This page documents the code quality enforcement tools used in the Langflow codebase, including linters, formatters, type checkers, and security scanners. These tools ensure consistent code style, catch bugs early, and maintain high code quality across both Python backend and TypeScript frontend code.
For information about testing strategies (unit tests, integration tests, E2E tests), see Testing Strategy. For CI/CD pipeline orchestration, see CI Pipeline.
Langflow uses multiple tools to enforce code quality at different stages of the development lifecycle:
| Tool | Language | Purpose | When It Runs |
|---|---|---|---|
| ruff | Python | Linting & formatting | Pre-commit, CI, Autofix |
| mypy | Python | Static type checking | CI |
| biome | TypeScript/JavaScript | Linting & formatting | Pre-commit, CI, Autofix |
| tsc | TypeScript | Type checking | CI, local |
| codespell | All | Spell checking | Makefile (manual) |
| detect-secrets | All | Security scanning | Pre-commit |
| Migration validators | Python | Database migration safety | Pre-commit |
All tools are configured to run automatically via pre-commit hooks for local development and GitHub Actions workflows for CI/CD.
Sources: .pre-commit-config.yaml1-79 .github/workflows/py_autofix.yml1-29 pyproject.toml158-246
Pre-commit Hook Configuration
The hooks are defined in .pre-commit-config.yaml1-79 with the following categories:
args: [--fix]pyproject.toml--write flag for auto-fixes.secrets.baselineSources: .pre-commit-config.yaml1-79
Ruff serves as both the linter and formatter for Python code, replacing multiple legacy tools (flake8, black, isort, etc.). The version is pinned at ~=0.13.1 in dev dependencies.
Configuration Location: Root pyproject.toml contains all ruff settings under [tool.ruff] and [tool.ruff.lint].
Key Configuration Values (pyproject.toml208-211):
| Setting | Value |
|---|---|
target-version | "py310" |
line-length | 120 |
select | ["ALL"] (then specific rules are ignored) |
Excluded Paths (pyproject.toml210):
src/backend/base/langflow/alembic/*src/frontend/tests/assets/*src/lfx/src/lfx/_assets/component_index.jsonNotable Ignored Rules (pyproject.toml228-245):
| Rule | Reason |
|---|---|
C90 | McCabe complexity not enforced |
CPY | No copyright headers required |
D10 | Missing docstrings not required |
ANN | Type annotation hints not enforced (TODO) |
ERA | Commented-out code allowed |
PLR09 | No limits on argument/statement counts |
Per-File Ignores (pyproject.toml251-387):
The configuration has extensive per-file ignore rules for different contexts:
| File Pattern | Notable Ignores |
|---|---|
src/backend/base/langflow/api/v1/* | TCH — FastAPI needs runtime type evaluation |
src/backend/base/langflow/alembic/versions/* | INP001, D415, PGH003 |
src/backend/tests/* | S101 (assert), PLR2004 (magic values), D1 (docstrings), SLF001 (private access) |
src/lfx/tests/* | Same as tests, plus S104 and S108 |
src/backend/base/langflow/services/cache/* | S301 — intentional pickle usage |
src/lfx/src/lfx/components/tools/* | S102 — exec/eval for dynamic code |
Ruff Execution Points:
| Context | Command | Auto-fix |
|---|---|---|
| Pre-commit | uv run ruff check --fix | Yes |
| Pre-commit | uv run ruff format --config pyproject.toml | Yes |
| CI style check | uv run ruff check --output-format=github | No |
| Autofix workflow | uv run ruff check --fix-only then ruff format | Yes |
Makefile format_backend | uv run ruff check . --fix && uv run ruff format . | Yes |
Makefile unsafe_fix | uv run ruff check . --fix --unsafe-fixes | Yes (unsafe) |
Style Check Workflow:
The .github/workflows/style-check-py.yml workflow runs on pull requests. The --output-format=github flag enables inline PR annotations.
Autofix Workflow:
The .github/workflows/py_autofix.yml workflow triggers on changes to **/*.py, src/lfx/src/lfx/components/**, and scripts/build_component_index.py. It automatically commits style fixes to the PR branch using autofix-ci/action.
Sources: pyproject.toml208-387 .pre-commit-config.yaml16-27 .github/workflows/py_autofix.yml1-29 .github/workflows/style-check-py.yml Makefile218-229
Mypy performs static type analysis on Python code to catch type errors before runtime. The version is pinned at >=1.11.0 in dev dependencies.
Configuration (pyproject.toml392-398):
| Setting | Value |
|---|---|
plugins | ["pydantic.mypy"] |
follow_imports | "skip" |
disable_error_code | ["type-var"] |
namespace_packages | true |
mypy_path | "langflow" |
ignore_missing_imports | true |
The same configuration appears in both pyproject.toml (root) and src/backend/base/pyproject.toml src/backend/base/pyproject.toml155-161
Execution Context:
Mypy only runs in CI via .github/workflows/lint-py.yml not in pre-commit hooks due to performance:
uv run mypy --namespace-packages -p "langflow"
The --namespace-packages flag is required because Langflow uses namespace packages. The Makefile lint target runs this same command (Makefile231-232).
