chore: import upstream snapshot with attribution

2026-07-13 12:37:18 +08:00
commit a7d6d88f6f
667 changed files with 232986 additions and 0 deletions
@@ -0,0 +1,168 @@
+name: CLI integration test
+
+on:
+  workflow_call:
+    secrets:
+      LANGSMITH_API_KEY:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version:
+          - "3.10"
+          - "3.14"
+        example:
+          - name: A
+            workdir: libs/cli/examples
+            tag: langgraph-test-a
+          - name: B
+            workdir: libs/cli/examples/graphs
+            tag: langgraph-test-b
+          - name: C
+            workdir: libs/cli/examples/graphs_reqs_a
+            tag: langgraph-test-c
+          - name: D
+            workdir: libs/cli/examples/graphs_reqs_b
+            tag: langgraph-test-d
+    name: "CLI integration test"
+    env:
+      HAS_LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY != '' }}
+    defaults:
+      run:
+        working-directory: libs/cli
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Get changed files
+        id: changed-files
+        if: github.event_name != 'workflow_dispatch'
+        uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0
+        with:
+          filter: "libs/cli/**"
+      - name: Set up Python ${{ matrix.python-version }}
+        if: (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch')
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: "false"
+          working-directory: libs/cli
+      - name: Install cli globally
+        if: (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch')
+        run: pip install -e .
+      - name: Build service ${{ matrix.example.name }}
+        if: (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch')
+        working-directory: ${{ matrix.example.workdir }}
+        run: |
+          langgraph build -t ${{ matrix.example.tag }}
+      - name: Test service ${{ matrix.example.name }}
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&env.HAS_LANGSMITH_API_KEY == 'true' }}
+        working-directory: ${{ matrix.example.workdir }}
+        env:
+          LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
+        run: |
+          # Prepare environment file from local or parent example directory
+          if [ -f .env.example ]; then cp .env.example .env; elif [ -f ../.env.example ]; then cp ../.env.example .env && cp ../.env.example ../.env; fi
+          echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> .env
+          if [ -f ../.env ]; then echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> ../.env; fi
+          # Run the integration test using the built tag
+          REPO_ROOT=$(git rev-parse --show-toplevel)
+          timeout 60 python "$REPO_ROOT/.github/scripts/run_langgraph_cli_test.py" -t ${{ matrix.example.tag }}
+
+      - name: Build JS service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
+        working-directory: libs/cli/js-examples
+        run: |
+          langgraph build -t langgraph-test-e
+
+      - name: Build JS monorepo service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
+        working-directory: libs/cli/js-monorepo-example
+        run: |
+          langgraph build -t langgraph-test-f -c apps/agent/langgraph.json --build-command "yarn run turbo build" --install-command "yarn install"
+
+      - name: Build Python monorepo service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
+        working-directory: libs/cli/python-monorepo-example
+        run: |
+          langgraph build -t langgraph-test-g -c apps/agent/langgraph.json
+      - name: Test Python monorepo service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        working-directory: libs/cli/python-monorepo-example
+        env:
+          LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
+        run: |
+          cp apps/agent/.env.example apps/agent/.env
+          echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> apps/agent/.env
+          timeout 60 python ../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-g -c apps/agent/langgraph.json
+
+      - name: Build prerelease reqs service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
+        working-directory: libs/cli/examples/graph_prerelease_reqs
+        run: |
+          langgraph build -t langgraph-test-h
+      - name: Test prerelease reqs service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        working-directory: libs/cli/examples/graph_prerelease_reqs
+        env:
+          LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
+        run: |
+          cp ../.env.example .env
+          echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> .env
+          timeout 60 python ../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-h
+          echo "Finished starting up langgraph-test-h"
+          LANGGRAPH_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h python -c "import sys; from importlib.metadata import version; v = version('langgraph'); print(v);")
+          if [ "$LANGGRAPH_VERSION" != "1.1.5" ]; then
+            echo "LANGGRAPH_VERSION != 1.1.5; $LANGGRAPH_VERSION"
+            exit 1
+          fi
+          LANGCHAIN_OPENAI_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h python -c "import sys; from importlib.metadata import version; v = version('langchain-openai'); print(v);")
+          if [ "$LANGCHAIN_OPENAI_VERSION" != "1.1.14" ]; then
+            echo "LANGCHAIN_OPENAI_VERSION != 1.1.14; $LANGCHAIN_OPENAI_VERSION"
+            exit 1
+          fi
+          LANGCHAIN_ANTHROPIC_VERSION=$(docker run --rm --entrypoint "" langgraph-test-h python -c "import sys; from importlib.metadata import version; v = version('langchain-anthropic'); print(v);")
+          if [ "$LANGCHAIN_ANTHROPIC_VERSION" != "1.4.6" ]; then
+            echo "LANGCHAIN_ANTHROPIC_VERSION != 1.4.6; $LANGCHAIN_ANTHROPIC_VERSION"
+            exit 1
+          fi
+
+      - name: Build and test prerelease reqs fail service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
+        working-directory: libs/cli/examples/graph_prerelease_reqs_fail
+        run: |
+          langgraph build -t langgraph-test-i || [ $? -eq 1 ]
+
+      - name: Build uv simple service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
+        working-directory: libs/cli/uv-examples/simple
+        run: |
+          langgraph build -t langgraph-test-uv-simple
+      - name: Test uv simple service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        working-directory: libs/cli/uv-examples/simple
+        env:
+          LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
+        run: |
+          cp .env.example .env
+          echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> .env
+          timeout 60 python ../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-uv-simple
+
+      - name: Build uv monorepo service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' }}
+        working-directory: libs/cli/uv-examples/monorepo/apps/agent
+        run: |
+          langgraph build -t langgraph-test-uv-monorepo
+      - name: Test uv monorepo service
+        if: ${{ (steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch') &&matrix.example.name == 'A' && env.HAS_LANGSMITH_API_KEY == 'true' }}
+        working-directory: libs/cli/uv-examples/monorepo/apps/agent
+        env:
+          LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
+        run: |
+          cp .env.example .env
+          echo "LANGSMITH_API_KEY=${{ secrets.LANGSMITH_API_KEY }}" >> .env
+          timeout 60 python ../../../../../../.github/scripts/run_langgraph_cli_test.py -t langgraph-test-uv-monorepo
@@ -0,0 +1,78 @@
+name: lint
+
+on:
+  workflow_call:
+    inputs:
+      working-directory:
+        required: true
+        type: string
+        description: "From which folder this pipeline executes"
+
+permissions:
+  contents: read
+
+env:
+  # This env var allows us to get inline annotations when ruff has complaints.
+  RUFF_OUTPUT_FORMAT: github
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # Only lint on the min and max supported Python versions.
+        # It's extremely unlikely that there's a lint issue on any version in between
+        # that doesn't show up on the min or max versions.
+        #
+        # GitHub rate-limits how many jobs can be running at any one time.
+        # Starting new jobs is also relatively slow,
+        # so linting on fewer versions makes CI faster.
