Merge remote-tracking branch 'origin/main' into matt/be-4815-lint-scope

# Conflicts:
#	eslint.config.ts

Author: mattmillerai

.github/actions/setup-frontend/action.yaml

@@ -5,6 +5,10 @@ inputs:
     description: 'Include the build step to build the frontend. Set to true for workflows that need a built frontend'
     required: false
     default: 'false'
+  node_cache:
+    description: "Share the lockfile-keyed pnpm store cache. Set to 'false' in jobs that execute unreviewed third-party code: setup-node's post step writes the store AFTER the job body, and the same key is restored by the publish workflows, which hold NPM_TOKEN, PYPI_TOKEN and id-token: write."
+    required: false
+    default: 'true'
 runs:
   using: 'composite'
   steps:
@@ -18,7 +22,7 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: '.nvmrc'
-        cache: 'pnpm'
+        cache: ${{ inputs.node_cache == 'true' && 'pnpm' || '' }}
         cache-dependency-path: './pnpm-lock.yaml'
 
     - name: Install dependencies

.github/workflows/ci-ecosystem-matrix.yaml

@@ -112,7 +112,7 @@ jobs:
             --summary \
             --excludePackages '@comfyorg/comfyui-frontend;@comfyorg/design-system;@comfyorg/ingest-types;@comfyorg/registry-types;@comfyorg/shared-frontend-utils;@comfyorg/tailwind-utils;@comfyorg/comfyui-electron-types' \
             --clarificationsFile .github/license-clarifications.json \
-            --onlyAllow 'MIT;MIT*;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;BlueOak-1.0.0;Python-2.0;CC0-1.0;Unlicense;(MIT OR Apache-2.0);(MIT OR GPL-3.0);(Apache-2.0 OR MIT);(MPL-2.0 OR Apache-2.0);CC-BY-4.0;CC-BY-3.0;GPL-3.0-only'; then
+            --onlyAllow 'MIT;MIT*;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;BlueOak-1.0.0;Python-2.0;CC0-1.0;Unlicense;(MIT OR Apache-2.0);(MIT OR GPL-3.0);(Apache-2.0 OR MIT);(MPL-2.0 OR Apache-2.0);MPL-2.0;CC-BY-4.0;CC-BY-3.0;GPL-3.0-only'; then
             echo ''
             echo '✅ All production dependency licenses are approved!'
           else

.github/workflows/ci-oss-assets-validation.yaml

@@ -106,6 +106,16 @@ jobs:
       ref: ${{ github.event.pull_request.merge_commit_sha }}
     secrets: inherit
 
+  # GITHUB_TOKEN releases emit no events, so the reconciler's own trigger never fires.
+  enforce_latest:
+    name: Enforce Latest Release
+    needs: draft_release
+    permissions:
+      contents: write
+    uses: ./.github/workflows/release-enforce-latest.yaml
+    secrets:
+      PR_GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
+
   comment_release_summary:
     name: Comment Release Summary
     needs:
@@ -125,6 +135,7 @@ jobs:
           fetch-depth: 2
 
       - name: Post release summary comment
+        continue-on-error: true
         uses: ./.github/actions/comment-release-links
         with:
           issue-number: ${{ github.event.pull_request.number }}

.github/workflows/release-draft-create.yaml

@@ -1,108 +1,38 @@
 name: Enforce Greatest-Semver-Wins Latest Release
 
-# Keeps GitHub's "latest release" flag pinned to the highest stable semver
-# tag, so `--front-end-version latest` can never resolve to an older release
-# than what's already shipped.
-#
-# Un-publishing the current latest release is treated as an implicit
-# rollback: latest reassigns to the next-highest published stable release.
-# This is intentional.
+# Un-publishing the latest release rolls Latest back on purpose.
 
 on:
   release:
     types: [published, edited, unpublished, deleted]
   workflow_dispatch: {}
+  workflow_call:
+    secrets:
+      PR_GH_TOKEN:
+        required: true
   schedule:
-    - cron: '0 4 * * *' # daily backstop in case a release webhook is dropped
+    - cron: '0 4 * * *'
 
-# Serialize runs so two near-simultaneous release edits can't race each
-# other's `gh release edit --latest` calls. Do NOT cancel-in-progress: a
-# queued run still needs to re-check state after the run ahead of it finishes.
 concurrency:
   group: enforce-latest-release
-  cancel-in-progress: false
 
