Merge origin/main into comfydesigner/enterprise-tier-rendering

Amp-Thread-ID: https://ampcode.com/threads/T-01a02452-d1ab-71a8-a05a-a44cde538f9c
Co-authored-by: Amp <amp@ampcode.com>

Author: dante01yoon

.github/workflows/ci-oss-assets-validation.yaml

@@ -112,7 +112,7 @@ jobs:
             --summary \
             --excludePackages '@comfyorg/comfyui-frontend;@comfyorg/design-system;@comfyorg/ingest-types;@comfyorg/registry-types;@comfyorg/shared-frontend-utils;@comfyorg/tailwind-utils;@comfyorg/comfyui-electron-types' \
             --clarificationsFile .github/license-clarifications.json \
-            --onlyAllow 'MIT;MIT*;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;BlueOak-1.0.0;Python-2.0;CC0-1.0;Unlicense;(MIT OR Apache-2.0);(MIT OR GPL-3.0);(Apache-2.0 OR MIT);(MPL-2.0 OR Apache-2.0);CC-BY-4.0;CC-BY-3.0;GPL-3.0-only'; then
+            --onlyAllow 'MIT;MIT*;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;BlueOak-1.0.0;Python-2.0;CC0-1.0;Unlicense;(MIT OR Apache-2.0);(MIT OR GPL-3.0);(Apache-2.0 OR MIT);(MPL-2.0 OR Apache-2.0);MPL-2.0;CC-BY-4.0;CC-BY-3.0;GPL-3.0-only'; then
             echo ''
             echo '✅ All production dependency licenses are approved!'
           else

.github/workflows/release-draft-create.yaml

@@ -106,6 +106,16 @@ jobs:
       ref: ${{ github.event.pull_request.merge_commit_sha }}
     secrets: inherit
 
+  # GITHUB_TOKEN releases emit no events, so the reconciler's own trigger never fires.
+  enforce_latest:
+    name: Enforce Latest Release
+    needs: draft_release
+    permissions:
+      contents: write
+    uses: ./.github/workflows/release-enforce-latest.yaml
+    secrets:
+      PR_GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
+
   comment_release_summary:
     name: Comment Release Summary
     needs:
@@ -125,6 +135,7 @@ jobs:
           fetch-depth: 2
 
       - name: Post release summary comment
+        continue-on-error: true
         uses: ./.github/actions/comment-release-links
         with:
           issue-number: ${{ github.event.pull_request.number }}

.github/workflows/release-enforce-latest.yaml

@@ -1,108 +1,38 @@
 name: Enforce Greatest-Semver-Wins Latest Release
 
-# Keeps GitHub's "latest release" flag pinned to the highest stable semver
-# tag, so `--front-end-version latest` can never resolve to an older release
-# than what's already shipped.
-#
-# Un-publishing the current latest release is treated as an implicit
-# rollback: latest reassigns to the next-highest published stable release.
-# This is intentional.
+# Un-publishing the latest release rolls Latest back on purpose.
 
 on:
   release:
     types: [published, edited, unpublished, deleted]
   workflow_dispatch: {}
+  workflow_call:
+    secrets:
+      PR_GH_TOKEN:
+        required: true
   schedule:
-    - cron: '0 4 * * *' # daily backstop in case a release webhook is dropped
+    - cron: '0 4 * * *'
 
-# Serialize runs so two near-simultaneous release edits can't race each
-# other's `gh release edit --latest` calls. Do NOT cancel-in-progress: a
-# queued run still needs to re-check state after the run ahead of it finishes.
 concurrency:
   group: enforce-latest-release
-  cancel-in-progress: false
 