+        python-version:
+          - "3.12"
+    name: "lint #${{ matrix.python-version }}"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Get changed files
+        id: changed-files
+        if: github.event_name != 'workflow_dispatch'
+        uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0
+        with:
+          filter: "${{ inputs.working-directory }}/**"
+      - name: Set up Python ${{ matrix.python-version }}
+        if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache-suffix: lint-${{ inputs.working-directory }}
+          working-directory: ${{ inputs.working-directory }}
+
+      - name: Install dependencies
+        if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
+        working-directory: ${{ inputs.working-directory }}
+        run: uv sync --frozen --group lint
+
+      - name: Analysing package code with our lint
+        if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
+        working-directory: ${{ inputs.working-directory }}
+        run: |
+          if make lint_package > /dev/null 2>&1; then
+            make lint_package
+          else
+            echo "lint_package command not found, using lint instead"
+            make lint
+          fi
+
+      - name: Install test dependencies
+        if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
+        working-directory: ${{ inputs.working-directory }}
+        run: uv sync --group lint
+
+      - name: Analysing tests with our lint
+        if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
+        working-directory: ${{ inputs.working-directory }}
+        run: |
+          if make lint_tests > /dev/null 2>&1; then
+            make lint_tests
+          else
+            echo "lint_tests command not found, skipping step"
+          fi
@@ -0,0 +1,85 @@
+name: sdk-py integration test
+
+on:
+  workflow_call:
+    secrets:
+      LANGSMITH_API_KEY:
+        required: false
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_RO_TOKEN:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    name: "sdk-py integration"
+    defaults:
+      run:
+        working-directory: libs/sdk-py
+    env:
+      HAS_LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY != '' }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: "3.13"
+          cache-suffix: sdk-py-integration
+          working-directory: libs/sdk-py
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_RO_TOKEN }}
+
+      - name: Install dependencies
+        shell: bash
+        run: uv sync --frozen --group test --no-dev
+
+      - name: Skip if LANGSMITH_API_KEY is not available
+        if: env.HAS_LANGSMITH_API_KEY != 'true'
+        run: |
+          echo "LANGSMITH_API_KEY is not set (likely a fork PR). Skipping integration tests."
+          exit 0
+
+      - name: Bring up integration stack
+        if: env.HAS_LANGSMITH_API_KEY == 'true'
+        working-directory: libs/sdk-py/integration
+        env:
+          LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
+        run: docker compose up -d --build
+
+      - name: Wait for API healthcheck
+        if: env.HAS_LANGSMITH_API_KEY == 'true'
+        run: |
+          for i in $(seq 1 60); do
+            if curl -sf http://localhost:2024/ok >/dev/null; then
+              echo "API ready after ${i}s"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "API failed to become healthy within 120s"
+          docker compose -f libs/sdk-py/integration/docker-compose.yml logs api | tail -100
+          exit 1
+
+      - name: Run integration suite
+        if: env.HAS_LANGSMITH_API_KEY == 'true'
+        run: uv run pytest tests/integration/ -m integration
+
+      - name: Dump api logs on failure
+        if: failure() && env.HAS_LANGSMITH_API_KEY == 'true'
+        working-directory: libs/sdk-py/integration
+        run: docker compose logs api | tail -200
+
+      - name: Tear down stack
+        if: always() && env.HAS_LANGSMITH_API_KEY == 'true'
+        working-directory: libs/sdk-py/integration
+        run: docker compose down -v
@@ -0,0 +1,63 @@
+name: test
+
+on:
+  workflow_call:
+    inputs:
+      working-directory:
+        required: true
+        type: string
+        description: "From which folder this pipeline executes"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+          - "3.14"
+
+    name: "test #${{ matrix.python-version }}"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache-suffix: test-${{ inputs.working-directory }}
+          working-directory: ${{ inputs.working-directory }}
+      - name: Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_RO_TOKEN }}
+
+      - name: Install dependencies
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        run: uv sync --frozen --group test --no-dev
+
+      - name: Run tests
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        run: make test
+
+      - name: Ensure the tests did not create any additional files
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        run: |
+          set -eu
+
+          STATUS="$(git status)"
+          echo "$STATUS"
+
+          # grep will exit non-zero if the target message isn't found,
+          # and `set -e` above will cause the step to fail.
+          echo "$STATUS" | grep 'nothing to commit, working tree clean'
@@ -0,0 +1,65 @@
+name: test
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+          - "3.14"
+
+    defaults:
+      run:
+        working-directory: libs/langgraph
+    name: "test #${{ matrix.python-version }}"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache-suffix: "test-langgraph"
+          working-directory: libs/langgraph
+      - name: Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_RO_TOKEN }}
+
+      - name: Install dependencies
+        shell: bash
+        run: uv sync --frozen --group test --no-dev
+
+      - name: Run tests
+        shell: bash
+        run: make test_parallel
+
+      - name: Run strict msgpack pregel tests
+        if: ${{ matrix.python-version == '3.13' }}
+        shell: bash
+        env:
+          LANGGRAPH_STRICT_MSGPACK: "true"
+        run: make test TEST="tests/test_pregel.py tests/test_pregel_async.py"
+
+      - name: Ensure the tests did not create any additional files
+        shell: bash
+        run: |
+          set -eu
+
+          STATUS="$(git status)"
+          echo "$STATUS"
+
+          # grep will exit non-zero if the target message isn't found,
+          # and `set -e` above will cause the step to fail.
+          echo "$STATUS" | grep 'nothing to commit, working tree clean'
@@ -0,0 +1,97 @@
+name: test-release
+
+on:
+  workflow_call:
+    inputs:
+      working-directory:
+        required: true
+        type: string
+        description: "From which folder this pipeline executes"
+
+env:
+  PYTHON_VERSION: "3.10"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    outputs:
+      pkg-name: ${{ steps.check-version.outputs.pkg-name }}
+      version: ${{ steps.check-version.outputs.version }}
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache-suffix: "release"
+          working-directory: ${{ inputs.working-directory }}
+
+      # We want to keep this build stage *separate* from the release stage,
+      # so that there's no sharing of permissions between them.
+      # The release stage has trusted publishing and GitHub repo contents write access,
+      # and we want to keep the scope of that access limited just to the release job.
+      # Otherwise, a malicious `build` step (e.g. via a compromised dependency)
+      # could get access to our GitHub or PyPI credentials.
+      #
+      # Per the trusted publishing GitHub Action:
+      # > It is strongly advised to separate jobs for building [...]
+      # > from the publish job.
+      # https://github.com/pypa/gh-action-pypi-publish#non-goals
+      - name: Build project for distribution
+        run: uv build
+        working-directory: ${{ inputs.working-directory }}
+
+      - name: Upload build
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-dist
+          path: ${{ inputs.working-directory }}/dist/
+
+      - name: Check Version
+        id: check-version
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        run: |
+          echo pkg-name=$(grep -m 1 "^name = " pyproject.toml | cut -d '"' -f 2)
+          echo version=$(grep -m 1 "^version = " pyproject.toml | cut -d '"' -f 2)
+
+  publish:
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    permissions:
+      # This permission is used for trusted publishing:
+      # https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
+      #
+      # Trusted publishing has to also be configured on PyPI for each package:
+      # https://docs.pypi.org/trusted-publishers/adding-a-publisher/
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: test-dist
+          path: ${{ inputs.working-directory }}/dist/
+
+      - name: Publish to test PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        with:
+          packages-dir: ${{ inputs.working-directory }}/dist/
+          verbose: true
+          print-hash: true
+          repository-url: https://test.pypi.org/legacy/
+
+          # We overwrite any existing distributions with the same name and version.