 jobs:
   enforce-latest:
     runs-on: ubuntu-latest
-    # Defense in depth: GH_TOKEN edits don't retrigger `release` events, but
-    # this guards against a future PAT/App-token swap that would.
-    if: github.triggering_actor != 'github-actions[bot]'
+    # On workflow_call the actor is whoever merged the release PR, often a bot.
+    if: github.event_name != 'release' || github.triggering_actor != 'github-actions[bot]'
     permissions:
-      contents: write # required: gh release edit / releases API write access
+      contents: write
     steps:
-      - name: Reconcile "latest" flag to the highest stable semver release
+      # workflow_call inherits the caller's refs/pull/N/merge, gone once it closes.
+      - uses: actions/checkout@v7
+        with:
+          ref: main
+          sparse-checkout: scripts/cicd/reconcile-latest-release.sh
+          sparse-checkout-cone-mode: false
+
+      - name: Reconcile Latest to the highest stable semver release
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
           REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-
-          echo "Fetching all releases for $REPO..."
-          RELEASES_JSON=$(gh release list --repo "$REPO" --limit 1000 \
-            --json tagName,isDraft,isPrerelease,isLatest)
-
-          COUNT=$(echo "$RELEASES_JSON" | jq 'length')
-          if [ "$COUNT" -ge 1000 ]; then
-            echo "::warning::Release count hit --limit 1000 cap. Results may be truncated."
-          fi
-
-          STABLE_TAGS=$(echo "$RELEASES_JSON" | jq -r \
-            '.[] | select(.isDraft == false and .isPrerelease == false) | .tagName')
-
-          if [ -z "$STABLE_TAGS" ]; then
-            echo "::warning::No stable (non-draft, non-prerelease) releases found. '--front-end-version latest' will 404 until one exists."
-            exit 0
-          fi
-
-          # Defensive filter: only strict [v]X.Y.Z tags -- skips "-rc"/"-beta"
-          # tags mis-flagged as stable, and other monorepo tags (design-system,
-          # desktop-ui, npm-types, etc.) that aren't ours.
-          CANDIDATES=()
-          while IFS= read -r tag; do
-            if [[ "$tag" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              CANDIDATES+=("$tag")
-            fi
-          done <<< "$STABLE_TAGS"
-
-          if [ "${#CANDIDATES[@]}" -eq 0 ]; then
-            echo "::warning::No semver-shaped stable tags found among releases. '--front-end-version latest' will 404 until one exists."
-            exit 0
-          fi
-
-          # greatest-semver-wins: sort numerically (v-prefix stripped), not by
-          # tag name or publish date.
-          TRUE_LATEST_VER=$(printf '%s\n' "${CANDIDATES[@]}" | sed 's/^v//' | sort -V | tail -1)
-
-          TRUE_LATEST_TAG=""
-          for tag in "${CANDIDATES[@]}"; do
-            if [[ "${tag#v}" == "$TRUE_LATEST_VER" ]]; then
-              TRUE_LATEST_TAG="$tag"
-              break
-            fi
-          done
-
-          [ -n "$TRUE_LATEST_TAG" ] || { echo "::error::BUG: could not resolve TRUE_LATEST_TAG"; exit 1; }
-
-          echo "Highest stable semver release: $TRUE_LATEST_TAG"
-
-          CURRENT_LATEST_TAG=$(echo "$RELEASES_JSON" | jq -r \
-            '[.[] | select(.isLatest == true)][0].tagName // empty')
-          echo "GitHub-flagged 'latest' release: ${CURRENT_LATEST_TAG:-<none>}"
-
-          if [ "$CURRENT_LATEST_TAG" == "$TRUE_LATEST_TAG" ]; then
-            echo "OK: 'latest' already matches the highest stable semver release. No action needed."
-            exit 0
-          fi
-
-          echo "::warning::'latest' is currently '${CURRENT_LATEST_TAG:-<none>}' but the highest stable semver release is '$TRUE_LATEST_TAG'. Reassigning 'latest' to '$TRUE_LATEST_TAG'."
-
-          gh release edit "$TRUE_LATEST_TAG" --repo "$REPO" --latest
-
-          {
-            echo "## Latest-release auto-correction"
-            echo ""
-            echo "- Previously flagged as \`latest\`: \`${CURRENT_LATEST_TAG:-<none>}\`"
-            echo "- Highest stable semver release: \`$TRUE_LATEST_TAG\`"
-            echo "- Action taken: re-assigned \`latest\` to \`$TRUE_LATEST_TAG\` via \`gh release edit --latest\`"
-          } >> "$GITHUB_STEP_SUMMARY"
+        run: ./scripts/cicd/reconcile-latest-release.sh

.github/workflows/release-enforce-latest.yaml

@@ -179,37 +179,34 @@ jobs:
 
