[feat] Add CI checks for OSS license compliance and telemetry tree-shaking#6777
Closed
[feat] Add CI checks for OSS license compliance and telemetry tree-shaking#6777
Conversation
…aking Implements automated verification to ensure the OSS distribution: 1. Only includes open-source licensed dependencies 2. Properly tree-shakes proprietary fonts (ABCROM) 3. Removes telemetry code (Mixpanel) from OSS builds New scripts: - scripts/verify-licenses.js - Validates production dependency licenses - scripts/verify-oss-build.js - Checks dist/ for violations New CI workflow: - .github/workflows/ci-oss-compliance.yaml - Runs compliance checks New npm scripts: - pnpm verify:licenses - Check dependency licenses - pnpm verify:oss - Verify OSS build compliance - pnpm verify:compliance - Run all checks - pnpm build:oss - Build OSS distribution Documentation: - docs/OSS_COMPLIANCE.md - Complete guide for compliance checks 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
🎨 Storybook Build Status✅ Build completed successfully! ⏰ Completed at: 12/03/2025, 10:45:51 AM UTC 🔗 Links🎉 Your Storybook is ready for review! |
🎭 Playwright Test Results⏰ Completed at: 12/03/2025, 10:55:35 AM UTC 📈 Summary
📊 Test Reports by Browser
🎉 Click on the links above to view detailed test results for each browser configuration. |
Bundle Size ReportSummary
Category Glance Per-category breakdownApp Entry Points — 3.2 MB (baseline 3.2 MB) • ⚪ 0 BMain entry bundles and manifests
Graph Workspace — 971 kB (baseline 971 kB) • ⚪ 0 BGraph editor runtime, canvas, workflow orchestration
Views & Navigation — 6.54 kB (baseline 6.54 kB) • ⚪ 0 BTop-level views, pages, and routed surfaces
Panels & Settings — 298 kB (baseline 298 kB) • ⚪ 0 BConfiguration panels, inspectors, and settings screens
UI Components — 169 kB (baseline 169 kB) • ⚪ 0 BReusable component library chunks
Data & Services — 12.5 kB (baseline 12.5 kB) • ⚪ 0 BStores, services, APIs, and repositories
Utilities & Hooks — 2.94 kB (baseline 2.94 kB) • ⚪ 0 BHelpers, composables, and utility bundles
Vendor & Third-Party — 8.56 MB (baseline 8.56 MB) • ⚪ 0 BExternal libraries and shared vendor chunks
Other — 3.81 MB (baseline 3.81 MB) • ⚪ 0 BBundles that do not match a named category
|
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
- Make telemetry detection patterns more specific - Target actual Mixpanel API calls instead of generic patterns - Avoid flagging benign code like `.track()` from other libraries - Focus on MixpanelTelemetryProvider and actual tracking methods This reduces false positives while maintaining security. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Post informative comment when OSS compliance checks fail - Include links to workflow logs and documentation - Guide developers on how to fix issues - Only comment on pull requests, not pushes Helps PR authors quickly understand and fix compliance issues. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
|
Member
Author
📝 PR Review Summary✅ Changes Reviewed
🔍 Current CI StatusFailing Check: OSS Build Verification Root Causes:
🛠️ Recent ImprovementsI've made two commits to improve this PR:
🎯 Remaining IssuesThe fundamental issue is that tree-shaking isn't fully working for cloud-specific code: Problem in src/router.ts:19: import { cloudOnboardingRoutes } from './platform/cloud/onboarding/onboardingCloudRoutes'This import happens unconditionally, causing Vite to include the cloud routes module and its dependencies (including fonts) even when Why it happens:
💡 Recommended SolutionsOption 1: Dynamic Import (Best) const routes = [
...(isCloud ? (await import('./platform/cloud/onboarding/onboardingCloudRoutes')).cloudOnboardingRoutes : []),
// ... other routes
]Option 2: Vite Plugin Option 3: Separate Entry Points Option 4: Accept Current Behavior
📊 Impact Assessment
The code is secure (cloud paths never execute), but not ideal for distribution hygiene. 🎬 Next Steps@snomiao - Please review the architectural options above and decide on the preferred approach. I recommend Option 1 (Dynamic Import) as it's the cleanest solution. Would you like me to implement one of these solutions? 🤖 Generated with Claude Code |
Member
Author
Decision: Breaking into Focused PRsAfter comparing this PR with #8623, we've decided to close this PR and break it into 3 focused PRs following the simpler, battle-tested approach from #8623. Why?1. Scope Creep
Each should be its own PR for easier review, testing, and potential rollback. 2. #8623 Approach is Superior
3. Wrong Target
New PlanBreaking into 3 PRs:
Merge OrderOur team will likely merge #8623 first (already in review), then these 3 focused PRs. Detailed AnalysisSee comparison reports: Key takeaway: Simple, focused PRs are easier to review, test, and maintain. The #8623 approach embodies Unix philosophy: do one thing well. |
Member
Author
|
Closing in favor of 3 focused PRs. See comment above for details. |
This was referenced Feb 12, 2026
christian-byrne
pushed a commit
that referenced
this pull request
Feb 20, 2026
