Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
✅ Test Coverage AdvisorNo source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉
|
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
fix(ci): resolve Trivy action setup failure in OpenXFlow release pipeline
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8e06322d73
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "display_name": "", | ||
| "documentation": "", | ||
| "i18n_key": "template_notes.basic_prompting.bd8ff52b", | ||
| "i18n_key": "template_notes.basic_prompting.ee8855e9", |
There was a problem hiding this comment.
When a user opens this starter project in any supported non-English locale, its README now appears in English: the new key exists only in locales/en.json, while all seven other locale files still contain template_notes.basic_prompting.bd8ff52b. translate_flow_notes() in utils/i18n.py performs an exact-key lookup and falls back to English, so those existing translations become unreachable. The same regression affects the renamed keys in Custom Component Generator, Document Q&A, and Research Translation Loop. Preserve the existing keys or migrate the corresponding entries in every locale file alongside these changes.
Useful? React with 👍 / 👎.
fix(ci): scan both OCI image architectures with Trivy-compatible archives
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| python scripts/ci/openxflow_verify_image.py \ | ||
| --archive /tmp/openxflow-pr.oci.tar \ | ||
| --plan /tmp/openxflow-pr-plan.json \ | ||
| --output-dir /tmp/openxflow-pr-image-verification |
There was a problem hiding this comment.
For the full image containing ibm_watsonx_ai/connections.py, the new preview job can pass both Trivy action steps but still fail here on the same SDK false positive: openxflow_verify_image.py runs its own secret scan with --ignorefile /dev/null, then rejects every reported finding. Consequently, the .trivyignore.yaml exception added in this commit never reaches this final gate, preventing upload of the verified PR package; the production verification invocation has the same mismatch. Pass the narrowly scoped exception into the verifier too. Trivy's documentation confirms that YAML exceptions require explicitly specifying their path with --ignorefile.
Useful? React with 👍 / 👎.
… exception Production PR amd64 scan detects only gcp-service-account in IBM SDK connections.cpython-314.pyc; the prior narrow source exception covered connections.py but not its generated Python bytecode. Add that exact bytecode path and a regression assertion, keeping other secrets and CRITICAL/HIGH vulnerabilities blocking.
…y policy Resolve the single SHA256-addressed nested image index returned by Skopeo instead of comparing it to the OCI layout wrapper. Keep exact digest and architecture/attestation checks, reuse the scoped Trivy exception for runtime probes, and add positive/negative regression tests. Format the release workflow assertion for Ruff.
… formatting Declare 7860/tcp at the shared runtime stage so docker image inspect matches the strict OCI verification requirement. Add a contract test that covers base/full/full-bundles inheritance. Apply the exact autofix patch for the release workflow test string.
…moke test Keep production LANGFLOW_AUTO_LOGIN=false. Generate a fresh strong password for each offline smoke container so startup can create its superuser, without checking credentials into the repository or modifying the image. Add CI contract tests for the user, network, and credential policy.
Use a named minimum-password constant, allow bounded QEMU startup time, skip unavailable network background refreshes, fail promptly when a container exits, and capture Docker stderr and container state. Keep authentication enabled and both HTTP readiness checks required; cover error paths with regression tests.
