From 54dbcbb761d21cc999f7362a452ed9671aac2bfe Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Sat, 18 Jul 2026 18:40:47 -0700 Subject: [PATCH 1/2] ci: install test deps from uv.lock so upstream releases can't break every PR (BE-3292) The pytest and build-and-test workflows installed test dependencies unpinned (pip install pytest ... + pip install -e .), resolving transitive deps fresh on every run and ignoring the versions pinned in uv.lock. When an upstream package publishes a new release, CI broke on every open PR at once with failures unrelated to the PR's own diff (e.g. tomlkit 0.15.1 on 2026-07-17 broke 9 config_parser/node_init tests). Install from the lockfile via uv sync/uv run --frozen so CI matches local dev; --frozen fails loudly if uv.lock drifts from pyproject.toml rather than silently resolving something new. Upgrades become deliberate lockfile bumps in their own reviewable PRs. --- .github/workflows/build-and-test.yml | 23 ++++++++++------------- .github/workflows/pytest.yml | 18 +++++++++--------- 2 files changed, 19 insertions(+), 22 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 24c58159..cf78c88c 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -39,30 +39,27 @@ jobs: - name: Check out code uses: actions/checkout@v7 - - name: Set up Python - uses: actions/setup-python@v6 + - name: Install uv + uses: astral-sh/setup-uv@v5 with: - python-version: ${{ matrix.python-version }} + enable-cache: true + # Install from uv.lock so CI uses the same pinned versions as local dev + # (`--frozen` fails loudly if the lockfile drifts from pyproject.toml + # instead of silently resolving a new upstream release). - name: Install Dependencies - run: | - python -m pip install --upgrade pip - pip install pytest - pip install -e . + run: uv sync --extra dev --frozen --python ${{ matrix.python-version }} - name: Test CUDA auto-detection (skips if no GPU) - run: | - pytest tests/comfy_cli/test_cuda_detect_real.py -v + run: uv run --frozen --extra dev --python ${{ matrix.python-version }} pytest tests/comfy_cli/test_cuda_detect_real.py -v - name: Test e2e env: PYTHONPATH: ${{ github.workspace }} TEST_E2E: true - run: | - pytest tests/e2e + run: uv run --frozen --extra dev --python ${{ matrix.python-version }} pytest tests/e2e - name: Test torch backend compilation env: TEST_TORCH_BACKEND: "true" - run: | - pytest tests/uv/test_torch_backend_compile.py -xvs + run: uv run --frozen --extra dev --python ${{ matrix.python-version }} pytest tests/uv/test_torch_backend_compile.py -xvs diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml index c0d45cca..0219f7ab 100644 --- a/.github/workflows/pytest.yml +++ b/.github/workflows/pytest.yml @@ -20,22 +20,22 @@ jobs: steps: - uses: actions/checkout@v7 - - name: Set up Python - uses: actions/setup-python@v6 + - name: Install uv + uses: astral-sh/setup-uv@v5 with: - python-version: '3.10' # Follow the min version in pyproject.toml + enable-cache: true + # Install from uv.lock so CI uses the same pinned versions as local dev + # (`--frozen` fails loudly if the lockfile drifts from pyproject.toml + # instead of silently resolving a new upstream release). `--python 3.10` + # follows the min version in pyproject.toml. - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install pytest pytest-cov jsonschema - pip install -e . + run: uv sync --extra dev --frozen --python 3.10 - name: Run tests env: PYTHONPATH: ${{ github.workspace }} - run: | - pytest --cov=comfy_cli --cov-report=xml . + run: uv run --frozen --extra dev --python 3.10 pytest --cov=comfy_cli --cov-report=xml . - name: Upload coverage to Codecov uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2 From 3ef75467103626e3d3a21c8c980909927ab1b23b Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Sat, 18 Jul 2026 18:55:21 -0700 Subject: [PATCH 2/2] ci: pin astral-sh/setup-uv to commit SHA (BE-3292) Pin astral-sh/setup-uv to the immutable commit d4b2f3b (v5.4.2, the current v5 tag) instead of the mutable v5 tag, so a retagged or compromised upstream release can't run arbitrary code in CI. Matches the SHA-pinning convention already used for codecov/codecov-action. Addresses CodeQL alerts 44/45 and adversarial cursor-review findings. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/build-and-test.yml | 2 +- .github/workflows/pytest.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index cf78c88c..466cdef1 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -40,7 +40,7 @@ jobs: uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2 with: enable-cache: true diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml index 0219f7ab..f4fcc072 100644 --- a/.github/workflows/pytest.yml +++ b/.github/workflows/pytest.yml @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2 with: enable-cache: true