## Summary Enhances the existing CI telemetry scan workflow to also detect Mixpanel code in dist files, ensuring it's properly tree-shaken from OSS builds. ## Context - Extends existing `ci-dist-telemetry-scan.yaml` (added in PR #8354) - Based on analysis in closed PR #6777 (split into focused PRs) - Complements GTM detection already in place - Part of comprehensive OSS compliance effort ## Implementation - Adds separate Mixpanel check step with specific patterns: - `mixpanel.init` - `mixpanel.identify` - `MixpanelTelemetryProvider` - `mp.comfy.org` - `mixpanel-browser` - `mixpanel.track(` - Separates GTM and Mixpanel checks for clarity - Adds `DISTRIBUTION=localhost` env var to build step - Excludes source maps from scanning ## Related - Supersedes part of closed PR #6777 - Complements existing GTM check from PR #8354 - Related to PR #8623 (GTM-focused, may be redundant) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8826-Add-Mixpanel-detection-to-telemetry-tree-shaking-validation-3056d73d36508153bab5f55d4bb17658) by [Unito](https://www.unito.io) --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
huntcsg
pushed a commit
that referenced
this pull request
Feb 21, 2026
## Summary Enhances the existing CI telemetry scan workflow to also detect Mixpanel code in dist files, ensuring it's properly tree-shaken from OSS builds. ## Context - Extends existing `ci-dist-telemetry-scan.yaml` (added in PR #8354) - Based on analysis in closed PR #6777 (split into focused PRs) - Complements GTM detection already in place - Part of comprehensive OSS compliance effort ## Implementation - Adds separate Mixpanel check step with specific patterns: - `mixpanel.init` - `mixpanel.identify` - `MixpanelTelemetryProvider` - `mp.comfy.org` - `mixpanel-browser` - `mixpanel.track(` - Separates GTM and Mixpanel checks for clarity - Adds `DISTRIBUTION=localhost` env var to build step - Excludes source maps from scanning ## Related - Supersedes part of closed PR #6777 - Complements existing GTM check from PR #8354 - Related to PR #8623 (GTM-focused, may be redundant) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8826-Add-Mixpanel-detection-to-telemetry-tree-shaking-validation-3056d73d36508153bab5f55d4bb17658) by [Unito](https://www.unito.io) --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
christian-byrne
added a commit
that referenced
this pull request
Feb 23, 2026
## Summary Adds CI workflow to validate OSS build compliance by checking for proprietary fonts and non-approved dependency licenses. ## Context - Part of comprehensive OSS compliance effort (split from closed PR #6777) - Uses simple bash/grep approach following proven #8623 pattern - Complements telemetry checking in PR #8826 and existing #8354 ## Implementation ### Font Validation - Scans dist/ for proprietary ABCROM fonts (.woff, .woff2, .ttf, .otf) - Fails if any ABCROM fonts found in OSS builds - Provides clear fix instructions ### License Validation - Uses `license-checker` npm package - Validates all production dependencies - Only allows OSI-approved licenses: - MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC - 0BSD, BlueOak-1.0.0, Python-2.0, CC0-1.0 - Unlicense, CC-BY-4.0, CC-BY-3.0 - Common dual-license combinations ### Workflow Details - Two separate jobs for parallel execution - Runs on PRs and pushes to main/dev - Builds with `DISTRIBUTION=localhost` for OSS mode - Clear error messages with remediation steps ## Testing - [ ] Font check passes on current main (no ABCROM fonts in dist) - [ ] License check passes on current main (all approved licenses) - [ ] Intentional violation testing ## Related - Supersedes remaining parts of closed PR #6777 - Complements PR #8826 (Mixpanel telemetry) - Follows pattern from PR #8623 (simple bash/grep) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> ┆Issue is synchronized with this [Notion page](https://www.notion.so/PR-8828-Add-CI-validation-for-OSS-assets-fonts-and-licenses-3056d73d3650812390d5d91ca2f319fc) by [Unito](https://www.unito.io) --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: bymyself <cbyrne@comfy.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements automated verification to ensure the OSS distribution complies with licensing requirements and properly removes proprietary/telemetry code.
This PR addresses the requirements from the Notion task:
Changes
New Verification Scripts
scripts/verify-licenses.jsscripts/verify-oss-build.jsdist/directory for violationsCI Workflow
.github/workflows/ci-oss-compliance.yamllicense-check: Verifies dependency licensesoss-build-check: Builds OSS distribution and verifies complianceNPM Scripts
Documentation
docs/OSS_COMPLIANCE.mdHow It Works
Tree-Shaking Mechanism
The build uses compile-time constants for dead code elimination:
When building with
DISTRIBUTION=localhost:isCloudevaluates tofalseVerification Patterns
The OSS build verifier checks for:
Proprietary Fonts:
.woff,.woff2,.ttf,.otffiles containing "ABCROM"Telemetry Code:
mixpanel/MixpanelTelemetryProvidertrackWorkflow,trackEvent,.track(mp.comfy.orgTest Plan
Testing Locally
Notes
🤖 Generated with Claude Code
Fixes #10204
┆Issue is synchronized with this Notion page by Unito