+          # This is *only for CI use* and is *extremely dangerous* otherwise!
+          # https://github.com/pypa/gh-action-pypi-publish#tolerating-release-package-file-duplicates
+          skip-existing: true
+          # Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
+          attestations: false
@@ -0,0 +1,37 @@
+name: baseline
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "libs/**"
+
+permissions:
+  contents: read
+
+jobs:
+  benchmark:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: libs/langgraph
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - run: SHA=$(git rev-parse HEAD) && echo "SHA=$SHA" >> $GITHUB_ENV
+      - name: Set up Python 3.11
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: "3.11"
+          cache-suffix: "bench"
+          working-directory: libs/langgraph
+      - name: Install dependencies
+        run: uv sync --group test
+      - name: Run benchmarks
+        run: OUTPUT=out/benchmark-baseline.json make -s benchmark
+      - name: Save outputs
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          key: ${{ runner.os }}-benchmark-baseline-${{ env.SHA }}
+          path: |
+            libs/langgraph/out/benchmark-baseline.json
@@ -0,0 +1,75 @@
+name: bench
+
+on:
+  pull_request:
+    paths:
+      - "libs/**"
+
+permissions:
+  contents: read
+
+jobs:
+  benchmark:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: libs/langgraph
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - id: files
+        name: Get changed files
+        uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0
+        with:
+          format: json
+      - name: Set up Python 3.11
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: "3.11"
+          cache-suffix: "bench"
+          working-directory: libs/langgraph
+      - name: Install dependencies
+        run: uv sync --group test
+      - name: Download baseline
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          key: ${{ runner.os }}-benchmark-baseline
+          restore-keys: |
+            ${{ runner.os }}-benchmark-baseline-
+          fail-on-cache-miss: true
+          path: |
+            libs/langgraph/out/benchmark-baseline.json
+      - name: Run benchmarks
+        id: benchmark
+        run: |
+          {
+            echo 'OUTPUT<<EOF'
+            make -s benchmark-fast
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+      - name: Compare benchmarks
+        id: compare
+        run: |
+          {
+            echo 'OUTPUT<<EOF'
+            mv out/benchmark-baseline.json out/main.json
+            mv out/benchmark.json out/changes.json
+            uv run pyperf compare_to out/main.json out/changes.json --table --group-by-speed
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+      - name: Annotation
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          CHANGED_FILES: ${{ steps.files.outputs.added_modified_renamed }}
+          BENCHMARK_OUTPUT: ${{ steps.benchmark.outputs.OUTPUT }}
+          COMPARE_OUTPUT: ${{ steps.compare.outputs.OUTPUT }}
+        with:
+          script: |
+            const file = JSON.parse(process.env.CHANGED_FILES || "[]")[0]
+            core.notice(process.env.BENCHMARK_OUTPUT || "", {
+              title: 'Benchmark results',
+              file,
+            })
+            core.notice(process.env.COMPARE_OUTPUT || "", {
+              title: 'Comparison against main',
+              file,
+            })
@@ -0,0 +1,198 @@
+---
+name: CI
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+  
+
+permissions:
+  contents: read
+
+# If another push to the same PR or branch happens while this workflow is still running,
+# cancel the earlier run in favor of the next run.
+#
+# There's no point in testing an outdated version of the code. GitHub only allows
+# a limited number of job runners to be active at the same time, so it's better to cancel
+# pointless jobs early so that more useful jobs can run sooner.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      python: ${{ steps.filter.outputs.python || 'true' }}
+      deps: ${{ steps.filter.outputs.deps || 'true' }}
+      sdk_py: ${{ steps.filter.outputs.sdk_py || 'true' }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+        if: github.event_name != 'workflow_dispatch'
+        id: filter
+        with:
+          filters: |
+            python:
+              - 'libs/langgraph/**'
+              - 'libs/sdk-py/**'
+              - 'libs/cli/**'
+              - 'libs/checkpoint/**'
+              - 'libs/checkpoint-sqlite/**'
+              - 'libs/checkpoint-postgres/**'
+              - 'libs/checkpoint-conformance/**'
+              - 'libs/prebuilt/**'
+            deps:
+              - '**/pyproject.toml'
+              - '**/uv.lock'
+            sdk_py:
+              - 'libs/sdk-py/**'
+              # The integration suite runs the local langgraph core inside the
+              # server (see libs/sdk-py/integration/Dockerfile), so any core
+              # change is now exercised end-to-end and should trigger it.
+              - 'libs/langgraph/**'
+
+  lint:
+    needs: changes
+    name: cd ${{ matrix.working-directory }}
+    strategy:
+      matrix:
+        working-directory:
+          [
+            "libs/langgraph",
+            "libs/sdk-py",
+            "libs/cli",
+            "libs/checkpoint",
+            "libs/checkpoint-sqlite",
+            "libs/checkpoint-postgres",
+            "libs/checkpoint-conformance",
+            "libs/prebuilt",
+          ]
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
+    uses: ./.github/workflows/_lint.yml
+    with:
+      working-directory: ${{ matrix.working-directory }}
+    secrets: inherit
+
+  test:
+    needs: changes
+    name: cd ${{ matrix.working-directory }}
+    strategy:
+      matrix:
+        working-directory:
+          [
+            "libs/cli",
+            "libs/checkpoint",
+            "libs/checkpoint-sqlite",
+            "libs/checkpoint-postgres",
+            "libs/checkpoint-conformance",
+            "libs/prebuilt",
+            "libs/sdk-py",
+          ]
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
+    uses: ./.github/workflows/_test.yml
+    with:
+      working-directory: ${{ matrix.working-directory }}
+    secrets: inherit
+
+  # NOTE: we're testing langgraph separately because it requires a different matrix
+  test-langgraph:
+    needs: changes
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
+    name: "cd libs/langgraph"
+    uses: ./.github/workflows/_test_langgraph.yml
+    secrets: inherit
+
+  check-sdk-methods:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    name: "Check SDK methods matching"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Run check_sdk_methods script
+        run: python .github/scripts/check_sdk_methods.py
+
+  check-schema:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    name: "Check CLI schema hasn't changed #${{ matrix.python-version }}"
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version:
+          - "3.13"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: "3.13"
+          cache-suffix: "schema-check-cli"
+          working-directory: libs/cli
+      - name: Install CLI dependencies
+        run: |
+          cd libs/cli
+          uv sync
+      - name: Generate schema and check for changes
+        run: |
+          cd libs/cli
+          # Create a temporary copy of the current schema
+          cp schemas/schema.json schemas/schema.current.json
+          # Generate new schema
+          uv run python generate_schema.py
+          # Compare the new schema with the original
+          if ! diff -q schemas/schema.json schemas/schema.current.json > /dev/null; then
+            echo "Error: Langgraph.json configuration schema has changed. Please run 'uv run python generate_schema.py' in the libs/cli directory and commit the changes."
