
)')
echo "Witness model selection: $(echo "$TEMPLATE" | jq -c '[.data.nodes[]? | select((.data.type // "") | test("LanguageModelComponent|OpenAIModel")) | .data.node.template | {model: .model.value, model_name: .model_name.value}]')"
FLOW_PAYLOAD=$(echo "$TEMPLATE" | jq '{
name: ((.name // "Simple Agent") + " — migration witness"),
description: "compose migration witness",
data: .data,
endpoint_name: .endpoint_name
}')
WITNESS_ID=$(curl -s -X POST "${LF_URL}/api/v1/flows/" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d "$FLOW_PAYLOAD" | jq -r '.id // empty')
[[ -z "$WITNESS_ID" ]] && { echo "::error::Failed to create witness flow"; exit 1; }
echo "$WITNESS_ID" > /tmp/witness-id.txt
echo "Witness flow: $WITNESS_ID"
# Smoke: execute it on source so we know it works before migration
HTTP=$(curl -s -o /tmp/run-source.json -w "%{http_code}" \
-X POST "${LF_URL}/api/v1/run/${WITNESS_ID}" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
--max-time 120 \
-d '{"input_value":"What is 2+2? Answer with just the number.","output_type":"chat","input_type":"chat"}')
if [[ "$HTTP" != "200" ]]; then
echo "::error::Source flow execution returned HTTP $HTTP"
head -c 2000 /tmp/run-source.json
# Attribute it before dying (#1295): the account can drain between the
# pre-flight and here, and a provider 429 quoted inside a Langflow 500 is
# not a migration verdict. `|| true` because attribution must never
# replace the real error with a crash of its own — and this classifier
# deliberately does not change the exit code below.
python3 tests/github-workflows/migration/provider_credentials.py \
--classify-file /tmp/run-source.json --status "$HTTP" \
--phase "compose/source-execute" --job compose || true
exit 1
fi
echo "Source flow execution OK"
- name: "[SOURCE] Stop langflow (preserve volumes)"
if: always()
working-directory: ${{ env.COMPOSE_DIR }}
run: |
docker compose logs langflow > /tmp/logs/compose-source-langflow.log 2>&1 || true
docker compose stop langflow
# ── Phase 2: Target (nightly) via docker compose ─────────────
- name: "[TARGET] Switch image to nightly + compose up"
working-directory: ${{ env.COMPOSE_DIR }}
run: |
# Flip LANGFLOW_IMAGE; postgres volume stays intact
sed -i 's|^LANGFLOW_IMAGE=.*|LANGFLOW_IMAGE=langflowai/langflow-nightly:latest|' .env
grep LANGFLOW_IMAGE .env
docker compose up -d langflow
- name: "[TARGET] Wait for /health_check (migration runs)"
run: |
for i in $(seq 1 72); do
sleep 5
if curl -fsS "${LF_URL}/health_check" >/dev/null 2>&1; then
echo "Target up after $((i*5))s"
break
fi
if [[ $i -eq 72 ]]; then
echo "::error::Target did not become healthy — likely migration failure"
(cd "$COMPOSE_DIR" && docker compose logs langflow --tail=200)
exit 1
fi
done
- name: "[TARGET] Verify witness flow + execute"
run: |
set -e
TOKEN=$(curl -s "${LF_URL}/api/v1/auto_login" | jq -r '.access_token // empty')
[[ -z "$TOKEN" ]] && { echo "::error::auto_login failed on target"; exit 1; }
WITNESS_ID=$(cat /tmp/witness-id.txt)
STATUS=$(curl -s -o /tmp/witness-resp.json -w "%{http_code}" \
-H "Authorization: Bearer $TOKEN" \
"${LF_URL}/api/v1/flows/${WITNESS_ID}")
if [[ "$STATUS" != "200" ]]; then
echo "::error::Witness flow lost after compose migration: HTTP $STATUS"
cat /tmp/witness-resp.json
exit 1
fi
echo "Witness flow preserved"
VAR_COUNT=$(curl -s -H "Authorization: Bearer $TOKEN" \
"${LF_URL}/api/v1/variables/" \
| jq '[.[] | select(.name == "OPENAI_API_KEY")] | length')
if [[ "$VAR_COUNT" -ne "1" ]]; then
echo "::error::OPENAI_API_KEY Variable count on target: $VAR_COUNT (expected 1)"
exit 1
fi
echo "OPENAI_API_KEY Variable preserved"
HTTP=$(curl -s -o /tmp/run-target.json -w "%{http_code}" \
-X POST "${LF_URL}/api/v1/run/${WITNESS_ID}" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
--max-time 120 \
-d '{"input_value":"What is 2+2? Answer with just the number.","output_type":"chat","input_type":"chat"}')
if [[ "$HTTP" != "200" ]]; then
echo "::error::Target flow execution returned HTTP $HTTP (Fernet/migration regression)"