 jobs:
   enforce-latest:
     runs-on: ubuntu-latest
-    # Defense in depth: GH_TOKEN edits don't retrigger `release` events, but
-    # this guards against a future PAT/App-token swap that would.
-    if: github.triggering_actor != 'github-actions[bot]'
+    # On workflow_call the actor is whoever merged the release PR, often a bot.
+    if: github.event_name != 'release' || github.triggering_actor != 'github-actions[bot]'
     permissions:
-      contents: write # required: gh release edit / releases API write access
+      contents: write
     steps:
-      - name: Reconcile "latest" flag to the highest stable semver release
+      # workflow_call inherits the caller's refs/pull/N/merge, gone once it closes.
+      - uses: actions/checkout@v7
+        with:
+          ref: main
+          sparse-checkout: scripts/cicd/reconcile-latest-release.sh
+          sparse-checkout-cone-mode: false
+
+      - name: Reconcile Latest to the highest stable semver release
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
           REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-
-          echo "Fetching all releases for $REPO..."
-          RELEASES_JSON=$(gh release list --repo "$REPO" --limit 1000 \
-            --json tagName,isDraft,isPrerelease,isLatest)
-
-          COUNT=$(echo "$RELEASES_JSON" | jq 'length')
-          if [ "$COUNT" -ge 1000 ]; then
-            echo "::warning::Release count hit --limit 1000 cap. Results may be truncated."
-          fi
-
-          STABLE_TAGS=$(echo "$RELEASES_JSON" | jq -r \
-            '.[] | select(.isDraft == false and .isPrerelease == false) | .tagName')
-
-          if [ -z "$STABLE_TAGS" ]; then
-            echo "::warning::No stable (non-draft, non-prerelease) releases found. '--front-end-version latest' will 404 until one exists."
-            exit 0
-          fi
-
-          # Defensive filter: only strict [v]X.Y.Z tags -- skips "-rc"/"-beta"
-          # tags mis-flagged as stable, and other monorepo tags (design-system,
-          # desktop-ui, npm-types, etc.) that aren't ours.
-          CANDIDATES=()
-          while IFS= read -r tag; do
-            if [[ "$tag" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              CANDIDATES+=("$tag")
-            fi
-          done <<< "$STABLE_TAGS"
-
-          if [ "${#CANDIDATES[@]}" -eq 0 ]; then
-            echo "::warning::No semver-shaped stable tags found among releases. '--front-end-version latest' will 404 until one exists."
-            exit 0
-          fi
-
-          # greatest-semver-wins: sort numerically (v-prefix stripped), not by
-          # tag name or publish date.
-          TRUE_LATEST_VER=$(printf '%s\n' "${CANDIDATES[@]}" | sed 's/^v//' | sort -V | tail -1)
-
-          TRUE_LATEST_TAG=""
-          for tag in "${CANDIDATES[@]}"; do
-            if [[ "${tag#v}" == "$TRUE_LATEST_VER" ]]; then
-              TRUE_LATEST_TAG="$tag"
-              break
-            fi
-          done
-
-          [ -n "$TRUE_LATEST_TAG" ] || { echo "::error::BUG: could not resolve TRUE_LATEST_TAG"; exit 1; }
-
-          echo "Highest stable semver release: $TRUE_LATEST_TAG"
-
-          CURRENT_LATEST_TAG=$(echo "$RELEASES_JSON" | jq -r \
-            '[.[] | select(.isLatest == true)][0].tagName // empty')
-          echo "GitHub-flagged 'latest' release: ${CURRENT_LATEST_TAG:-<none>}"
-
-          if [ "$CURRENT_LATEST_TAG" == "$TRUE_LATEST_TAG" ]; then
-            echo "OK: 'latest' already matches the highest stable semver release. No action needed."
-            exit 0
-          fi
-
-          echo "::warning::'latest' is currently '${CURRENT_LATEST_TAG:-<none>}' but the highest stable semver release is '$TRUE_LATEST_TAG'. Reassigning 'latest' to '$TRUE_LATEST_TAG'."
-
-          gh release edit "$TRUE_LATEST_TAG" --repo "$REPO" --latest
-
-          {
-            echo "## Latest-release auto-correction"
-            echo ""
-            echo "- Previously flagged as \`latest\`: \`${CURRENT_LATEST_TAG:-<none>}\`"
-            echo "- Highest stable semver release: \`$TRUE_LATEST_TAG\`"
-            echo "- Action taken: re-assigned \`latest\` to \`$TRUE_LATEST_TAG\` via \`gh release edit --latest\`"
-          } >> "$GITHUB_STEP_SUMMARY"
+        run: ./scripts/cicd/reconcile-latest-release.sh

.github/workflows/release-weekly-comfyui.yaml

@@ -179,37 +179,34 @@ jobs:
 