+            diff schemas/schema.json schemas/schema.current.json
+            exit 1
+          fi
+          echo "Schema check passed - no changes detected"
+
+  integration-test:
+    needs: changes
+    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.deps == 'true'
+    name: CLI integration test
+    uses: ./.github/workflows/_integration_test.yml
+    secrets: inherit
+
+  sdk-py-integration-test:
+    needs: changes
+    if: needs.changes.outputs.sdk_py == 'true'
+    name: "sdk-py integration test"
+    uses: ./.github/workflows/_sdk_integration_test.yml
+    secrets: inherit
+
+  ci_success:
+    name: "CI Success"
+    needs:
+      [
+        lint,
+        test,
+        test-langgraph,
+        check-sdk-methods,
+        check-schema,
+        integration-test,
+        sdk-py-integration-test,
+      ]
+    if: |
+      always()
+    runs-on: ubuntu-latest
+    env:
+      JOBS_JSON: ${{ toJSON(needs) }}
+      RESULTS_JSON: ${{ toJSON(needs.*.result) }}
+      EXIT_CODE: ${{!contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') && '0' || '1'}}
+    steps:
+      - name: "CI Success"
+        run: |
+          echo $JOBS_JSON
+          echo $RESULTS_JSON
+          echo "Exiting with $EXIT_CODE"
+          exit $EXIT_CODE
@@ -0,0 +1,49 @@
+name: Deploy Redirects to GitHub Pages
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/**'
+      - '.github/workflows/deploy-redirects.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: '3.11'
+
+      - name: Generate redirect files
+        run: python docs/generate_redirects.py
+
+      - name: Setup Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: 'docs/_site'
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
@@ -0,0 +1,47 @@
+name: PR Title Lint
+
+permissions:
+  pull-requests: read
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+jobs:
+  lint-pr-title:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR Title
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+            release
+          scopes: |
+            checkpoint
+            checkpoint-postgres
+            checkpoint-sqlite
+            cli
+            langgraph
+            prebuilt
+            scheduler-kafka
+            sdk-py
+            docs
+            ci
+            deps
+            deps-dev
+          requireScope: false
+          ignoreLabels: |
+            ignore-lint-pr-title
@@ -0,0 +1,331 @@
+name: release
+run-name: Release ${{ inputs.working-directory }} by @${{ github.actor }}
+on:
+  workflow_dispatch:
+    inputs:
+      working-directory:
+        required: true
+        type: string
+        default: "libs/langgraph"
+
+permissions:
+  contents: read
+
+env:
+  PYTHON_VERSION: "3.11"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    outputs:
+      pkg-name: ${{ steps.check-version.outputs.pkg-name }}
+      short-pkg-name: ${{ steps.check-version.outputs.short-pkg-name }}
+      version: ${{ steps.check-version.outputs.version }}
+      tag: ${{ steps.check-version.outputs.tag }}
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache-suffix: "release"
+          enable-cache: false
+          working-directory: ${{ inputs.working-directory }}
+
+      # We want to keep this build stage *separate* from the release stage,
+      # so that there's no sharing of permissions between them.
+      # The release stage has trusted publishing and GitHub repo contents write access,
+      # and we want to keep the scope of that access limited just to the release job.
+      # Otherwise, a malicious `build` step (e.g. via a compromised dependency)
+      # could get access to our GitHub or PyPI credentials.
+      #
+      # Per the trusted publishing GitHub Action:
+      # > It is strongly advised to separate jobs for building [...]
+      # > from the publish job.
+      # https://github.com/pypa/gh-action-pypi-publish#non-goals
+      - name: Build project for distribution
+        run: uv build
+        working-directory: ${{ inputs.working-directory }}
+
+      - name: Upload build
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: ${{ inputs.working-directory }}/dist/
+
+      - name: Check Version
+        id: check-version
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        run: |
+          PKG_NAME=$(grep -m 1 "^name = " pyproject.toml | cut -d '"' -f 2)
+          if grep -q 'dynamic.*=.*\[.*"version".*\]' pyproject.toml; then
+            # handle dynamic versioning
+            DIR_NAME=$(echo "$PKG_NAME" | tr '-' '_')
+            VERSION=$(grep -m 1 '^__version__' "${DIR_NAME}/__init__.py" | cut -d '"' -f 2)
+          else
+            VERSION=$(grep -m 1 "^version = " pyproject.toml | cut -d '"' -f 2)
+          fi
+          SHORT_PKG_NAME="$(echo "$PKG_NAME" | sed -e 's/langgraph//g' -e 's/-//g')"
+          if [ -z $SHORT_PKG_NAME ]; then
+            TAG="$VERSION"
+          else
+            TAG="${SHORT_PKG_NAME}==${VERSION}"
+          fi
+          echo pkg-name="$PKG_NAME" >> $GITHUB_OUTPUT
+          echo short-pkg-name="$SHORT_PKG_NAME" >> $GITHUB_OUTPUT
+          echo version="$VERSION" >> $GITHUB_OUTPUT
+          echo tag="$TAG" >> $GITHUB_OUTPUT
+
+  release-notes:
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    outputs:
+      release-body: ${{ steps.generate-release-body.outputs.release-body }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: langchain-ai/langgraph
+          path: langgraph
+          sparse-checkout: | # this only grabs files for relevant dir
+            ${{ inputs.working-directory }}
+          ref: main # this scopes to just master branch
+          fetch-depth: 0 # this fetches entire commit history
+      - name: Check Tags
+        id: check-tags
+        shell: bash
+        working-directory: langgraph/${{ inputs.working-directory }}
+        env:
+          PKG_NAME: ${{ needs.build.outputs.pkg-name }}
+          SHORT_PKG_NAME: ${{ needs.build.outputs.short-pkg-name }}
+          VERSION: ${{ needs.build.outputs.version }}
+          TAG: ${{ needs.build.outputs.tag }}
+        run: |
+          if [ -z $SHORT_PKG_NAME ]; then
+            REGEX="^\\d+\\.\\d+\\.\\d+((a|b|rc)\\d+)?\$"
+          else
+            REGEX="^$SHORT_PKG_NAME==\\d+\\.\\d+\\.\\d+((a|b|rc)\\d+)?\$"
+          fi
+          echo $REGEX
+          PREV_TAG=$(git tag --sort=-creatordate | grep -P $REGEX | head -1 || echo "")
+          echo $PREV_TAG
+          if [ "$TAG" == "$PREV_TAG" ]; then
+            echo "No new version to release"
+            exit 1
+          fi
+          echo prev-tag="$PREV_TAG" >> $GITHUB_OUTPUT
+      - name: Generate release body
+        id: generate-release-body
+        working-directory: langgraph
+        env:
+          WORKING_DIR: ${{ inputs.working-directory }}
+          PKG_NAME: ${{ needs.build.outputs.pkg-name }}
+          TAG: ${{ needs.build.outputs.tag }}
+          PREV_TAG: ${{ steps.check-tags.outputs.prev-tag }}
+        run: |
+          {
+            echo 'release-body<<EOF'
+            if [ -z "$PREV_TAG" ]; then
+              echo "Initial release"
+            else
+              echo "Changes since $PREV_TAG"
+              echo
+              git log --format="%s" "$PREV_TAG"..HEAD -- $WORKING_DIR | awk '{print "* " $0}'
+            fi
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+
+  test-pypi-publish:
+    needs:
+      - build
+      - release-notes
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/_test_release.yml
+    with:
+      working-directory: ${{ inputs.working-directory }}
+    secrets: inherit
+
+  pre-release-checks:
+    needs:
+      - build
+      - release-notes
+      - test-pypi-publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      # We explicitly *don't* set up caching here. This ensures our tests are
+      # maximally sensitive to catching breakage.
