ci(nightly): re-pin bundle lfx deps to lfx-nightly during nightly build by erichare · Pull Request #13208 · langflow-ai/langflow

erichare · 2026-05-19T16:43:03Z

Summary

uv lock in the nightly create-nightly-tag job fails on branches that ship bundle pyprojects (e.g. release-1.10.0):

× No solution found when resolving dependencies for split [...]
╰─▶ Because only lfx<=0.4.3 is available and lfx-arxiv depends on
    lfx>=0.5.0,<0.6.0, we can conclude that lfx-arxiv's requirements
    are unsatisfiable.

Same shape as #13207. Nightly renames the workspace lfx package to lfx-nightly and updates the workspace dep in the root pyproject, but each src/bundles/*/pyproject.toml still pins "lfx>=0.5.0,<0.6.0" against the package name that no longer exists in the workspace — and PyPI only has lfx 0.4.3.

What changed

scripts/ci/update_lfx_version.py — added update_lfx_dep_in_bundles(lfx_version). Iterates src/bundles/*/pyproject.toml and rewrites any "lfx[<>=!~]..." or already-rewritten "lfx-nightly==..." spec to "lfx-nightly==<dev version>". A regex lookahead requires a version operator immediately after the package name, so sibling packages like lfx-arxiv / lfx-duckduckgo are not matched. Called from update_lfx_for_nightly after the existing SDK rewrite.
.github/workflows/nightly_build.yml — restored the guarded git add src/bundles/*/pyproject.toml step so the rewritten bundle pyprojects ride the same commit/tag as the other version bumps.

No-op on branches without bundle pyprojects (e.g. main today), so this is safe to merge ahead of the bundle extraction landing on main.

Verification

Inline regex tests covered:

Input	Result
`"lfx>=0.5.0,<0.6.0"`	rewritten to `"lfx-nightly==<v>"`
`"lfx-nightly==0.5.0.dev10"`	rewritten to `"lfx-nightly==<v>"` (idempotent re-runs)
`"lfx-arxiv>=0.1.0"`	no match (sibling left alone)
`"lfx-duckduckgo>=0.1.0"`	no match
`"defusedxml>=0.7.1,<1.0.0"`	no match

Functional test against a fake workspace with three bundle pyprojects (one with lfx>=..., one already on lfx-nightly==..., one with no lfx dep) confirmed the script rewrites only the first two and skips the third.

Cherry-pick to release-1.10.0 to unblock nightlies cut from that branch.

Summary by CodeRabbit

Chores
- Enhanced nightly build workflow to properly include bundle dependency updates during version tagging.
- Improved automated dependency version management for nightly releases.

The nightly pipeline renames the workspace `lfx` package to `lfx-nightly` in `src/lfx/pyproject.toml` and the root workspace dep, but leaves each `src/bundles/*/pyproject.toml`'s `"lfx>=X.Y,<Z"` pin unchanged. With the workspace `lfx` gone and PyPI still on lfx 0.4.3, the create-nightly-tag job's `uv lock` fails: × No solution found when resolving dependencies for split [...] ╰─▶ Because only lfx<=0.4.3 is available and lfx-arxiv depends on lfx>=0.5.0,<0.6.0, we can conclude that lfx-arxiv's requirements are unsatisfiable. `update_lfx_version.py` now also rewrites the `lfx` (or already-rewritten `lfx-nightly`) specifier in every `src/bundles/*/pyproject.toml` to `lfx-nightly==<dev version>`, mirroring how `update_lf_base_dependency` re-pins the lfx dep inside `langflow-base`. The lookahead in the regex prevents matching sibling packages like `lfx-arxiv` / `lfx-duckduckgo`. No-op when no bundle pyprojects exist (e.g. on main today), so this is safe to merge ahead of the bundle extraction landing on main. Restored the guarded `git add src/bundles/*/pyproject.toml` step so the modified bundle pyprojects ride the same commit/tag as the rest of the nightly version bumps. Cherry-pick to release-1.10.0 to unblock nightlies cut from that branch.

coderabbitai · 2026-05-19T16:43:29Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 953ae1d8-63b8-4f5d-9a6e-dde76c3ef8e0

📥 Commits

Reviewing files that changed from the base of the PR and between baceda7 and 4f4f9ff.