   publish-pypi:
     needs: [resolve-version, trigger-release-if-needed]
+    outputs:
+      pypi_confirmed: ${{ steps.pypi-wait.outputs.confirmed }}
     if: >
       always() &&
       needs.resolve-version.result == 'success' &&
       (needs.trigger-release-if-needed.result == 'success' ||
        needs.trigger-release-if-needed.result == 'skipped')
     runs-on: ubuntu-latest
     steps:
-      - name: Wait for release PR to be created and merged
+      - name: Check out release scripts
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: scripts/cicd
+          sparse-checkout-cone-mode: false
+
+      # The tag checkout below replaces the workspace, and the tag predates these.
+      - name: Stage release scripts
+        run: cp -r scripts/cicd "$RUNNER_TEMP/cicd"
+
+      - name: Wait for the release tag
         if: needs.trigger-release-if-needed.result == 'success'
         env:
           GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          TARGET_VERSION="${{ needs.resolve-version.outputs.target_version }}"
-          TARGET_BRANCH="${{ needs.resolve-version.outputs.target_branch }}"
-          echo "Waiting for version bump PR for v${TARGET_VERSION} on ${TARGET_BRANCH} to be merged..."
-
-          # Poll for up to 30 minutes (a human or automation needs to merge the version bump PR)
-          for i in $(seq 1 60); do
-            # Check if the tag exists (release-draft-create creates a tag on merge)
-            if gh api "repos/Comfy-Org/ComfyUI_frontend/git/ref/tags/v${TARGET_VERSION}" --silent 2>/dev/null; then
-              echo "✅ Tag v${TARGET_VERSION} found — release PR has been merged"
-              exit 0
-            fi
-            echo "Attempt $i/60: Tag v${TARGET_VERSION} not found yet, waiting 30s..."
-            sleep 30
-          done
-
-          echo "❌ Timed out waiting for tag v${TARGET_VERSION}"
-          exit 1
+          REPO: ${{ github.repository }}
+          TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
+          TARGET_BRANCH: ${{ needs.resolve-version.outputs.target_branch }}
+          RUN_ID: ${{ github.run_id }}
+        run: '$RUNNER_TEMP/cicd/wait-for-release-tag.sh'
 
       - name: Checkout code at target version
         uses: actions/checkout@v7
@@ -262,35 +259,20 @@ jobs:
           password: ${{ secrets.PYPI_TOKEN }}
           packages-dir: comfyui_frontend_package/dist
 
-      - name: Wait for PyPI propagation
-        run: |
-          set -euo pipefail
-
-          TARGET_VERSION="${{ needs.resolve-version.outputs.target_version }}"
-          PACKAGE="comfyui-frontend-package"
-          echo "Waiting for ${PACKAGE}==${TARGET_VERSION} to be available on PyPI..."
-
-          # Wait up to 15 minutes (polling every 30 seconds)
-          for i in $(seq 1 30); do
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/${PACKAGE}/${TARGET_VERSION}/json")
-            if [ "$HTTP_CODE" = "200" ]; then
-              echo "✅ ${PACKAGE}==${TARGET_VERSION} is available on PyPI"
-              exit 0
-            fi
-            echo "Attempt $i/30: PyPI returned HTTP ${HTTP_CODE}, waiting 30s..."
-            sleep 30
-          done
-
-          echo "❌ Timed out waiting for ${PACKAGE}==${TARGET_VERSION} on PyPI"
-          exit 1
+      - name: Wait for the version to be installable
+        id: pypi-wait
+        env:
+          PACKAGE: comfyui-frontend-package
+          TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
+        run: '$RUNNER_TEMP/cicd/wait-for-pypi-version.sh'
 
       - name: Summary
         run: |
           echo "## PyPI Publishing" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "- Package: comfyui-frontend-package" >> $GITHUB_STEP_SUMMARY
           echo "- Version: ${{ needs.resolve-version.outputs.target_version }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Status: ✅ Published and confirmed available" >> $GITHUB_STEP_SUMMARY
+          echo "- Installable from PyPI: ${{ steps.pypi-wait.outputs.confirmed }}" >> $GITHUB_STEP_SUMMARY
 
   create-comfyui-pr:
     needs:
@@ -372,7 +354,11 @@ jobs:
           EOF
           )
 
-          PYPI_NOTE="✅ **PyPI package confirmed available** — \`comfyui-frontend-package==${{ needs.resolve-version.outputs.target_version }}\` has been published and verified."
+          if [ "${{ needs.publish-pypi.outputs.pypi_confirmed }}" = "true" ]; then
+            PYPI_NOTE="✅ **PyPI package confirmed available** — \`comfyui-frontend-package==${{ needs.resolve-version.outputs.target_version }}\` has been published and verified."
+          else
+            PYPI_NOTE="⚠️ **PyPI availability unconfirmed** — \`comfyui-frontend-package==${{ needs.resolve-version.outputs.target_version }}\` was not installable from PyPI before the wait expired. CI here may fail until the index catches up."
+          fi
           BODY=$''"${PYPI_NOTE}"$'\n\n'"${BODY}"
 
