Merge remote-tracking branch 'origin/main' into glary/design-system-brand-yellow-f2ff59

# Conflicts:
#	.github/workflows/ci-tests-e2e.yaml

Author: christian-byrne

.coderabbit.yaml

@@ -5,6 +5,10 @@ reviews:
   profile: assertive
   high_level_summary: false
   request_changes_workflow: true
+  # Without this, a review that never happened (rate limit, internal error)
+  # still reports green, so an unreviewed PR is indistinguishable from a
+  # cleanly reviewed one.
+  fail_commit_status: true
   auto_review:
     drafts: true
     ignore_title_keywords:

.github/ISSUE_TEMPLATE/bug-report.yaml

@@ -26,7 +26,7 @@ body:
     id: reproduce
     attributes:
       label: Steps to Reproduce
-      description: How can we reproduce this issue? Please attach your workflow (JSON or PNG).
+      description: How can we reproduce this issue?
       placeholder: |
         1. Add a KSampler node
         2. Connect it to...
@@ -39,6 +39,22 @@ body:
     validations:
       required: true
 
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Workflow
+      description: |
+        **This is the single most useful thing you can give us.** A workflow that reproduces the
+        bug lets us write a regression test matching your exact setup, so the bug stays fixed.
+
+        Export it with **Workflow → Export** in the menu, then drag the `.json` file into this box.
+        A PNG saved by ComfyUI also works — it has the workflow embedded.
+
+        If the bug has nothing to do with a specific workflow, write "N/A".
+      placeholder: Drag your workflow .json or .png here, or write N/A
+    validations:
+      required: true
+
   - type: dropdown
     id: severity
     attributes:
@@ -56,8 +72,8 @@ body:
     id: version
     attributes:
       label: ComfyUI Frontend Version
-      description: Found in Settings > About (e.g., "1.3.45")
-      placeholder: '1.3.45'
+      description: Open **Settings → About** and copy the frontend version shown there. Please give the actual version, not the example.
+      placeholder: 'e.g. 1.49.2'
     validations:
       required: true
 

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and usage help
+    url: https://discord.com/invite/comfyorg
+    about: For "how do I…" questions, setup help, and general usage, ask in Discord — you will get an answer faster there.
+  - name: Documentation
+    url: https://docs.comfy.org
+    about: Guides, node reference, and troubleshooting.
+  - name: Custom node problems
+    url: https://github.com/Comfy-Org/ComfyUI-Manager/issues
+    about: If the problem only happens with a specific custom node installed, report it to that node's repository or to ComfyUI-Manager.
+  - name: Backend, sampling, or model issues
+    url: https://github.com/Comfy-Org/ComfyUI/issues
+    about: For errors during generation, VRAM problems, model loading, or samplers — those live in the core ComfyUI repository.

.github/actions/find-workflow-run/action.yaml

@@ -29,7 +29,7 @@ runs:
   steps:
     - name: Find workflow run
       id: find
-      uses: actions/github-script@v8
+      uses: actions/github-script@v9
       env:
         WORKFLOW_ID: ${{ inputs.workflow-id }}
         HEAD_SHA: ${{ inputs.head-sha }}

.github/actions/resolve-pr-from-workflow-run/action.yaml

@@ -32,7 +32,7 @@ runs:
   steps:
     - name: Resolve PR
       id: resolve
-      uses: actions/github-script@v8
+      uses: actions/github-script@v9
       with:
         github-token: ${{ inputs.token }}
         script: |

.github/actions/upsert-comment-section/action.yaml

@@ -26,7 +26,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/github-script@v8
+    - uses: actions/github-script@v9
       env:
         INPUT_PR_NUMBER: ${{ inputs.pr-number }}
         INPUT_SECTION_NAME: ${{ inputs.section-name }}

.github/workflows/ci-lint-format.yaml

@@ -78,7 +78,7 @@ jobs:
       - name: Comment on PR about auto-fix
         if: steps.verify-changed-files.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name == github.repository
         continue-on-error: true
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             github.rest.issues.createComment({

