fix(ci): expose OPENAI_API_KEY for env-based credential auto-import - #244
Merged
Conversation
…ential auto-import The setup_latest.py helper creates the OPENAI_API_KEY Global Variable via POST /api/v1/variables/ AFTER Langflow is already running. The Simple Agent starter project, however, resolves its credential binding at startup — so the variable created post-startup is not picked up, and flow execution fails with "Missing credentials". Langflow has built-in support for promoting OS environment variables to Credential-typed Global Variables on startup. `OPENAI_API_KEY` is in the default auto-import list, so simply exposing it as an env var on the Start step makes the variable available at the right time, encrypted with LANGFLOW_SECRET_KEY in the DB just like any UI-created credential. Reference: https://docs.langflow.org/configuration-global-variables ("Langflow automatically detects standard keys like OPENAI_API_KEY from constants.py without requiring explicit declaration in LANGFLOW_VARIABLES_TO_GET_FROM_ENVIRONMENT.") The redundant POST /api/v1/variables/ call in setup_latest.py is left in place — it's now a no-op or a warning, but it doesn't fail the run. Can be cleaned up in a follow-up. Closes the failure mode exposed by run 26047300330 (which itself was unblocked by the [postgresql]-extra fix in #234). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the migration CI workflow so Langflow boots with OPENAI_API_KEY present in its environment, enabling Langflow’s startup-time auto-import of credential global variables and preventing starter-project flows from failing with “Missing credentials”.
Changes:
- Expose
OPENAI_API_KEYas an env var on the “Start Langflow latest” step. - Expose
OPENAI_API_KEYas an env var on the “Start Langflow nightly” step.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+85
to
+90
| env: | ||
| # Langflow auto-imports OPENAI_API_KEY from the environment as a | ||
| # Credential-typed Global Variable at startup (see | ||
| # docs.langflow.org/configuration-global-variables). This is how | ||
| # starter-project flows get their credentials wired correctly. | ||
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} |
Address Copilot review feedback on #244. When the OPENAI_API_KEY repo secret is not configured, `\${{ secrets.OPENAI_API_KEY }}` resolves to an empty string rather than being unset. Langflow's env-based credential auto-import skips empty values, so the workflow only fails 5+ minutes later at the flow-execution step with a misleading "Missing credentials" error. Guard with an early step that aborts immediately with a clear message if the secret is empty, sparing the install/migration time on a known-bad configuration. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the failure exposed by run 26047300330 — flow execution returning
HTTP 500: Missing credentialseven though the workflow successfully called `POST /api/v1/variables/` to create OPENAI_API_KEY.Root cause
`setup_latest.py` creates the credential after Langflow is already running. The Simple Agent starter project resolves its credential binding at startup time, so the variable created post-startup is not picked up by the component's template.
Langflow has built-in support for promoting OS env vars to Credential-typed Global Variables on startup. `OPENAI_API_KEY` is in the default auto-import list (from `constants.py`), so just exposing it as an env var on the Start step makes the variable available at the right time — Fernet-encrypted in the DB with `LANGFLOW_SECRET_KEY`, identical to a UI-created credential.
Reference: docs.langflow.org/configuration-global-variables — "Langflow automatically detects standard keys like OPENAI_API_KEY from constants.py without requiring explicit declaration."
Change
Two-line addition: `env: OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}` on both `Start Langflow latest` and `Start Langflow nightly` steps.
The redundant `POST /api/v1/variables/` call in `setup_latest.py` is left in place — it's now either a no-op (if Langflow returns 409 for existing names) or creates a duplicate row, but `setup_latest.py` catches that as a warning and continues. Can be cleaned up in a follow-up; outside the scope of this fix.
Test plan
Related
🤖 Generated with Claude Code