+      #
+      # For example, here's a way that caching can cause a falsely-passing test:
+      # - Make the langchain package manifest no longer list a dependency package
+      #   as a requirement. This means it won't be installed by `pip install`,
+      #   and attempting to use it would cause a crash.
+      # - That dependency used to be required, so it may have been cached.
+      #   When restoring the venv packages from cache, that dependency gets included.
+      # - Tests pass, because the dependency is present even though it wasn't specified.
+      # - The package is published, and it breaks on the missing dependency when
+      #   used in the real world.
+
+      - name: Set up Python
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          enable-cache: false
+          working-directory: ${{ inputs.working-directory }}
+
+      - name: Import published package
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+        env:
+          PKG_NAME: ${{ needs.build.outputs.pkg-name }}
+          VERSION: ${{ needs.build.outputs.version }}
+        # Here we use:
+        # - The default regular PyPI index as the *primary* index, meaning
+        #   that it takes priority (https://pypi.org/simple)
+        # - The test PyPI index as an extra index, so that any dependencies that
+        #   are not found on test PyPI can be resolved and installed anyway.
+        #   (https://test.pypi.org/simple). This will include the PKG_NAME==VERSION
+        #   package because VERSION will not have been uploaded to regular PyPI yet.
+        # - attempt install again after 5 seconds if it fails because there is
+        #   sometimes a delay in availability on test pypi
+        run: |
+          uv run pip install \
+            --extra-index-url https://test.pypi.org/simple/ \
+            "$PKG_NAME==$VERSION" || \
+          ( \
+            sleep 5 && \
+            uv run pip install \
+              --extra-index-url https://test.pypi.org/simple/ \
+              "$PKG_NAME==$VERSION" \
+          )
+
+          if [[ "$PKG_NAME" == *prebuilt* ]]; then
+            uv run pip install langgraph
+          fi
+
+          if [[ "$PKG_NAME" == *checkpoint* || "$PKG_NAME" == *prebuilt* ]]; then
+            # since checkpoint packages are namespace packages, import them with . convention
+            # i.e. import langgraph.checkpoint or langgraph.checkpoint.sqlite
+            IMPORT_NAME="$(echo "$PKG_NAME" | sed s/-/./g)"
+          else
+            # Replace all dashes in the package name with underscores,
+            # since that's how Python imports packages with dashes in the name.
+            IMPORT_NAME="$(echo "$PKG_NAME" | sed s/-/_/g)"
+          fi
+
+          uv run python -c "import $IMPORT_NAME; print(dir($IMPORT_NAME))"
+
+      - name: Import test dependencies
+        run: uv sync --group test
+        working-directory: ${{ inputs.working-directory }}
+
+      # Overwrite the local version of the package with the test PyPI version.
+      - name: Import published package (again)
+        working-directory: ${{ inputs.working-directory }}
+        shell: bash
+        env:
+          PKG_NAME: ${{ needs.build.outputs.pkg-name }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          uv run pip install \
+            --extra-index-url https://test.pypi.org/simple/ \
+            "$PKG_NAME==$VERSION"
+
+      - name: Run unit tests
+        run: make test
+        working-directory: ${{ inputs.working-directory }}
+
+  publish:
+    needs:
+      - build
+      - release-notes
+      - test-pypi-publish
+      - pre-release-checks
+    runs-on: ubuntu-latest
+    permissions:
+      # This permission is used for trusted publishing:
+      # https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
+      #
+      # Trusted publishing has to also be configured on PyPI for each package:
+      # https://docs.pypi.org/trusted-publishers/adding-a-publisher/
+      id-token: write
+
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache-suffix: "release"
+          enable-cache: false
+          working-directory: ${{ inputs.working-directory }}
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: ${{ inputs.working-directory }}/dist/
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        with:
+          packages-dir: ${{ inputs.working-directory }}/dist/
+          verbose: true
+          print-hash: true
+          # Temp workaround since attestations are on by default as of gh-action-pypi-publish v1.11.0
+          attestations: false
+
+  mark-release:
+    needs:
+      - build
+      - release-notes
+      - test-pypi-publish
+      - pre-release-checks
+      - publish
+    runs-on: ubuntu-latest
+    permissions:
+      # This permission is needed by `ncipollo/release-action` to
+      # create the GitHub release.
+      contents: write
+
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache-suffix: "release"
+          enable-cache: false
+          working-directory: ${{ inputs.working-directory }}
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: ${{ inputs.working-directory }}/dist/
+
+      - name: Create Tag
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
+        with:
+          artifacts: "dist/*"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          generateReleaseNotes: false
+          tag: ${{needs.build.outputs.tag}}
+          name: ${{ needs.build.outputs.pkg-name }}==${{ needs.build.outputs.version }}
+          body: ${{ needs.release-notes.outputs.release-body }}
+          commit: ${{ github.sha }}
@@ -0,0 +1,195 @@
+# Reopen PRs that were auto-closed by require_issue_link.yml when the
+# contributor was not assigned to the linked issue. When a maintainer
+# assigns the contributor to the issue, this workflow finds matching
+# closed PRs, verifies the issue link, and reopens them.
+#
+# Uses the default GITHUB_TOKEN (not a PAT or app token) so that the
+# reopen and label-removal events do NOT re-trigger other workflows.
+# GitHub suppresses events created by the default GITHUB_TOKEN within
+# workflow runs to prevent infinite loops.
