Conversation
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that determines a target ComfyUI release (input, payload, or latest), validates it, updates package.json, checks out ComfyUI into assets, regenerates core requirements patch, recompiles bundled requirements, and opens a PR. Includes two helper scripts for patch regen and recompilation. Changes
Sequence DiagramsequenceDiagram
participant User as User
participant Workflow as GitHub Actions Workflow
participant Repo as This Repo
participant API as GitHub API
participant ComfyUI as ComfyUI Repo
participant Scripts as Local Scripts
User->>Workflow: trigger (workflow_dispatch or repository_dispatch)
Workflow->>API: request latest ComfyUI release (if needed)
API-->>Workflow: release tag, version, URL
Workflow->>Workflow: normalize & validate tag/version
Workflow->>Repo: read current package.json version
alt should_update == true
Workflow->>ComfyUI: checkout target tag into assets/ComfyUI
Workflow->>Scripts: run `regenerateCoreRequirementsPatch.sh`
Scripts-->>Workflow: core-requirements.patch
Workflow->>Scripts: run `recompileRequirementsFromHeaders.sh`
Scripts-->>Workflow: recompiled artifacts
Workflow->>Repo: update `package.json` and commit changes
Workflow->>API: create PR with branch, commit, artifacts, labels
API-->>Workflow: PR created
else should_update == false
Workflow-->>User: skip with message
end
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
No actionable comments were generated in the recent review. 🎉 Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
dosubot
bot
added
size:L
There was a problem hiding this comment.
Pull request overview
Adds an automated, event-driven GitHub Actions workflow to bump the embedded ComfyUI release and regenerate the downstream patch + compiled requirement artifacts, reducing manual release maintenance work for Desktop.
Changes:
- Introduces
auto_bump_comfyui_release.yml, triggered byrepository_dispatch(comfyui_release_published) and manualworkflow_dispatch, to open an automated PR bumping ComfyUI. - Adds
scripts/regenerateCoreRequirementsPatch.shto regeneratescripts/core-requirements.patchby removing thecomfyui-frontend-package==...pin from upstream requirements. - Adds
scripts/recompileRequirementsFromHeaders.shto re-runuv pip compilecommands embedded inassets/requirements/*.compiledheaders.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| scripts/regenerateCoreRequirementsPatch.sh | Generates scripts/core-requirements.patch from upstream ComfyUI requirements.txt by removing a pinned dependency line. |
| scripts/recompileRequirementsFromHeaders.sh | Recompiles assets/requirements/*.compiled by replaying the embedded uv pip compile command from each file header. |
| .github/workflows/auto_bump_comfyui_release.yml | New workflow to resolve a target ComfyUI release, bump package.json, regenerate patch, rebuild compiled requirements, and open a PR. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Checkout target ComfyUI release | ||
| if: steps.version.outputs.should_update == 'true' | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| repository: Comfy-Org/ComfyUI | ||
| ref: ${{ steps.version.outputs.target_tag }} | ||
| path: assets/ComfyUI | ||
|
|
||
| - name: Regenerate core requirements patch | ||
| if: steps.version.outputs.should_update == 'true' | ||
| run: | | ||
| set -euo pipefail | ||
| bash scripts/regenerateCoreRequirementsPatch.sh |
There was a problem hiding this comment.
This workflow runs uv pip compile (via scripts/recompileRequirementsFromHeaders.sh) but never pins/installs a specific Python version. update_compiled_requirements.yml explicitly sets up Python 3.12 before compiling; without that, uv may resolve markers differently depending on the runner image and produce inconsistent .compiled outputs. Add a actions/setup-python step (matching the version used elsewhere) before installing/running uv.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.github/workflows/auto_bump_comfyui_release.yml:
- Around line 87-94: The curl invocation that sets TAG_STATUS uses the -f flag
which causes curl to exit non-zero on HTTP errors and triggers set -euo pipefail
to abort the script before the 404 check; update the TAG_STATUS curl command
(the line that sets TAG_STATUS using curl and the TARGET_TAG variable) to remove
the -f option (e.g., change -fsSL to -sSL or otherwise ensure curl always
returns 0) so the HTTP status is captured and the subsequent if [ "$TAG_STATUS"
!= "200" ] check can run and emit the friendly error message.
In `@scripts/recompileRequirementsFromHeaders.sh`:
- Around line 103-105: The current invocation uses bash -lc "$compile_command"
which forces a login shell (losing CI PATH) and runs an unchecked shell string;
change it to run without -l and avoid executing an unchecked string: replace
bash -lc "$compile_command" with a safer execution strategy such as invoking
bash -c "$compile_command" (drop -l) or, better, split the validated command
into an argv array and exec it directly (use the compile_command words as
arguments to run uv with exec or use an array variable) so PATH is preserved and
arbitrary shell injection is avoided; update the invocation around the
compile_command and dry_run check (the block that currently runs bash -lc
"$compile_command") to implement this.