.github/workflows/ci-tests-e2e-coverage.yaml

@@ -85,6 +85,16 @@ jobs:
             fi
           done
 
+      - name: Assert coverage was mapped back to source
+        if: steps.coverage-shards.outputs.has-coverage == 'true'
+        run: |
+          MAPPED_SF=$(grep -cE '^SF:(src|packages)/' coverage/playwright/coverage.lcov || true)
+          echo "Source-mapped files: $MAPPED_SF" >> "$GITHUB_STEP_SUMMARY"
+          if [ "${MAPPED_SF:-0}" -lt 100 ]; then
+            echo "::error::Only $MAPPED_SF files under src/ or packages/ in the merged tracefile. Observed paths: $(grep -m 5 '^SF:' coverage/playwright/coverage.lcov | tr '\n' ' '). Served bundle paths mean the E2E build dropped its '//# sourceMappingURL=' comment — check it ran with COLLECT_COVERAGE=true (vite.config.mts build.sourcemap)."
+            exit 1
+          fi
+
       - name: Strip non-source entries from coverage
         if: steps.coverage-shards.outputs.has-coverage == 'true'
         run: |
@@ -106,7 +116,7 @@ jobs:
 
       - name: Upload E2E coverage to Codecov
         if: steps.coverage-shards.outputs.has-coverage == 'true'
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: coverage/playwright/coverage.lcov
           flags: e2e

.github/workflows/ci-tests-e2e.yaml

@@ -21,7 +21,7 @@ jobs:
     outputs:
       should-run: ${{ steps.changes.outputs.should-run }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: changes
         uses: ./.github/actions/changes-filter
 
@@ -31,15 +31,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup frontend
         uses: ./.github/actions/setup-frontend
         with:
           include_build_step: true
+        env:
+          COLLECT_COVERAGE: 'true'
 
       # Upload only built dist/ (containerized test jobs will pnpm install without cache)
       - name: Upload built frontend
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: frontend-dist
           path: dist/
@@ -68,9 +70,9 @@ jobs:
         shardTotal: [16]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download built frontend
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: frontend-dist
           path: dist/
@@ -90,7 +92,7 @@ jobs:
           COLLECT_COVERAGE: 'true'
 
       - name: Upload blob report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ !cancelled() }}
         with:
           name: blob-report-chromium-${{ matrix.shardIndex }}
@@ -99,7 +101,7 @@ jobs:
 
       - name: Upload shard coverage data
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: e2e-coverage-shard-${{ matrix.shardIndex }}
           path: coverage/playwright/
@@ -126,9 +128,9 @@ jobs:
           [chromium-2x, chromium-0.5x, mobile-chrome, cloud, mobile-safari]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download built frontend
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ (matrix.browser == 'cloud' || matrix.browser == 'mobile-safari') && 'frontend-dist-cloud' || 'frontend-dist' }}
           path: dist/
@@ -156,7 +158,7 @@ jobs:
           pnpm exec playwright merge-reports --reporter=json ./blob-report
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: always()
         with:
           name: playwright-report-${{ matrix.browser }}
@@ -175,7 +177,7 @@ jobs:
           version: 10
 
       - name: Download blob reports
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: ./all-blob-reports
           pattern: blob-report-chromium-*
@@ -190,7 +192,7 @@ jobs:
           pnpm dlx @playwright/test merge-reports --reporter=json ./all-blob-reports
 
       - name: Upload HTML report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: playwright-report-chromium
           path: ./playwright-report/
@@ -232,7 +234,7 @@ jobs:
       has-new-tests: ${{ steps.detect.outputs.has-new-tests }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -260,7 +262,7 @@ jobs:
 
       - name: Download built frontend
         if: steps.detect.outputs.has-new-tests == 'true'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: frontend-dist
           path: dist/
@@ -285,7 +287,7 @@ jobs:
 
       - name: Upload new-test report (with embedded video)
         if: ${{ !cancelled() && steps.detect.outputs.has-new-tests == 'true' }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: playwright-report-new-tests
           path: ./playwright-report/
@@ -314,7 +316,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Upsert playwright starting section into unified report
         uses: ./.github/actions/upsert-comment-section
@@ -345,10 +347,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download all playwright reports
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: playwright-report-*
           path: reports

.github/workflows/ci-tests-unit.yaml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: always()
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: coverage/lcov.info
           flags: unit