+
+name: Reopen PR on Issue Assignment
+
+on:
+  issues:
+    types: [assigned]
+
+permissions:
+  contents: read
+
+jobs:
+  reopen-linked-prs:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      pull-requests: write
+
+    steps:
+      - name: Find and reopen matching PRs
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const issueNumber = context.payload.issue.number;
+            const assignee = context.payload.assignee.login;
+
+            console.log(
+              `Issue #${issueNumber} assigned to ${assignee} — searching for closed PRs to reopen`,
+            );
+
+            const q = [
+              `is:pr`,
+              `is:closed`,
+              `author:${assignee}`,
+              `label:missing-issue-link`,
+              `repo:${owner}/${repo}`,
+            ].join(' ');
+
+            let data;
+            try {
+              ({ data } = await github.rest.search.issuesAndPullRequests({
+                q,
+                per_page: 30,
+              }));
+            } catch (e) {
+              throw new Error(
+                `Failed to search for closed PRs to reopen after assigning ${assignee} ` +
+                `to #${issueNumber} (HTTP ${e.status ?? 'unknown'}): ${e.message}`,
+              );
+            }
+
+            if (data.total_count === 0) {
+              console.log('No matching closed PRs found');
+              return;
+            }
+
+            console.log(`Found ${data.total_count} candidate PR(s)`);
+
+            // Must stay in sync with the identical pattern in require_issue_link.yml
+            const pattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*#(\d+)/gi;
+
+            for (const item of data.items) {
+              const prNumber = item.number;
+              const body = item.body || '';
+              const matches = [...body.matchAll(pattern)];
+              const referencedIssues = matches.map(m => parseInt(m[1], 10));
+
+              if (!referencedIssues.includes(issueNumber)) {
+                console.log(`PR #${prNumber} does not reference #${issueNumber} — skipping`);
+                continue;
+              }
+
+              // Skip if already bypassed
+              const labels = item.labels.map(l => l.name);
+              if (labels.includes('bypass-issue-check')) {
+                console.log(`PR #${prNumber} already has bypass-issue-check — skipping`);
+                continue;
+              }
+
+              // Reopen first, remove label second — a closed PR that still has
+              // missing-issue-link is recoverable; a closed PR with the label
+              // stripped is invisible to both workflows.
+              try {
+                await github.rest.pulls.update({
+                  owner,
+                  repo,
+                  pull_number: prNumber,
+                  state: 'open',
+                });
+                console.log(`Reopened PR #${prNumber}`);
+              } catch (e) {
+                if (e.status === 422) {
+                  // Head branch deleted — PR is unrecoverable. Notify the
+                  // contributor so they know to open a new PR.
+                  core.warning(`Cannot reopen PR #${prNumber}: head branch was likely deleted`);
+                  try {
+                    await github.rest.issues.createComment({
+                      owner,
+                      repo,
+                      issue_number: prNumber,
+                      body:
+                        `You have been assigned to #${issueNumber}, but this PR could not be ` +
+                        `reopened because the head branch has been deleted. Please open a new ` +
+                        `PR referencing the issue.`,
+                    });
+                  } catch (commentErr) {
+                    core.warning(
+                      `Also failed to post comment on PR #${prNumber}: ${commentErr.message}`,
+                    );
+                  }
+                  continue;
+                }
+                // Transient errors (rate limit, 5xx) should fail the job so
+                // the label is NOT removed and the run can be retried.
+                throw e;
+              }
+
+              // Remove missing-issue-link label only after successful reopen
+              try {
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: prNumber,
+                  name: 'missing-issue-link',
+                });
+                console.log(`Removed missing-issue-link from PR #${prNumber}`);
+              } catch (e) {
+                if (e.status !== 404) throw e;
+              }
+
+              // Minimize stale enforcement comment (best-effort;
+              // sync w/ require_issue_link.yml minimize blocks)
+              try {
+                const marker = '<!-- require-issue-link -->';
+                const comments = await github.paginate(
+                  github.rest.issues.listComments,
+                  { owner, repo, issue_number: prNumber, per_page: 100 },
+                );
+                const stale = comments.find(c => c.body && c.body.includes(marker));
+                if (stale) {
+                  await github.graphql(`
+                    mutation($id: ID!) {
+                      minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) {
+                        minimizedComment { isMinimized }
+                      }
+                    }
+                  `, { id: stale.node_id });
+                  console.log(`Minimized stale enforcement comment ${stale.id} as outdated`);
+                }
+              } catch (e) {
+                core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`);
+              }
+
+              // Re-run the failed require_issue_link check so it picks up the
+              // new assignment.  The re-run uses the original event payload but
+              // fetches live issue data, so the assignment check will pass.
+              //
+              // Limitation: we look up runs by the PR's current head SHA.  If the
+              // contributor pushed new commits while the PR was closed, head.sha
+              // won't match the SHA of the original failed run and the query will
+              // return 0 results.  This is acceptable because any push after reopen
+              // triggers a fresh require_issue_link run against the new SHA.
+              try {
+                const { data: pr } = await github.rest.pulls.get({
+                  owner, repo, pull_number: prNumber,
+                });
+                const { data: runs } = await github.rest.actions.listWorkflowRuns({
+                  owner, repo,
+                  workflow_id: 'require_issue_link.yml',
+                  head_sha: pr.head.sha,
+                  status: 'failure',
+                  per_page: 1,
+                });
+                if (runs.workflow_runs.length > 0) {
+                  await github.rest.actions.reRunWorkflowFailedJobs({
+                    owner, repo,
+                    run_id: runs.workflow_runs[0].id,
+                  });
+                  console.log(`Re-ran failed require_issue_link run ${runs.workflow_runs[0].id} for PR #${prNumber}`);
+                } else {
+                  console.log(`No failed require_issue_link runs found for PR #${prNumber} — skipping re-run`);
+                }
+              } catch (e) {
+                core.warning(`Could not re-run require_issue_link check for PR #${prNumber} (HTTP ${e.status ?? 'unknown'}): ${e.message}`);
+              }
+            }
@@ -0,0 +1,467 @@
+# Require external PRs to reference an approved issue (e.g. Fixes #NNN) and
+# the PR author to be assigned to that issue. On failure the PR is
+# labeled "missing-issue-link", commented on, and closed.
+#
+# Maintainer override: an org member can reopen the PR or remove
+# "missing-issue-link" — both add "bypass-issue-check" and reopen.
+#
+# Dependency: tag-external-prs.yml must apply the "external" label
+# first. This workflow does NOT trigger on "opened" (new PRs have no labels
+# yet, so the gate would always skip).
+
+name: Require Issue Link
+
+on:
+  pull_request_target:
+    # NEVER CHECK OUT UNTRUSTED CODE FROM A PR's HEAD IN A pull_request_target JOB.
+    # Doing so would allow attackers to execute arbitrary code in the context of your repository.
+    types: [edited, reopened, labeled, unlabeled]
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Enforcement gate: set to 'true' to activate the issue link requirement.
+# When 'false', the workflow still runs the check logic (useful for dry-run
+# visibility) but will NOT label, comment, close, or fail PRs.
+# ──────────────────────────────────────────────────────────────────────────────
+env:
+  ENFORCE_ISSUE_LINK: "true"
+
+permissions:
+  contents: read
+
+jobs:
+  check-issue-link:
+    # Run when the "external" label is added, on edit/reopen if already labeled,
+    # or when "missing-issue-link" is removed (triggers maintainer override check).
+    # Skip entirely when the PR already carries "trusted-contributor" or
+    # "bypass-issue-check".