📒 Files selected for processing (3)

.github/workflows/nightly_build.yml
.secrets.baseline
scripts/ci/update_lfx_version.py

Walkthrough

The PR integrates bundle-level LFX dependency pinning into nightly builds. A Python utility now rewrites LFX dependency specifications in bundle pyproject.toml files, the nightly workflow invokes this rewriting step, and the GitHub Actions workflow stages the updated bundle files in the version-tag commit to keep dependencies synchronized across the workspace.

Changes

Nightly Bundle Dependency Synchronization

Layer / File(s)	Summary
Bundle LFX dependency rewriting `scripts/ci/update_lfx_version.py`	Adds `_BUNDLE_LFX_DEP_PATTERN` regex and `update_lfx_dep_in_bundles(lfx_version)` function to scan and rewrite `lfx`/`lfx-nightly` version pins in `src/bundles/*/pyproject.toml` files with exact `lfx-nightly==<version>` specs.
Nightly update flow integration `scripts/ci/update_lfx_version.py`	`update_lfx_for_nightly()` calls `update_lfx_dep_in_bundles()` after the main LFX package rename, ensuring bundle dependencies are rewritten as part of the nightly version update sequence.
Workflow bundle file staging `.github/workflows/nightly_build.yml`	The `create-nightly-tag` job conditionally stages `src/bundles/*/pyproject.toml` files before creating the version-and-project-name commit, aligning bundle changes with the rest of the nightly version bumps.
Secrets baseline metadata `.secrets.baseline`	The baseline file reflects the workflow modification (line-number update from 297 to 303) and refreshed generation timestamp.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

langflow-ai/langflow#13195: Modifies the nightly create-nightly-tag job to conditionally include src/bundles/*/pyproject.toml in the version-tag commit, directly overlapping with workflow-level bundle staging changes.
langflow-ai/langflow#13193: Rewrites LFX dependency specs inside src/bundles/*/pyproject.toml via a separate script, directly overlapping on the same bundle LFX-pinning logic.

Suggested labels

bug

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Test Coverage For New Implementations	❌ Error	PR adds new function update_lfx_dep_in_bundles but includes no dedicated test file. PR description mentions "inline tests" but none exist in code.	Add test file (scripts/ci/test_update_lfx_version.py) with unit tests for update_lfx_dep_in_bundles function and integration tests, following test_*.py naming convention.
Test Quality And Coverage	⚠️ Warning	No dedicated test file or pytest tests found for the new `update_lfx_dep_in_bundles()` function. Mentioned verification was done during development but tests are not committed with the code.	Add `scripts/ci/test_update_lfx_version.py` with tests for: regex matching, idempotent behavior, no-op when bundles dir missing, proper file rewriting without changing unrelated deps.

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title clearly and accurately summarizes the main change: re-pinning bundle LFX dependencies to lfx-nightly during nightly build, which is the core objective of this PR.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test File Naming And Structure	✅ Passed	Check not applicable. PR modifies CI workflow, secrets baseline, and a CI script. No test files were added or modified.
Excessive Mock Usage Warning	✅ Passed	PR contains only implementation and configuration changes. No test files are added/modified, and new code has zero mock usage. Check not applicable.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ci/nightly-bundle-lfx-pin

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-05-19T16:46:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.06%. Comparing base (5620ce1) to head (4f4f9ff).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #13208      +/-   ##
==========================================
- Coverage   53.12%   53.06%   -0.07%     
==========================================
  Files        2033     2033              
  Lines      184171   184171              
  Branches    26195    27723    +1528     
==========================================
- Hits        97843    97725     -118     
- Misses      85219    85337     +118     
  Partials     1109     1109

Flag	Coverage Δ
backend	`56.20% <ø> (-0.02%)`	⬇️
frontend	`53.04% <ø> (-0.09%)`	⬇️
lfx	`50.07% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.
see 168 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-05-19T16:52:50Z

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	35.47% (40695/114715)	68.12% (5605/8227)	35.95% (943/2623)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
4018	0 💤	0 ❌	0 🔥	8m 39s ⏱️

