chore(release): promote develop to main with Langflow 1.13 and production publishing pipeline

.github/workflows/ci.yml

@@ -100,10 +100,20 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       should-proceed: ${{ steps.check-pypi.outputs.success }}
+      status: ${{ steps.check-pypi.outputs.status }}
     steps:
       - name: Check PyPI package update
         id: check-pypi
         run: |
+          # Nightly publishing only runs in the canonical Langflow repository. Do not
+          # block fork PRs on the global PyPI package's daily upload schedule.
+          if [[ "${{ github.repository }}" != "langflow-ai/langflow" ]]; then
+            echo "Nightly PyPI check is not applicable to ${{ github.repository }}"
+            echo "success=true" >> $GITHUB_OUTPUT
+            echo "status=not-applicable" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
           # Get today's date in ISO format for comparison
           TODAY=$(date -u +"%Y-%m-%d")
           echo "Today's date: $TODAY"
@@ -118,6 +128,7 @@ jobs:
           if [ "$HTTP_STATUS" -ne 200 ]; then
             echo "Error: PyPI API returned HTTP status $HTTP_STATUS"
             echo "success=false" >> $GITHUB_OUTPUT
+            echo "status=unavailable" >> $GITHUB_OUTPUT
             exit 0
           fi
 
@@ -127,6 +138,7 @@ jobs:
             echo "Response preview:"
             head -n 10 response.json
             echo "success=false" >> $GITHUB_OUTPUT
+            echo "status=unavailable" >> $GITHUB_OUTPUT
             exit 0
           fi
 
@@ -136,6 +148,7 @@ jobs:
           if [ -z "$LATEST_VERSION" ]; then
             echo "Could not find a nightly (.devN) release"
             echo "success=false" >> $GITHUB_OUTPUT
+            echo "status=unavailable" >> $GITHUB_OUTPUT
             exit 0
           fi
 
@@ -145,6 +158,7 @@ jobs:
           if [ -z "$RELEASE_DATE" ]; then
             echo "Could not extract release date"
             echo "success=false" >> $GITHUB_OUTPUT
+            echo "status=unavailable" >> $GITHUB_OUTPUT
             exit 0
           fi
 
@@ -155,9 +169,11 @@ jobs:
           if [[ "$RELEASE_DATE" == "$TODAY" ]]; then
             echo "Package was updated today"
             echo "success=true" >> $GITHUB_OUTPUT
+            echo "status=healthy" >> $GITHUB_OUTPUT
           else
             echo "Package was not updated today"
             echo "success=false" >> $GITHUB_OUTPUT
+            echo "status=stale" >> $GITHUB_OUTPUT
           fi
 
           # Clean up
@@ -394,7 +410,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
-          ref: ${{ inputs.ref || github.ref }}
+          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}
 
       # SeaweedFS's S3 gateway: MinIO no longer publishes pullable images. A service
       # container cannot pass it the "server" command, so start it here. With no S3
@@ -557,7 +573,7 @@ jobs:
           echo "=== CI Status Summary ==="
           echo "Should run tests: ${{ needs.set-ci-condition.outputs.should-run-tests }}"
           echo "Should run CI: ${{ needs.set-ci-condition.outputs.should-run-ci }}"
-          echo "Nightly build status: ${{ needs.check-nightly-status.outputs.should-proceed }}"
+          echo "Nightly build status: ${{ needs.check-nightly-status.outputs.status }}"
           echo "Event type: ${{ github.event_name }}"
           echo "Docs only changes: $DOCS_ONLY"
           echo "Path filter decision: ${{ needs.path-filter.result }}"
@@ -620,9 +636,9 @@ jobs:
             echo "  2. Re-run the workflow if needed"
 
           elif [[ "${{ needs.check-nightly-status.outputs.should-proceed }}" != "true" && "${{ github.event_name }}" != "workflow_dispatch" && "$DOCS_ONLY" != "true" ]]; then
-            echo "🚫 CI BLOCKED: Nightly build is broken"
+            echo "🚫 CI BLOCKED: Nightly package is stale or unavailable"
             echo ""
-            echo "The nightly PyPI package was not updated today, indicating the nightly build failed."
+            echo "The latest nightly PyPI package was not updated today or its status could not be verified."
             echo ""
             echo "🔧 Next steps:"
             echo "  1. Work with the team to investigate and fix the nightly build"
@@ -637,7 +653,11 @@ jobs:
             echo "🎉 Your changes are ready:"
             echo "  - All tests passed"
             echo "  - Code quality checks passed"
-            echo "  - Nightly build is healthy"
+            if [[ "${{ needs.check-nightly-status.outputs.status }}" == "not-applicable" ]]; then
+              echo "  - Nightly status check is not applicable to this repository"
+            else
+              echo "  - Nightly build is healthy"
+            fi
           fi
 
           echo ""