   publish-pypi:
     needs: [resolve-version, trigger-release-if-needed]
+    outputs:
+      pypi_confirmed: ${{ steps.pypi-wait.outputs.confirmed }}
     if: >
       always() &&
       needs.resolve-version.result == 'success' &&
       (needs.trigger-release-if-needed.result == 'success' ||
        needs.trigger-release-if-needed.result == 'skipped')
     runs-on: ubuntu-latest
     steps:
-      - name: Wait for release PR to be created and merged
+      - name: Check out release scripts
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: scripts/cicd
+          sparse-checkout-cone-mode: false
+
+      # The tag checkout below replaces the workspace, and the tag predates these.
+      - name: Stage release scripts
+        run: cp -r scripts/cicd "$RUNNER_TEMP/cicd"
+
+      - name: Wait for the release tag
         if: needs.trigger-release-if-needed.result == 'success'
         env:
           GH_TOKEN: ${{ secrets.PR_GH_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          TARGET_VERSION="${{ needs.resolve-version.outputs.target_version }}"
-          TARGET_BRANCH="${{ needs.resolve-version.outputs.target_branch }}"
-          echo "Waiting for version bump PR for v${TARGET_VERSION} on ${TARGET_BRANCH} to be merged..."
-
-          # Poll for up to 30 minutes (a human or automation needs to merge the version bump PR)
-          for i in $(seq 1 60); do
-            # Check if the tag exists (release-draft-create creates a tag on merge)
-            if gh api "repos/Comfy-Org/ComfyUI_frontend/git/ref/tags/v${TARGET_VERSION}" --silent 2>/dev/null; then
-              echo "✅ Tag v${TARGET_VERSION} found — release PR has been merged"
-              exit 0
-            fi
-            echo "Attempt $i/60: Tag v${TARGET_VERSION} not found yet, waiting 30s..."
-            sleep 30
-          done
-
-          echo "❌ Timed out waiting for tag v${TARGET_VERSION}"
-          exit 1
+          REPO: ${{ github.repository }}
+          TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
+          TARGET_BRANCH: ${{ needs.resolve-version.outputs.target_branch }}
+          RUN_ID: ${{ github.run_id }}
+        run: '$RUNNER_TEMP/cicd/wait-for-release-tag.sh'
 
       - name: Checkout code at target version
         uses: actions/checkout@v7
@@ -262,35 +259,20 @@ jobs:
           password: ${{ secrets.PYPI_TOKEN }}
           packages-dir: comfyui_frontend_package/dist
 
-      - name: Wait for PyPI propagation
-        run: |
-          set -euo pipefail
-
-          TARGET_VERSION="${{ needs.resolve-version.outputs.target_version }}"
-          PACKAGE="comfyui-frontend-package"
-          echo "Waiting for ${PACKAGE}==${TARGET_VERSION} to be available on PyPI..."
-
-          # Wait up to 15 minutes (polling every 30 seconds)
-          for i in $(seq 1 30); do
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/${PACKAGE}/${TARGET_VERSION}/json")
-            if [ "$HTTP_CODE" = "200" ]; then
-              echo "✅ ${PACKAGE}==${TARGET_VERSION} is available on PyPI"
-              exit 0
-            fi
-            echo "Attempt $i/30: PyPI returned HTTP ${HTTP_CODE}, waiting 30s..."
-            sleep 30
-          done
-
-          echo "❌ Timed out waiting for ${PACKAGE}==${TARGET_VERSION} on PyPI"
-          exit 1
+      - name: Wait for the version to be installable
+        id: pypi-wait
+        env:
+          PACKAGE: comfyui-frontend-package
+          TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
+        run: '$RUNNER_TEMP/cicd/wait-for-pypi-version.sh'
 
       - name: Summary
         run: |
           echo "## PyPI Publishing" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "- Package: comfyui-frontend-package" >> $GITHUB_STEP_SUMMARY
           echo "- Version: ${{ needs.resolve-version.outputs.target_version }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Status: ✅ Published and confirmed available" >> $GITHUB_STEP_SUMMARY
+          echo "- Installable from PyPI: ${{ steps.pypi-wait.outputs.confirmed }}" >> $GITHUB_STEP_SUMMARY
 
   create-comfyui-pr:
     needs:
@@ -372,7 +354,11 @@ jobs:
           EOF
           )
 
-          PYPI_NOTE="✅ **PyPI package confirmed available** — \`comfyui-frontend-package==${{ needs.resolve-version.outputs.target_version }}\` has been published and verified."
+          if [ "${{ needs.publish-pypi.outputs.pypi_confirmed }}" = "true" ]; then
+            PYPI_NOTE="✅ **PyPI package confirmed available** — \`comfyui-frontend-package==${{ needs.resolve-version.outputs.target_version }}\` has been published and verified."
+          else
+            PYPI_NOTE="⚠️ **PyPI availability unconfirmed** — \`comfyui-frontend-package==${{ needs.resolve-version.outputs.target_version }}\` was not installable from PyPI before the wait expired. CI here may fail until the index catches up."
+          fi
           BODY=$''"${PYPI_NOTE}"$'\n\n'"${BODY}"
 
           # Save to file for later use
@@ -459,3 +445,21 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### PR Body:" >> $GITHUB_STEP_SUMMARY
           cat pr-body.txt >> $GITHUB_STEP_SUMMARY
+
+  release-done:
+    name: Verify release reached users
+    needs: [resolve-version, publish-pypi]
+    if: always() && needs.publish-pypi.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout ComfyUI_frontend
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Assert the release reached users
+        env:
+          PACKAGE: comfyui-frontend-package
+          TARGET_VERSION: ${{ needs.resolve-version.outputs.target_version }}
+          TARGET_BRANCH: ${{ needs.resolve-version.outputs.target_branch }}
+        run: ./scripts/cicd/assert-release-shipped.sh