… (#13210) * ci: stop publishing -nightly bundle variants; release bundles on demand (#13206) Bundles (lfx-arxiv, lfx-duckduckgo) change infrequently enough that a nightly cadence is overkill. Drop the rename-to-`-nightly` and bundle publish lanes from the nightly pipeline and add a dedicated workflow_dispatch-only release_bundles.yml for purposeful releases. - nightly_build.yml: drop update_bundle_versions.py invocation and the src/bundles/*/pyproject.toml git-add guard. - release_nightly.yml: remove build-nightly-bundles and publish-nightly-bundles jobs; untether test-cross-platform and publish-nightly-main from them. - release_bundles.yml (new): build all src/bundles/* wheels, run a cross-OS install smoke test, then publish to PyPI under their stable names. Tolerates already-published versions so re-runs without a version bump are no-ops. release.yml still owns bundle publishing as part of main releases. Manual follow-up (PyPI admin): delete the lfx-arxiv-nightly and lfx-duckduckgo-nightly projects from PyPI. * ci(release_bundles): build lfx wheel locally for smoke test (#13207) The release_bundles.yml smoke test installs bundle wheels into a fresh venv, which makes uv resolve their `lfx>=X.Y,<Z` pin against PyPI. When bundles are released ahead of a matching lfx (typical case — bundles ship more often than lfx bumps land on PyPI), the resolve fails: Because only lfx<=0.4.3 is available and lfx-arxiv==0.1.0 depends on lfx>=0.5.0,<0.6.0, we can conclude that lfx-arxiv==0.1.0 cannot be used. Build the lfx wheel from the current ref in the build-bundles job and install it alongside the bundle wheels in the smoke test. The lfx wheel ships as a separate `dist-lfx-smoketest` artifact and is NOT included in the publish-bundles step — only the `dist-bundles` artifact gets pushed to PyPI. * ci(nightly): re-pin bundle lfx deps to lfx-nightly during nightly build (#13208) The nightly pipeline renames the workspace `lfx` package to `lfx-nightly` in `src/lfx/pyproject.toml` and the root workspace dep, but leaves each `src/bundles/*/pyproject.toml`'s `"lfx>=X.Y,<Z"` pin unchanged. With the workspace `lfx` gone and PyPI still on lfx 0.4.3, the create-nightly-tag job's `uv lock` fails: × No solution found when resolving dependencies for split [...] ╰─▶ Because only lfx<=0.4.3 is available and lfx-arxiv depends on lfx>=0.5.0,<0.6.0, we can conclude that lfx-arxiv's requirements are unsatisfiable. `update_lfx_version.py` now also rewrites the `lfx` (or already-rewritten `lfx-nightly`) specifier in every `src/bundles/*/pyproject.toml` to `lfx-nightly==<dev version>`, mirroring how `update_lf_base_dependency` re-pins the lfx dep inside `langflow-base`. The lookahead in the regex prevents matching sibling packages like `lfx-arxiv` / `lfx-duckduckgo`. No-op when no bundle pyprojects exist (e.g. on main today), so this is safe to merge ahead of the bundle extraction landing on main. Restored the guarded `git add src/bundles/*/pyproject.toml` step so the modified bundle pyprojects ride the same commit/tag as the rest of the nightly version bumps. Cherry-pick to release-1.10.0 to unblock nightlies cut from that branch.

erichare merged commit 500b5e9 into main May 19, 2026
114 of 115 checks passed

erichare deleted the ci/nightly-bundle-lfx-pin branch May 19, 2026 16:55

erichare mentioned this pull request May 19, 2026

ci: backport bundle/nightly CI fixes from main (#13206, #13207, #13208) #13210

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(nightly): re-pin bundle lfx deps to lfx-nightly during nightly build#13208

ci(nightly): re-pin bundle lfx deps to lfx-nightly during nightly build#13208
erichare merged 1 commit into
mainfrom
ci/nightly-bundle-lfx-pin

erichare commented May 19, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 19, 2026 •

edited

Loading

Pre-merge checks failed

Uh oh!

codecov Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

erichare commented May 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Pre-merge checks failed

❌ Failed checks (1 error, 1 warning)

Uh oh!

codecov Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented May 19, 2026

Frontend Unit Test Coverage Report

Coverage Summary

Unit Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

erichare commented May 19, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 19, 2026 •

edited

Loading

codecov Bot commented May 19, 2026 •

edited

Loading