           # Save to file for later use
@@ -459,3 +445,21 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### PR Body:" >> $GITHUB_STEP_SUMMARY
           cat pr-body.txt >> $GITHUB_STEP_SUMMARY
+
+  release-done:
+    name: Verify release reached users
+    needs: [resolve-version, publish-pypi]
+    if: always() && needs.publish-pypi.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout ComfyUI_frontend
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Assert the release reached users
+        env:
+          PACKAGE: comfyui-frontend-package
+          TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
+          TARGET_BRANCH: ${{ needs.resolve-version.outputs.target_branch }}
+        run: ./scripts/cicd/assert-release-shipped.sh

apps/website/e2e/events.spec.ts

@@ -194,15 +194,27 @@ test.describe('Events page — desktop @smoke', () => {
         await expect(row).toContainText(event.location![locale])
         await expect(row).toContainText(event.dateLabel![locale])
 
-        const livestreamLink = row.getByRole('link', {
-          name: new RegExp(t('events.upcoming.livestream', locale))
+        // In-person events override the CTA label (e.g. "Register"); the rest
+        // fall back to the default "Livestream" label.
+        const ctaLabel =
+          event.ctaLabel?.[locale] ?? t('events.upcoming.livestream', locale)
+        const ctaLink = row.getByRole('link', {
+          name: `${event.title[locale]} — ${ctaLabel}`,
+          exact: true
         })
         // Events with a stream open their own detail page (dialog over the
         // directory); the rest link to the event's page.
+        const eventLink = event.link
         const expectedHref = eventVideoId(event)
           ? localizeHref(eventPath(event), locale)
-          : event.link!.href[locale]
-        await expect(livestreamLink).toHaveAttribute('href', expectedHref)
+          : eventLink?.href[locale]
+        if (expectedHref) {
+          await expect(ctaLink).toHaveAttribute('href', expectedHref)
+        }
+        // External registration links open in a new tab.
+        if (!eventVideoId(event) && eventLink?.newTab) {
+          await expect(ctaLink).toHaveAttribute('target', '_blank')
+        }
       }
     }
   })

apps/website/e2e/seedance.spec.ts

@@ -1,6 +1,6 @@
 import { expect } from '@playwright/test'
 
-import { externalLinks, getRoutes } from '../src/config/routes'
+import { getRoutes } from '../src/config/routes'
 import { creatorReviews } from '../src/data/creatorReviews'
 import { seedancePage } from '../src/data/seedance'
 import { t } from '../src/i18n/translations'
@@ -20,7 +20,10 @@ const HERO_PRIMARY_CTA: ModelLaunchCta | undefined =
 if (!HERO_PRIMARY_CTA)
   throw new Error('seedancePage must configure a hero primary CTA')
 const SEEDANCE_RUN: string = HERO_PRIMARY_CTA.href
-const CLOUD_WORKFLOWS_HUB = externalLinks.workflows
+// The hub's Seedance family page, which lists the shipped 2.5 workflows. The
+// CTA used to open the hub root, leaving the reader to find the model they had
+// just read about.
+const SEEDANCE_HUB_PAGE: string = seedancePage.hero.secondaryCta?.href ?? ''
 const PROMPT_CTA = t('seedance.hero.promptCta', 'en')
 const COPY_PROMPT = t('modelLaunch.copyPrompt', 'en')
 // `faq` is optional on the template (Wan Animate 2 ships without one), but
@@ -106,7 +109,9 @@ test.describe('Seedance 2.5 page — link targets', () => {
     await expect(primary).toHaveAttribute('href', /video_wan2_2/)
   })
 
-  test('the hero run CTA opens the same Cloud workflow', async ({ page }) => {
+  test('the hero CTAs open Cloud to run and the hub to browse', async ({
+    page
+  }) => {
     const hero = page.locator('section').filter({
       has: page.getByRole('heading', { level: 1, name: HERO_TITLE })
     })
@@ -116,7 +121,10 @@ test.describe('Seedance 2.5 page — link targets', () => {
 
     await expect(
       hero.getByRole('link', { name: t('seedance.hero.secondaryCta', 'en') })
-    ).toHaveAttribute('href', CLOUD_WORKFLOWS_HUB)
+    ).toHaveAttribute('href', SEEDANCE_HUB_PAGE)
+    await expect(
+      hero.getByRole('link', { name: t('seedance.hero.secondaryCta', 'en') })
+    ).toHaveAttribute('href', /\/workflows\/model\/seedance$/)
   })
 
   test('renders one step card per configured step', async ({ page }) => {