head -c 2000 /tmp/run-target.json
# The one place where the distinction matters most: this step's whole
# purpose is to catch a Fernet/migration regression, and a drained account
# here would have filed exactly that against Langflow (#1295).
python3 tests/github-workflows/migration/provider_credentials.py \
--classify-file /tmp/run-target.json --status "$HTTP" \
--phase "compose/target-execute" --job compose || true
exit 1
fi
if grep -iE 'api[ _-]?key.{0,30}(required|missing|not[ _]?found)|fernet|cannot[ _]decrypt' /tmp/run-target.json; then
echo "::error::Target run body indicates credential / Fernet issue"
head -c 2000 /tmp/run-target.json
exit 1
fi
echo "Target flow execution OK"
- name: Save logs + cleanup
if: always()
working-directory: ${{ env.COMPOSE_DIR }}
run: |
docker compose logs langflow > /tmp/logs/compose-target-langflow.log 2>&1 || true
docker compose logs postgres > /tmp/logs/compose-postgres.log 2>&1 || true
docker compose down -v
- name: Generate migration summary
if: always()
run: |
SOURCE_DIGEST=$(cat /tmp/source-digest.txt 2>/dev/null || echo "(unavailable)")
TARGET_DIGEST=$(cat /tmp/target-digest.txt 2>/dev/null || echo "(unavailable)")
WITNESS_ID=$(cat /tmp/witness-id.txt 2>/dev/null || echo "(unavailable)")
OUTCOME="${{ job.status }}"
DATE=$(date -u +%Y-%m-%d)
{
echo "# Langflow Migration — Run Summary"
echo ""
echo "**Outcome:** \`${OUTCOME}\` · Run #${{ github.run_number }} (${DATE}, ${{ github.event_name }})"
echo ""
echo "## Scenario"
echo ""
echo "| Field | Value |"
echo "|---|---|"
echo "| Workflow | \`${{ github.workflow }}\` |"
echo "| Job | \`${{ github.job }}\` (docker-compose) |"
echo "| Source image | \`langflowai/langflow:latest\` (\`${SOURCE_DIGEST}\`) |"
echo "| Target image | \`langflowai/langflow-nightly:latest\` (\`${TARGET_DIGEST}\`) |"
echo "| Database | PostgreSQL 16-trixie (named volume \`langflow-data\`) |"
echo "| Compose file | upstream \`langflow-ai/langflow/docker_example/docker-compose.yml\` (snapshot in artifact) |"
echo "| Witness flow id | \`${WITNESS_ID}\` |"
echo ""
echo "## What this run verified"
echo ""
echo "- Source image pulled and started via \`docker compose up -d\`."
echo "- OPENAI_API_KEY auto-imported as Credential Variable on source."
echo "- Simple Agent witness flow created on source."
echo "- Witness flow executes successfully on source (Fernet end-to-end smoke)."
echo "- Source stopped; postgres named volume preserved."
echo "- Target image started on the same volume; alembic migration runs."
echo "- Witness flow + OPENAI_API_KEY Variable preserved on target."
echo "- Witness flow re-executes successfully on target (Fernet decrypt preserved across migration)."