Sources: pyproject.toml392-398 src/backend/base/pyproject.toml155-161 .github/workflows/lint-py.yml Makefile231-232
Biome (version 2.1.1) is a unified toolchain for JavaScript/TypeScript that handles both linting and formatting, replacing ESLint and Prettier. It is listed as a devDependency in src/frontend/package.json141
Configuration:
Primary configuration lives in src/frontend/biome.json. It uses VCS integration to compare against the main branch and can operate on staged or changed files only.
npm Scripts (src/frontend/package.json106-126):
| Script | Command | Purpose |
|---|---|---|
format | npx @biomejs/biome format --write | Format all files |
lint | npx @biomejs/biome lint | Lint all files |
lint:types:staged | npx @biomejs/biome lint --staged --diagnostic-level=error | Lint only staged files |
check-format | npx @biomejs/biome check | Check (no writes) |
type-check | tsc --noEmit --pretty --project tsconfig.json && vite | TypeScript type check |
TypeScript Type Checking:
In addition to biome linting, tsc --noEmit is available via the type-check npm script for full TypeScript static analysis.
Pre-commit Integration:
The pre-commit hooks run biome in two stages on staged frontend files:
biome check --writeany types using biome lint --staged --diagnostic-level=errorCI Lint Check:
A lint workflow runs biome in check mode with the --changed flag to only check files that differ from the base branch.
An autofix workflow (analogous to py_autofix.yml for Python) auto-commits formatting fixes by running npm run format then using autofix-ci/action to push the changes.
Makefile Target (Makefile224-226):
make format_frontend_check # runs: cd src/frontend && npx @biomejs/biome check
Sources: src/frontend/package.json103-126 .pre-commit-config.yaml1-79 Makefile224-226
codespell is used to catch common spelling errors across all file types in the repository.
Configuration (pyproject.toml158-162):
The ignore-regex pattern suppresses false positives for Latin phrases that appear in code and comments.
Makefile Targets (Makefile212-216):
| Target | Command |
|---|---|
make codespell | uvx codespell --toml pyproject.toml — check only |
make fix_codespell | uvx codespell --toml pyproject.toml --write — auto-fix |
Note that codespell is invoked via uvx (which runs it in an isolated environment) rather than as a project dependency. It is not part of the pre-commit hooks and must be run manually via the Makefile.
Sources: pyproject.toml158-162 Makefile212-216
The detect-secrets tool scans code for accidentally committed secrets (API keys, passwords, tokens, etc.).
Baseline System:
Detect-secrets uses a baseline file at .secrets.baseline1-89 that contains known false positives. The baseline includes:
The baseline contains hashed versions of known false positives (example secrets in documentation, test fixtures, etc.).
Pre-commit Hook:
Configured in .pre-commit-config.yaml43-48:
The exclude pattern skips documentation files and component index which may contain example API keys.
Updating the Baseline:
To update the baseline when adding new legitimate secrets to documentation:
Sources: .pre-commit-config.yaml43-48 .secrets.baseline1-89
Two validators ensure safe database migrations:
1. Expand-Contract Pattern Validator:
Located at src/backend/base/langflow/alembic/migration_validator.py validates that migrations follow the expand-contract pattern for zero-downtime deployments.
Pre-commit hook at .pre-commit-config.yaml28-36:
2. Phase Documentation Validator:
Ensures migrations document their phase (EXPAND, MIGRATE, or CONTRACT):
Sources: .pre-commit-config.yaml28-42
Validates that starter project templates are valid flow definitions:
This runs security checks on starter projects to ensure they don't contain malicious code.
Sources: .pre-commit-config.yaml66-72
Checks for deprecated LangChain imports in component files:
This ensures components use current LangChain import paths.
Sources: .pre-commit-config.yaml73-78
Path-Based Filtering:
The CI pipeline uses .github/changes-filter.yaml1-104 to determine which checks to run based on changed files:
This ensures fast CI runs by only executing relevant checks.
Autofix Workflows:
Both Python and frontend autofix workflows are triggered on pull requests and automatically commit fixes:
**/*.py files changesrc/frontend/** files changeBoth use the autofix-ci/action to commit changes, which triggers a new CI run with the fixes applied.
Sources: .github/workflows/ci.yml1-457 .github/changes-filter.yaml1-104 .github/workflows/py_autofix.yml1-82 .github/workflows/js_autofix.yml1-47
Configuration Priority:
| Tool | Primary Config | Override Config |
|---|---|---|
| ruff | pyproject.toml at root | None |
| mypy | pyproject.toml at root | None |
| biome | src/frontend/biome.json | None |
| detect-secrets | .secrets.baseline | Command-line args |
| pre-commit | .pre-commit-config.yaml | .git/hooks/ |
Sources: pyproject.toml src/frontend/biome.json1-108 .pre-commit-config.yaml1-79 .secrets.baseline1-89
The root Makefile provides convenient targets for running quality tools (Makefile209-232):
| Target | Description | Underlying Command |
|---|---|---|
make lint | Run mypy type checking | uv run mypy --namespace-packages -p "langflow" |
make format | Format backend + frontend | Runs format_backend then format_frontend |
make format_backend | Format Python (backend) | uv run ruff check . --fix && uv run ruff format . |
make format_frontend_check | Check frontend without modifying | cd src/frontend && npx @biomejs/biome check |
make unsafe_fix | Apply unsafe ruff auto-fixes | uv run ruff check . --fix --unsafe-fixes |
make codespell | Check spelling | uvx codespell --toml pyproject.toml |
make fix_codespell | Fix spelling errors | uvx codespell --toml pyproject.toml --write |
Sources: Makefile209-232
The Langflow quality tooling strategy uses:
All quality gates are enforced in CI before code can be merged, with pre-commit hooks providing fast feedback during development.
Refresh this wiki
This wiki was recently refreshed. Please wait 3 days to refresh again.