.github/workflows/openxflow-production-release.yml

@@ -2,7 +2,7 @@ name: OpenXFlow Production Release
 
 on:
   pull_request:
-    types: [closed]
+    types: [opened, synchronize, reopened, closed]
     branches: [main]
 
 permissions:
@@ -13,13 +13,167 @@ env:
   IMAGE_NAME: lien0219/openxflow
   PRODUCTION_REPOSITORY: lien0219/openxflow
 
-# Every merged PR gets its own run. Only the floating main promotion is
-# serialized, so a slow build cannot discard an immutable source image.
+# PR updates produce a verified artifact without registry publication. Every
+# merged PR gets its own release run; only floating main promotion is serialized.
 concurrency:
   group: openxflow-production-${{ github.event.pull_request.merge_commit_sha || github.run_id }}
   cancel-in-progress: false
 
 jobs:
+  preview-package:
+    name: Build and verify PR package
+    if: >-
+      github.repository == 'lien0219/openxflow' &&
+      github.event_name == 'pull_request' &&
+      github.event.action != 'closed' &&
+      github.event.pull_request.base.ref == 'main' &&
+      github.event.pull_request.base.repo.full_name == 'lien0219/openxflow'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out PR head
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Set up emulation and Buildx
+        uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Materialize the PR image verification plan
+        id: preview-plan
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          source="$(git rev-parse HEAD)"
+          version="$(cat deploy/IMAGE_VERSION)"
+          created="$(git show -s --format=%cI "$source")"
+          python - "$source" "$version" "$created" > /tmp/openxflow-pr-plan.json <<'PY'
+          import json
+          import sys
+          print(json.dumps({"source": sys.argv[1], "version": sys.argv[2], "created": sys.argv[3]}))
+          PY
+          {
+            echo "source=$source"
+            echo "version=$version"
+            echo "created=$created"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build the PR OCI package
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./docker/build_and_push.Dockerfile
+          target: full
+          platforms: linux/amd64,linux/arm64
+          push: false
+          outputs: type=oci,dest=/tmp/openxflow-pr.oci.tar
+          build-args: |
+            OPENXFLOW_VERSION=${{ steps.preview-plan.outputs.version }}
+            OPENXFLOW_REVISION=${{ steps.preview-plan.outputs.source }}
+            OPENXFLOW_CREATED=${{ steps.preview-plan.outputs.created }}
+            OPENXFLOW_SOURCE=https://github.com/lien0219/openxflow
+            OPENXFLOW_URL=https://github.com/lien0219/openxflow
+          labels: |
+            org.opencontainers.image.title=OpenXFlow
+            org.opencontainers.image.description=OpenXFlow workflow automation platform
+            org.opencontainers.image.version=${{ steps.preview-plan.outputs.version }}
+            org.opencontainers.image.revision=${{ steps.preview-plan.outputs.source }}
+            org.opencontainers.image.created=${{ steps.preview-plan.outputs.created }}
+            org.opencontainers.image.source=https://github.com/lien0219/openxflow
+            org.opencontainers.image.url=https://github.com/lien0219/openxflow
+          cache-from: type=gha,scope=openxflow-pr-${{ github.event.pull_request.number }}
+          cache-to: type=gha,mode=max,scope=openxflow-pr-${{ github.event.pull_request.number }}
+          provenance: mode=max
+          sbom: true
+
+      # Trivy's --input accepts Docker save tarballs or an unpacked OCI layout,
+      # not a Buildx type=oci tar archive. Convert each platform separately so
+      # both architectures receive the same blocking vulnerability/secret scan.
+      - name: Prepare per-architecture Trivy scan inputs (PR)
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq skopeo jq
+          for arch in amd64 arm64; do
+            output="/tmp/openxflow-pr-${arch}.docker.tar"
+            skopeo copy --override-os linux --override-arch "$arch" \
+              "oci-archive:/tmp/openxflow-pr.oci.tar" \
+              "docker-archive:${output}:openxflow-scan:${arch}"
+            actual="$(skopeo inspect "docker-archive:${output}" | jq -r '.Architecture // empty')"
+            if [ "$actual" != "$arch" ]; then
+              echo "::error::Expected $arch scan input, got ${actual:-missing}"
+              exit 1
+            fi
+          done
+
+      - name: Prepare Trivy evidence folder (PR)
+        shell: bash
+        run: mkdir -p /tmp/openxflow-trivy
+
+      - name: Scan the unpushed PR amd64 image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          input: /tmp/openxflow-pr-amd64.docker.tar
+          format: json
+          output: /tmp/openxflow-trivy/pr-amd64.json
+          exit-code: "1"
+          ignore-unfixed: "false"
+          severity: CRITICAL,HIGH
+          scanners: vuln,secret
+          trivyignores: .trivyignore.yaml
+
+      - name: Scan the unpushed PR arm64 image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          input: /tmp/openxflow-pr-arm64.docker.tar
+          format: json
+          output: /tmp/openxflow-trivy/pr-arm64.json
+          exit-code: "1"
+          ignore-unfixed: "false"
+          severity: CRITICAL,HIGH
+          scanners: vuln,secret
+          trivyignores: .trivyignore.yaml
+
+      - name: Verify PR package attestations and runtime probes
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          python scripts/ci/openxflow_verify_image.py \
+            --archive /tmp/openxflow-pr.oci.tar \
+            --plan /tmp/openxflow-pr-plan.json \
+            --output-dir /tmp/openxflow-pr-image-verification
+
+      - name: Retain failed and successful Trivy PR reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: openxflow-pr-trivy-${{ github.event.pull_request.number }}-${{ steps.preview-plan.outputs.source }}
+          path: /tmp/openxflow-trivy/
+          if-no-files-found: ignore
+          retention-days: 14
+
+      - name: Retain PR image verification evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: openxflow-pr-image-verification-${{ github.event.pull_request.number }}-${{ steps.preview-plan.outputs.source }}
+          path: /tmp/openxflow-pr-image-verification
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Upload verified PR OCI package
+        uses: actions/upload-artifact@v4
+        with:
+          name: openxflow-pr-oci-${{ github.event.pull_request.number }}-${{ steps.preview-plan.outputs.source }}
+          path: /tmp/openxflow-pr.oci.tar
+          if-no-files-found: error
+          retention-days: 7
+
   validate-merge:
     name: Validate exact merged main source
     if: >-
@@ -297,15 +451,63 @@ jobs:
             'import importlib.util; assert importlib.util.find_spec("langflow"); assert importlib.util.find_spec("pgvector")'
           docker run --rm --entrypoint langflow openxflow-runtime-probe:local --help >/dev/null
 