+    if: >-
+      !contains(github.event.pull_request.labels.*.name, 'trusted-contributor') &&
+      !contains(github.event.pull_request.labels.*.name, 'bypass-issue-check') &&
+      (
+        (github.event.action == 'labeled' && github.event.label.name == 'external') ||
+        (github.event.action == 'unlabeled' && github.event.label.name == 'missing-issue-link' && contains(github.event.pull_request.labels.*.name, 'external')) ||
+        (github.event.action != 'labeled' && github.event.action != 'unlabeled' && contains(github.event.pull_request.labels.*.name, 'external'))
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      pull-requests: write
+
+    steps:
+      - name: Check for issue link and assignee
+        id: check-link
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            const action = context.payload.action;
+
+            // ── Helper: ensure a label exists, then add it to the PR ────────
+            async function ensureAndAddLabel(labelName, color) {
+              try {
+                await github.rest.issues.getLabel({ owner, repo, name: labelName });
+              } catch (e) {
+                if (e.status !== 404) throw e;
+                try {
+                  await github.rest.issues.createLabel({ owner, repo, name: labelName, color });
+                } catch (createErr) {
+                  // 422 = label was created by a concurrent run between our
+                  // GET and POST — safe to ignore.
+                  if (createErr.status !== 422) throw createErr;
+                }
+              }
+              await github.rest.issues.addLabels({
+                owner, repo, issue_number: prNumber, labels: [labelName],
+              });
+            }
+
+            // ── Helper: check if the user who triggered this event (reopened
+            // the PR / removed the label) has write+ access on the repo ───
+            // Uses the repo collaborator permission endpoint instead of the
+            // org membership endpoint. The org endpoint requires the caller
+            // to be an org member, which GITHUB_TOKEN (an app installation
+            // token) never is — so it always returns 403.
+            async function senderIsOrgMember() {
+              const sender = context.payload.sender?.login;
+              if (!sender) {
+                throw new Error('Event has no sender — cannot check permissions');
+              }
+              try {
+                const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner, repo, username: sender,
+                });
+                const perm = data.permission;
+                if (['admin', 'maintain', 'write'].includes(perm)) {
+                  console.log(`${sender} has ${perm} permission — treating as maintainer`);
+                  return { isMember: true, login: sender };
+                }
+                console.log(`${sender} has ${perm} permission — not a maintainer`);
+                return { isMember: false, login: sender };
+              } catch (e) {
+                if (e.status === 404) {
+                  console.log(`Cannot check permissions for ${sender} — treating as non-maintainer`);
+                  return { isMember: false, login: sender };
+                }
+                const status = e.status ?? 'unknown';
+                throw new Error(
+                  `Permission check failed for ${sender} (HTTP ${status}): ${e.message}`,
+                );
+              }
+            }
+
+            // ── Helper: apply maintainer bypass (shared by both override paths) ──
+            async function applyMaintainerBypass(reason) {
+              console.log(reason);
+
+              // Remove missing-issue-link if present
+              try {
+                await github.rest.issues.removeLabel({
+                  owner, repo, issue_number: prNumber, name: 'missing-issue-link',
+                });
+              } catch (e) {
+                if (e.status !== 404) throw e;
+              }
+
+              // Reopen before adding bypass label — a failed reopen is more
+              // actionable than a closed PR with a bypass label stuck on it.
+              if (context.payload.pull_request.state === 'closed') {
+                try {
+                  await github.rest.pulls.update({
+                    owner, repo, pull_number: prNumber, state: 'open',
+                  });
+                  console.log(`Reopened PR #${prNumber}`);
+                } catch (e) {
+                  // 422 if head branch deleted; 403 if permissions insufficient.
+                  // Bypass labels still apply — maintainer can reopen manually.
+                  core.warning(
+                    `Could not reopen PR #${prNumber} (HTTP ${e.status ?? 'unknown'}): ${e.message}. ` +
+                    `Bypass labels were applied — a maintainer may need to reopen manually.`,
+                  );
+                }
+              }
+
+              // Add bypass-issue-check so future triggers skip enforcement
+              await ensureAndAddLabel('bypass-issue-check', '0e8a16');
+
+              // Minimize stale enforcement comment (best-effort; must not
+              // abort bypass — sync w/ reopen_on_assignment.yml & step below)
+              try {
+                const marker = '<!-- require-issue-link -->';
+                const comments = await github.paginate(
+                  github.rest.issues.listComments,
+                  { owner, repo, issue_number: prNumber, per_page: 100 },
+                );
+                const stale = comments.find(c => c.body && c.body.includes(marker));
+                if (stale) {
+                  await github.graphql(`
+                    mutation($id: ID!) {
+                      minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) {
+                        minimizedComment { isMinimized }
+                      }
+                    }
+                  `, { id: stale.node_id });
+                  console.log(`Minimized stale enforcement comment ${stale.id} as outdated`);
+                }
+              } catch (e) {
+                core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`);
+              }
+
+              core.setOutput('has-link', 'true');
+              core.setOutput('is-assigned', 'true');
+            }
+
+            // ── Maintainer override: removed "missing-issue-link" label ─────
+            if (action === 'unlabeled') {
+              const { isMember, login } = await senderIsOrgMember();
+              if (isMember) {
+                await applyMaintainerBypass(
+                  `Maintainer ${login} removed missing-issue-link from PR #${prNumber} — bypassing enforcement`,
+                );
+                return;
+              }
+              // Non-member removed the label — re-add it defensively and
+              // set failure outputs so downstream steps (comment, close) fire.
+              // NOTE: addLabels fires a "labeled" event, but the job-level gate
+              // only matches labeled events for "external", so no re-trigger.
