mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-23 22:15:24 +08:00
a277209fe4
* ci: push nightly .devX docker images to langflowai/langflow in addition to langflowai/langflow-nightly
Mirrors PyPI behaviour where .devX releases are published under the
'langflow' package name (not 'langflow-nightly'). The Docker nightly
workflow now tags and pushes every nightly image to both repos:
- langflowai/langflow-nightly:{ver} (existing)
- langflowai/langflow:{ver} (new — matches PyPI)
- langflowai/langflow-nightly:latest (existing)
- langflowai/langflow:latest (new)
Same mirroring applied to the base and main-all variants, and to GHCR.
The arch-specific intermediate tags (used to assemble multi-arch
manifests) remain under the '-nightly' repos; only the final merged
manifests are additionally published to the canonical 'langflow' repos.
Fixes: LE-1667
* ci: update db-migration-validation to use canonical langflowai/langflow image
The db-migration-validation workflow was still referencing the old
langflowai/langflow-nightly image for its nightly upgrade step.
Now that .devX images are also pushed to langflowai/langflow (canonical
repo, matching PyPI), update all consumer-side references:
- nightly_build.yml: nightly_tag now passes langflowai/langflow:<tag>
- db-migration-validation.yml: default and shell fallbacks updated to
langflowai/langflow:latest; inline comments updated to match
The langflowai/langflow-nightly images remain in use as intermediate
arch-specific staging tags inside docker-nightly-build.yml only.
Relates to: LE-1667
* ci: fix stale langflow-nightly package name reference in comment
The nightly is published as canonical .devN pre-releases of langflow /
langflow-base (not as separate langflow-nightly / langflow-base-nightly
packages). Update the generate-shared-tag step comment to accurately
reflect this since the rename that happened in the 1.10 release cycle.
Relates to: LE-1353, LE-1667
* fix(ci): do not set :latest on canonical langflow repo for nightly .devX images
Nightly .devX images should not overwrite the stable :latest tag on
langflowai/langflow. The :latest (and :base-latest) floating tags are
only set on the -nightly repos (langflowai/langflow-nightly), which
are explicitly nightly-only. The canonical langflowai/langflow repo
only receives the versioned tag (e.g. :1.11.0.dev20250522), matching
PyPI behaviour where langflow==1.11.0.dev20250522 is published but
never becomes the 'latest' release index entry.
Addresses PR review comment from @jordanrfrazier.
Relates to: LE-1667
* fix(ci): prevent shell injection from inputs.nightly_tag in db-migration-validation
Pass inputs.nightly_tag through an env: block and reference it as
$INPUT_NIGHTLY_TAG in the shell script rather than expanding the
GitHub Actions expression directly inside run:. Direct expansion of
${{ inputs.* }} in shell scripts allows an attacker-controlled input
to inject arbitrary shell commands (CWE-78).
Flagged by CodeRabbit security review.
Relates to: LE-1667