echo ""
echo "## Related artifacts in this run"
echo ""
echo "- \`logs/compose-source-langflow.log\` / \`compose-target-langflow.log\` — langflow service logs"
echo "- \`logs/compose-postgres.log\` — postgres service log"
echo "- \`logs/official-compose-snapshot.yml\` — exact upstream compose file fetched"
echo "- \`run-source.json\` / \`run-target.json\` — full flow-execution responses"
echo "- \`witness-id.txt\` — witness flow UUID (same source and target)"
} > /tmp/migration-summary.md
echo "::group::Generated summary"
cat /tmp/migration-summary.md
echo "::endgroup::"
- name: Upload artifacts
if: always()
uses: actions/upload-artifact@v7
with:
name: migration-compose-${{ github.run_number }}
path: |
/tmp/logs/
/tmp/migration-summary.md
/tmp/witness-id.txt
/tmp/run-source.json
/tmp/run-target.json
/tmp/credential-verdict.json
retention-days: 30
# Same default-branch scope as the API job above (#1145).
- name: Close issue on success
if: success() && github.ref == 'refs/heads/main'
uses: actions/github-script@v9
with:
script: |
// Two trackers, same reasoning as the API job above (#1295) — and the
// credential label is this job's own (`-compose`), for the #793 reason.
const CLOSING = {
'migration-test': 'docker-compose migration test passed. Closing.',
'provider-credentials-compose':
'This run reached the model provider and executed the witness flow, so the ' +
'credential that blocked it is usable again. Closing.',
};
for (const [label, message] of Object.entries(CLOSING)) {
const { data: existing } = await github.rest.issues.listForRepo({
owner: context.repo.owner,
repo: context.repo.repo,
labels: label,
state: 'open',
});
if (existing.length === 0) continue;
const issue = existing[0];
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issue.number,
body: [
`## ✅ Run #${context.runNumber} — ${new Date().toISOString().split('T')[0]}`,
'',
message,
'',
`[Workflow Run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`,
].join('\n'),
});
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: issue.number,
state: 'closed',
});
}
- name: Create or update issue on failure
if: failure()
uses: actions/github-script@v9
with:
script: |
// Same routing as the API job (#1295) — see the long comment there. Run
// #124's `migration-test` issue was OPENED by this job (the compose body is
// the issue body) while the API job commented its report onto it, so both
// halves have to route on the verdict or the misattribution survives in one.
const fs = require('fs');
let credential = null;
try {
credential = JSON.parse(fs.readFileSync('/tmp/credential-verdict.json', 'utf8'));
} catch (e) {
console.log('No credential verdict for this run:', e.message);
}
const blocked = credential && ['billing', 'key-rot'].includes(credential.verdict);
const label = blocked ? credential.label : 'migration-test';
const title = blocked
? credential.title
: 'Langflow Migration Test Failed (latest → nightly)';
if (blocked) {
try {
await github.rest.issues.createLabel({
owner: context.repo.owner,
repo: context.repo.repo,
name: label,
color: 'd93f0b',
description: `Provider credential/billing state blocked the migration test's ${credential.job} job (no product signal)`,
});
} catch (e) {
console.log(`Label ${label} already exists or could not be created:`, e.message);
}
}
const { data: existing } = await github.rest.issues.listForRepo({
owner: context.repo.owner,
repo: context.repo.repo,
labels: label,
state: 'open',
});
const what = blocked
? [
`> **This is not a migration verdict.** The witness flow could not reach the`,
`> model provider (\`${credential.verdict}\`, at \`${credential.phase}\`), so`,
`> **nothing about the docker-compose migration was measured** in this run.`,
'',
`**Reason:** ${credential.reason}`,
'',
`**What to do:** ${credential.action}`,
]
: [
`docker-compose migration test failed. Source: \`langflowai/langflow:latest\` → Target: \`langflowai/langflow-nightly:latest\`.`,
`Compose file: pinned to upstream main of \`langflow-ai/langflow/docker_example/docker-compose.yml\`.`,
];
const body = [
`## Run #${context.runNumber} — ${new Date().toISOString().split('T')[0]}`,
'',
`**Ref:** \`${context.ref}\` · **Event:** \`${context.eventName}\``,
'',
...what,
'',
`[Workflow Run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`,
'',
'/cc @lice-reis',
].join('\n');
if (existing.length > 0) {
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: existing[0].number,
body,
});
} else {
await github.rest.issues.create({
owner: context.repo.owner,
repo: context.repo.repo,
title,
body,
labels: [label, 'automated'],
});
}