Skip to content

fix: restrict PyPI publishing to core-bound versions only #9949

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
christian-byrne wants to merge 1 commit into from
Closed

fix: restrict PyPI publishing to core-bound versions only #9949

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 98 additions & 2 deletions .github/workflows/release-biweekly-comfyui.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,9 +162,105 @@ jobs:
echo "- Target version: ${{ needs.resolve-version.outputs.target_version }}" >> $GITHUB_STEP_SUMMARY
echo "- [View workflow runs](https://github.com/Comfy-Org/ComfyUI_frontend/actions/workflows/release-version-bump.yaml)" >> $GITHUB_STEP_SUMMARY

wait-for-release:
needs: [resolve-version, trigger-release-if-needed]
if: always() && needs.resolve-version.result == 'success'
runs-on: ubuntu-latest
steps:
- name: Wait for release tag
if: needs.trigger-release-if-needed.result == 'success'
env:
GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
run: |
set -euo pipefail

TAG="v${TARGET_VERSION}"
echo "Waiting for tag ${TAG} to appear..."

MAX_ATTEMPTS=60
SLEEP_SECONDS=30

for i in $(seq 1 $MAX_ATTEMPTS); do
if gh api "repos/Comfy-Org/ComfyUI_frontend/git/refs/tags/${TAG}" --silent 2>/dev/null; then
echo "✅ Tag ${TAG} found after ${i} attempts"
exit 0
fi

echo "Attempt ${i}/${MAX_ATTEMPTS}: Tag ${TAG} not found yet, waiting ${SLEEP_SECONDS}s..."
sleep $SLEEP_SECONDS
done

echo "❌ Tag ${TAG} not found after ${MAX_ATTEMPTS} attempts ($(( MAX_ATTEMPTS * SLEEP_SECONDS / 60 )) minutes)"
echo "The release PR may need to be merged manually."
echo "Re-run this workflow via workflow_dispatch after the release is complete."
exit 1

- name: Tag already exists
if: needs.trigger-release-if-needed.result == 'skipped'
env:
TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
run: |
echo "✅ No new release needed — tag v${TARGET_VERSION} should already exist"
Comment on lines +199 to +204
Copy link
Contributor

@coderabbitai coderabbitai bot Mar 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

"Tag already exists" step doesn't verify the tag actually exists.

When trigger-release-if-needed is skipped, this step assumes the tag exists but doesn't verify it. If needs_release is false for a reason other than the tag existing (e.g., no changes detected), the subsequent publish-pypi job will fail at checkout.

Consider adding verification to fail fast with a clear error rather than failing later at checkout.

🛡️ Proposed fix: verify tag existence 
       - name: Tag already exists
         if: needs.trigger-release-if-needed.result == 'skipped'
         env:
+          GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
           TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
         run: |
-          echo "✅ No new release needed — tag v${TARGET_VERSION} should already exist"
+          TAG="v${TARGET_VERSION}"
+          if gh api "repos/Comfy-Org/ComfyUI_frontend/git/refs/tags/${TAG}" > /dev/null 2>&1; then
+            echo "✅ Tag ${TAG} already exists"
+          else
+            echo "❌ Tag ${TAG} does not exist but needs_release is false"
+            echo "This may indicate the resolver returned unexpected results."
+            exit 1
+          fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Tag already exists
if: needs.trigger-release-if-needed.result == 'skipped'
env:
TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
run: |
echo "✅ No new release needed — tag v${TARGET_VERSION} should already exist"
- name: Tag already exists
if: needs.trigger-release-if-needed.result == 'skipped'
env:
GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
run: |
TAG="v${TARGET_VERSION}"
if gh api "repos/Comfy-Org/ComfyUI_frontend/git/refs/tags/${TAG}" > /dev/null 2>&1; then
echo "✅ Tag ${TAG} already exists"
else
echo "❌ Tag ${TAG} does not exist but needs_release is false"
echo "This may indicate the resolver returned unexpected results."
exit 1
fi
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release-biweekly-comfyui.yaml around lines 199 - 204,
Update the "Tag already exists" step to actually verify the remote tag before
assuming it exists: when needs.trigger-release-if-needed.result == 'skipped',
run a check using TARGET_VERSION (env TARGET_VERSION) against the remote (e.g.,
git ls-remote or git fetch + git rev-parse refs/tags/v${TARGET_VERSION}) and
exit non‑zero with a clear error if the tag is missing so downstream jobs like
publish-pypi fail fast with a descriptive message.


publish-pypi:
needs: [resolve-version, wait-for-release]
runs-on: ubuntu-latest
steps:
- name: Checkout code at target version
uses: actions/checkout@v6
with:
ref: v${{ needs.resolve-version.outputs.target_version }}

- name: Install pnpm
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 10

- uses: actions/setup-node@v6
with:
node-version-file: '.nvmrc'
cache: 'pnpm'

- name: Build project
env:
SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
ALGOLIA_APP_ID: ${{ secrets.ALGOLIA_APP_ID }}
ALGOLIA_API_KEY: ${{ secrets.ALGOLIA_API_KEY }}
ENABLE_MINIFY: 'true'
USE_PROD_CONFIG: 'true'
run: |
pnpm install --frozen-lockfile
pnpm build

- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.x'

- name: Install build dependencies
run: python -m pip install build

- name: Setup pypi package
run: |
mkdir -p comfyui_frontend_package/comfyui_frontend_package/static/
cp -r dist/* comfyui_frontend_package/comfyui_frontend_package/static/

- name: Build pypi package
run: python -m build
working-directory: comfyui_frontend_package
env:
COMFYUI_FRONTEND_VERSION: ${{ needs.resolve-version.outputs.target_version }}

- name: Publish pypi package
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
with:
password: ${{ secrets.PYPI_TOKEN }}
packages-dir: comfyui_frontend_package/dist

create-comfyui-pr:
needs: [check-release-week, resolve-version, trigger-release-if-needed]
if: always() && needs.resolve-version.result == 'success' && (needs.check-release-week.outputs.is_release_week == 'true' || github.event_name == 'workflow_dispatch')
needs: [check-release-week, resolve-version, publish-pypi]
if: always() && needs.resolve-version.result == 'success' && needs.publish-pypi.result == 'success' && (needs.check-release-week.outputs.is_release_week == 'true' || github.event_name == 'workflow_dispatch')
runs-on: ubuntu-latest

steps:
Expand Down
32 changes: 0 additions & 32 deletions .github/workflows/release-draft-create.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,37 +99,6 @@ jobs:
${{ needs.build.outputs.is_prerelease == 'true' }}
generate_release_notes: true

publish_pypi:
needs: build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
- name: Download dist artifact
uses: actions/download-artifact@v7
with:
name: dist-files
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.x'
- name: Install build dependencies
run: python -m pip install build
- name: Setup pypi package
run: |
mkdir -p comfyui_frontend_package/comfyui_frontend_package/static/
cp -r dist/* comfyui_frontend_package/comfyui_frontend_package/static/
- name: Build pypi package
run: python -m build
working-directory: comfyui_frontend_package
env:
COMFYUI_FRONTEND_VERSION: ${{ needs.build.outputs.version }}
- name: Publish pypi package
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
with:
password: ${{ secrets.PYPI_TOKEN }}
packages-dir: comfyui_frontend_package/dist

publish_types:
needs: build
uses: ./.github/workflows/release-npm-types.yaml
Expand All @@ -142,7 +111,6 @@ jobs:
name: Comment Release Summary
needs:
- draft_release
- publish_pypi
- publish_types
if: success()
runs-on: ubuntu-latest
Expand Down
Loading