🧹 Nitpick comments (3)
scripts/recompileRequirementsFromHeaders.sh (1)
21-34: Unknown flags (e.g.--foo) are silently treated as file paths.The
*catch-all in the argument parser will interpret any unrecognized flag like--typoas a file argument, leading to a confusing "Missing file" error downstream rather than an "unknown option" message.Consider adding a guard:
Suggested change
*) + if [[ "$argument" == --* ]]; then + echo "Unknown option: $argument" >&2 + usage >&2 + exit 1 + fi compiled_files+=("$argument") ;;.github/workflows/auto_bump_comfyui_release.yml (2)
144-150:uvis installed without version pinning.The install script (
https://astral.sh/uv/install.sh) fetches the latestuvversion. A breaking change or regression in a futureuvrelease could silently alter the compiled output. Consider pinning a version:curl -LsSf https://astral.sh/uv/0.6.x/install.sh | shThis is acceptable for a workflow that produces a human-reviewed PR, but worth noting for reproducibility.
162-164: Consider updating topeter-evans/create-pull-request@v8, the current major version.The
peter-evans/create-pull-request@v6action exists and is stable (v6.1.0 is the latest v6 release), but v8 is now the current major version. Upgrading would ensure access to the latest features, improvements, and security updates.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/auto_bump_comfyui_release.yml:
- Around line 143-167: The PR creation uses the default github.token (see the
peter-evans/create-pull-request@v6 step and its token input), which prevents CI
from running; replace token: ${{ github.token }} with an app-generated
installation token or PAT (e.g., a secret like ${{ secrets.GH_APP_TOKEN }}), and
add a preceding step to create or retrieve that GitHub App/PAT token (store it
in a job output or a secret-name) so the create-pull-request action consumes
that token instead; update the token reference in the create-pull-request step
(token input) to use the generated token variable.
🧹 Nitpick comments (1)
.github/workflows/auto_bump_comfyui_release.yml (1)
125-131: Consider pinning theuvversion for reproducibility.The install script fetches the latest
uv, which could introduce breakage if a newuvrelease changes behavior. The install script supports version pinning:- curl -LsSf https://astral.sh/uv/install.sh | sh + curl -LsSf https://astral.sh/uv/0.6.x/install.sh | shReplace
0.6.xwith the version currently in use. This makes the workflow deterministic and avoids surprise breakage.
| - name: Create pull request | ||
| if: steps.version.outputs.should_update == 'true' | ||
| uses: peter-evans/create-pull-request@v6 | ||
| with: | ||
| token: ${{ github.token }} | ||
| branch: automated/bump-comfyui-v${{ steps.version.outputs.target_version }} | ||
| delete-branch: true | ||
| commit-message: Bump ComfyUI to v${{ steps.version.outputs.target_version }} | ||
| title: Bump ComfyUI to v${{ steps.version.outputs.target_version }} | ||
| body: | | ||
| ## Summary | ||
| - bump `config.comfyUI.version` from `${{ steps.version.outputs.current_version }}` to `${{ steps.version.outputs.target_version }}` | ||
| - regenerate `scripts/core-requirements.patch` from upstream ComfyUI requirements | ||
| - recompile pre-shipped requirements in `assets/requirements/*.compiled` using `uv pip compile` commands stored in file headers | ||
|
|
||
| ## Upstream Release | ||
| - ${{ steps.version.outputs.target_release_url }} | ||
|
|
||
| ## Testing | ||
| - workflow regenerated compiled requirements and patch artifacts | ||
| labels: dependencies | ||
| add-paths: | | ||
| package.json | ||
| scripts/core-requirements.patch | ||
| assets/requirements/*.compiled |
There was a problem hiding this comment.
PRs created with github.token won't trigger CI workflows.
GitHub deliberately prevents workflows triggered by the default GITHUB_TOKEN from triggering further workflow runs (to avoid infinite loops). The auto-generated PR won't run CI checks (e.g., build, test, lint) unless you use a GitHub App token or PAT.
If CI validation on the bump PR is required, swap github.token for an app-generated token:
- token: ${{ github.token }}
+ token: ${{ steps.app-token.outputs.token }}(after adding a step to generate a token from a GitHub App installation)
If the intent is to merge without CI or to manually re-trigger, the current setup is fine — just document that expectation.
🤖 Prompt for AI Agents
In @.github/workflows/auto_bump_comfyui_release.yml around lines 143 - 167, The
PR creation uses the default github.token (see the
peter-evans/create-pull-request@v6 step and its token input), which prevents CI
from running; replace token: ${{ github.token }} with an app-generated
installation token or PAT (e.g., a secret like ${{ secrets.GH_APP_TOKEN }}), and
add a preceding step to create or retrieve that GitHub App/PAT token (store it
in a job output or a secret-name) so the create-pull-request action consumes
that token instead; update the token reference in the create-pull-request step
(token input) to use the generated token variable.
…mfy-Org/desktop into ben/auto-bump-comfyui-release
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Test Evidence CheckIf this PR changes user-facing behavior, visual proof (screen recording or screenshot) is required. PRs without applicable visual documentation may not be reviewed until provided. You can add it by:
|
Summary
workflow_dispatchconfig.comfyUI.version, regeneratescripts/core-requirements.patch, and recompileassets/requirements/*.compiled.compiledheadersMotivation
81c93891303c9b55f0f6601bea44ee5029b2b7faComfy-Org/ComfyUITesting
yarn formatyarn lintyarn typecheckHow To Use
Auto Bump ComfyUI Releasefrom Actions inComfy-Org/desktopcomfyui_version(e.g.0.12.4orv0.12.4)Summary by CodeRabbit