-      - name: Scan the unpushed OCI archive (or recovered retry)
-        uses: aquasecurity/trivy-action@0.28.0
+      # Trivy's --input accepts Docker save tarballs or an unpacked OCI layout,
+      # not a Buildx type=oci tar archive. Convert each platform separately so
+      # both architectures receive the same blocking vulnerability/secret scan.
+      - name: Prepare per-architecture Trivy scan inputs (production)
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq skopeo jq
+          for arch in amd64 arm64; do
+            output="/tmp/openxflow-${arch}.docker.tar"
+            skopeo copy --override-os linux --override-arch "$arch" \
+              "oci-archive:/tmp/openxflow.oci.tar" \
+              "docker-archive:${output}:openxflow-scan:${arch}"
+            actual="$(skopeo inspect "docker-archive:${output}" | jq -r '.Architecture // empty')"
+            if [ "$actual" != "$arch" ]; then
+              echo "::error::Expected $arch scan input, got ${actual:-missing}"
+              exit 1
+            fi
+          done
+
+      - name: Prepare Trivy evidence folder (production)
+        shell: bash
+        run: mkdir -p /tmp/openxflow-trivy
+
+      - name: Scan the unpushed production amd64 image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
-          input: /tmp/openxflow.oci.tar
-          format: table
+          input: /tmp/openxflow-amd64.docker.tar
+          format: json
+          output: /tmp/openxflow-trivy/production-amd64.json
           exit-code: "1"
           ignore-unfixed: "false"
           severity: CRITICAL,HIGH
           scanners: vuln,secret
+          trivyignores: .trivyignore.yaml
+
+      - name: Scan the unpushed production arm64 image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          input: /tmp/openxflow-arm64.docker.tar
+          format: json
+          output: /tmp/openxflow-trivy/production-arm64.json
+          exit-code: "1"
+          ignore-unfixed: "false"
+          severity: CRITICAL,HIGH
+          scanners: vuln,secret
+          trivyignores: .trivyignore.yaml
+
+      - name: Retain production Trivy reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: openxflow-production-trivy-${{ github.run_id }}-${{ github.run_attempt }}
+          path: /tmp/openxflow-trivy/
+          if-no-files-found: ignore
+          retention-days: 14
 
       - name: Verify OCI attestations, both architectures, and runtime probes
         shell: bash

.trivyignore.yaml

@@ -0,0 +1,12 @@
+# Exception for a third-party SDK's literal property-name example, not a credential.
+# Review with IBM Watson SDK upgrades; expires automatically.
+secrets:
+  - id: gcp-service-account
+    paths:
+      - "**/site-packages/ibm_watsonx_ai/connections.py"
+      - "**/site-packages/ibm_watsonx_ai/__pycache__/connections.cpython-314.pyc"
+    expired_at: 2026-12-31
+    statement: >-
+      IBM Watson SDK example property mapping includes the literal identifier
+      gcp_service_account; no service-account JSON private key is embedded.
+      Only this rule in this SDK source file and its deterministic CPython 3.14\n      compiled bytecode are excluded; all other findings still block.