Use documented LiteLLM offline/local cost-map flags and one worker in disposable smoke containers; replace repeated QEMU Python interpreter launches with fail-closed curl checks for both real endpoints. Bound ARM64 startup at 600s with existing exit diagnostics. Fix Ruff I001/SLF001 and add checks for HTTP failures, empty responses, and offline environment.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Summary
本次 PR 将 OpenXFlow
develop分支的阶段性开发成果合并至main，完成 Langflow 1.13 官方代码集成、OpenXFlow 自定义功能保留、生产自动发布流水线建设及相关稳定性修复。本次属于正式版本集成，涉及前后端、工作流引擎、权限系统、数据库迁移、CI/CD 和生产部署配置。
合并方向：
develop→main变更规模： 260 commits / 2,239 files changed
主要更新
1. Langflow 1.13 官方代码同步
集成最新 Langflow 1.13 系列代码及相关安全修复。
更新 Connections / OAuth、Provider 集成与治理策略。
集成 Flow Versions、并发编辑冲突保护和工作流版本管理。
更新 Agent、MCP/A2A、Triggers 及 LFX 组件。
改进后台任务执行、暂停、恢复、取消和异常处理。
集成 OIDC issuer 校验、错误信息脱敏等安全改进。
更新组件索引、Starter Projects、依赖和构建工具链。
2. OpenXFlow 定制功能保留与兼容
保留 RBAC 权限、角色委派、用户和团队管理。
保留组织、工作区、项目等授权边界及审计能力。
保留 Channels Gateway 及相关渠道集成。
保留 OpenXFlow 品牌、导航、设置和多语言功能。
保留自定义主题、前端交互和工作流界面。
保留定制 Provider、组件和现有工作流兼容性。
完成官方代码与 OpenXFlow 自定义逻辑的语义合并。
3. 生产自动发布系统
新增参考 ModuRelay 的 main-only 自动发布机制。
新增独立版本文件
deploy/IMAGE_VERSION。仅允许成功合并到
main的 PR 触发生产发布。自动构建 OpenXFlow Docker 镜像并推送 GHCR。
支持
main、sha-*、main-vX.Y.Z镜像标签。版本更新时自动创建 Git Tag 和 GitHub Release。
增加版本不可变校验、发布幂等与并发保护。
集成 SBOM、Provenance、Trivy 安全扫描及运行时检查。
隔离旧 Langflow 发布入口，防止非预期发布。
保留正常开发分支 CI，不允许其触发生产镜像发布。
目标镜像：
ghcr.io/lien0219/openxflow4. 生产部署与集群兼容
新增生产 Docker Compose 配置和部署文档。
支持独立 PostgreSQL、Redis、S3 和共享向量存储。
支持通过固定镜像版本或 Digest 部署。
新增部署健康检查、迁移校验和回滚工具。
为未来多实例及 Kubernetes 部署保留兼容性。
不包含自动连接生产服务器或自动修改生产数据库的操作。
5. CI、依赖和稳定性改进
修复官方同步过程中的代码冲突及集成回归。
更新 Python、LFX、Frontend 依赖和组件索引。
修复 TypeScript、主题、国际化及 Windows CI 相关问题。
完善数据库迁移版本图和兼容性验证。
增加生产发布规则、镜像构建和部署安全测试。
Validation
已完成的主要本地验证：
验证项目 | 结果 -- | -- 官方同步冲突处理 | 75 个冲突全部解决 发布/镜像/部署专项测试 | 748 passed CI 脚本全量测试 | 1328 passed / 18 skipped / 6 failed PostgreSQL 隔离迁移升级 | Passed RBAC / 认证关键回归 | Passed 后台执行与恢复关键回归 | Passed 前端生产构建 | Passed Ruff / Biome / pre-commit | Passed已报告的 6 个 CI 脚本测试失败集中在 Windows Bash/CRLF 历史基线问题，仍需以远程 CI 和基线复核结果为准。
Release Gate
本次 PR 涉及自动生产发布，需要在合并前确认：
GitHub 必需 CI 检查通过。
OpenXFlow release policy 检查通过。
OpenXFlow image rehearsal 检查通过。
GHCR 构建、镜像扫描及架构验证通过。
GitHub Actions 和 GHCR 权限配置完成。
CODEOWNERS 和 main 分支保护生效。
v*Git Tag 保护配置完成。首次发布版本号和已有 Tag 无冲突。
确认
OPENXFLOW_RELEASE_ENABLED的首次发布状态。数据库迁移风险及备份恢复方案完成评审。
重要：本地代码实现完成不代表生产发布验收已经通过。
尚未完成的真实生产环境、外部 Provider 和部署验证不得标记为 Passed。
如果正式发布门禁尚未满足，应保持发布开关关闭，不得绕过检查强行发布。
Deployment & Rollback
正式发布镜像命名规范：
ghcr.io/lien0219/openxflow:main-vX.Y.Z生产环境升级前必须完成 PostgreSQL 备份与迁移兼容性检查。
Docker 镜像回滚不等于数据库回滚。对于不可逆数据库迁移，必须使用经过验证的数据库备份恢复方案。
本次 PR 不直接执行生产部署。
Merge Checklist
所有 Required Checks 通过。
没有新增的 P0/P1 安全或业务回归。
生产发布工作流来源校验正确。
非 main 分支无法执行正式镜像发布。
生产镜像及 Release 门禁已确认。
完成最终代码审查。
目标：完成 OpenXFlow 最新开发成果的稳定集成，为后续正式版本发布及生产部署提供可追溯、可验证、可回滚的交付基础。