+              console.log(`Non-member ${login} removed missing-issue-link — re-adding`);
+              try {
+                await ensureAndAddLabel('missing-issue-link', 'b76e79');
+              } catch (e) {
+                core.warning(
+                  `Failed to re-add missing-issue-link (HTTP ${e.status ?? 'unknown'}): ${e.message}. ` +
+                  `Downstream step will retry.`,
+                );
+              }
+              core.setOutput('has-link', 'false');
+              core.setOutput('is-assigned', 'false');
+              return;
+            }
+
+            // ── Maintainer override: reopened PR with "missing-issue-link" ──
+            const prLabels = context.payload.pull_request.labels.map(l => l.name);
+            if (action === 'reopened' && prLabels.includes('missing-issue-link')) {
+              const { isMember, login } = await senderIsOrgMember();
+              if (isMember) {
+                await applyMaintainerBypass(
+                  `Maintainer ${login} reopened PR #${prNumber} — bypassing enforcement`,
+                );
+                return;
+              }
+              console.log(`Non-member ${login} reopened PR — proceeding with check`);
+            }
+
+            // ── Fetch live labels (race guard) ──────────────────────────────
+            const { data: liveLabels } = await github.rest.issues.listLabelsOnIssue({
+              owner, repo, issue_number: prNumber,
+            });
+            const liveNames = liveLabels.map(l => l.name);
+            if (liveNames.includes('trusted-contributor') || liveNames.includes('bypass-issue-check')) {
+              console.log('PR has trusted-contributor or bypass-issue-check label — bypassing');
+              core.setOutput('has-link', 'true');
+              core.setOutput('is-assigned', 'true');
+              return;
+            }
+
+            const body = context.payload.pull_request.body || '';
+            const pattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*#(\d+)/gi;
+            const matches = [...body.matchAll(pattern)];
+
+            if (matches.length === 0) {
+              console.log('No issue link found in PR body');
+              core.setOutput('has-link', 'false');
+              core.setOutput('is-assigned', 'false');
+              return;
+            }
+
+            const issues = matches.map(m => `#${m[1]}`).join(', ');
+            console.log(`Found issue link(s): ${issues}`);
+            core.setOutput('has-link', 'true');
+
+            // Check whether the PR author is assigned to at least one linked issue
+            const prAuthor = context.payload.pull_request.user.login;
+            const MAX_ISSUES = 5;
+            const allIssueNumbers = [...new Set(matches.map(m => parseInt(m[1], 10)))];
+            const issueNumbers = allIssueNumbers.slice(0, MAX_ISSUES);
+            if (allIssueNumbers.length > MAX_ISSUES) {
+              core.warning(
+                `PR references ${allIssueNumbers.length} issues — only checking the first ${MAX_ISSUES}`,
+              );
+            }
+
+            let assignedToAny = false;
+            for (const num of issueNumbers) {
+              try {
+                const { data: issue } = await github.rest.issues.get({
+                  owner, repo, issue_number: num,
+                });
+                const assignees = issue.assignees.map(a => a.login.toLowerCase());
+                if (assignees.includes(prAuthor.toLowerCase())) {
+                  console.log(`PR author "${prAuthor}" is assigned to #${num}`);
+                  assignedToAny = true;
+                  break;
+                } else {
+                  console.log(`PR author "${prAuthor}" is NOT assigned to #${num} (assignees: ${assignees.join(', ') || 'none'})`);
+                }
+              } catch (error) {
+                if (error.status === 404) {
+                  console.log(`Issue #${num} not found — skipping`);
+                } else {
+                  // Non-404 errors (rate limit, server error) must not be
+                  // silently skipped — they could cause false enforcement
+                  // (closing a legitimate PR whose assignment can't be verified).
+                  throw new Error(
+                    `Cannot verify assignee for issue #${num} (${error.status}): ${error.message}`,
+                  );
+                }
+              }
+            }
+
+            core.setOutput('is-assigned', assignedToAny ? 'true' : 'false');
+
+      - name: Add missing-issue-link label
+        if: >-
+          env.ENFORCE_ISSUE_LINK == 'true' &&
+          (steps.check-link.outputs.has-link != 'true' || steps.check-link.outputs.is-assigned != 'true')
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            const labelName = 'missing-issue-link';
+
+            // Ensure the label exists (no checkout/shared helper available)
+            try {
+              await github.rest.issues.getLabel({ owner, repo, name: labelName });
+            } catch (e) {
+              if (e.status !== 404) throw e;
+              try {
+                await github.rest.issues.createLabel({
+                  owner, repo, name: labelName, color: 'b76e79',
+                });
+              } catch (createErr) {
+                if (createErr.status !== 422) throw createErr;
+              }
+            }
+
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number: prNumber, labels: [labelName],
+            });
+
+      - name: Remove missing-issue-link label and reopen PR
+        if: >-
+          env.ENFORCE_ISSUE_LINK == 'true' &&
+          steps.check-link.outputs.has-link == 'true' && steps.check-link.outputs.is-assigned == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            try {
+              await github.rest.issues.removeLabel({
+                owner, repo, issue_number: prNumber, name: 'missing-issue-link',
+              });
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+            // Reopen if this workflow previously closed the PR. We check the
+            // event payload labels (not live labels) because we already removed
+            // missing-issue-link above; the payload still reflects pre-step state.
+            const labels = context.payload.pull_request.labels.map(l => l.name);
+            if (context.payload.pull_request.state === 'closed' && labels.includes('missing-issue-link')) {
+              await github.rest.pulls.update({
+                owner,
+                repo,
+                pull_number: prNumber,
+                state: 'open',
+              });
+              console.log(`Reopened PR #${prNumber}`);
+            }
+
+            // Minimize stale enforcement comment (best-effort;
+            // sync w/ applyMaintainerBypass above & reopen_on_assignment.yml)
+            try {
+              const marker = '<!-- require-issue-link -->';
+              const comments = await github.paginate(
+                github.rest.issues.listComments,
+                { owner, repo, issue_number: prNumber, per_page: 100 },
+              );
+              const stale = comments.find(c => c.body && c.body.includes(marker));
+              if (stale) {
+                await github.graphql(`
+                  mutation($id: ID!) {
+                    minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) {
+                      minimizedComment { isMinimized }
+                    }
+                  }
+                `, { id: stale.node_id });
+                console.log(`Minimized stale enforcement comment ${stale.id} as outdated`);
+              }
+            } catch (e) {
+              core.warning(`Could not minimize stale comment on PR #${prNumber}: ${e.message}`);
+            }
+
+      - name: Post comment, close PR, and fail
+        if: >-
+          env.ENFORCE_ISSUE_LINK == 'true' &&
+          (steps.check-link.outputs.has-link != 'true' || steps.check-link.outputs.is-assigned != 'true')
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            const hasLink = '${{ steps.check-link.outputs.has-link }}' === 'true';
+            const isAssigned = '${{ steps.check-link.outputs.is-assigned }}' === 'true';
+            const marker = '<!-- require-issue-link -->';
+
+            let lines;
+            if (!hasLink) {
+              lines = [
+                marker,
+                '**This PR has been automatically closed** because it does not link to an approved issue.',
+                '',
+                'All external contributions must reference an approved issue or discussion. Please:',
+                '1. Find or [open an issue](https://github.com/' + owner + '/' + repo + '/issues/new/choose) describing the change',
+                '2. Wait for a maintainer to approve and assign you',
+                '3. Add `Fixes #<issue_number>`, `Closes #<issue_number>`, or `Resolves #<issue_number>` to your PR description and the PR will be reopened automatically',
+                '',
+                '*Maintainers: reopen this PR or remove the `missing-issue-link` label to bypass this check.*',
+              ];
+            } else {
+              lines = [
+                marker,
+                '**This PR has been automatically closed** because you are not assigned to the linked issue.',
+                '',
+                'External contributors must be assigned to an issue before opening a PR for it. Please:',
+                '1. Comment on the linked issue to request assignment from a maintainer',
+                '2. Once assigned, your PR will be reopened automatically',
+                '',
+                '*Maintainers: reopen this PR or remove the `missing-issue-link` label to bypass this check.*',
+              ];
+            }
+
+            const body = lines.join('\n');
+
+            // Deduplicate: check for existing comment with the marker
+            const comments = await github.paginate(
+              github.rest.issues.listComments,
+              { owner, repo, issue_number: prNumber, per_page: 100 },
+            );
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+
+            if (!existing) {
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: prNumber,
+                body,
+              });
+              console.log('Posted requirement comment');
+            } else if (existing.body !== body) {
+              await github.rest.issues.updateComment({
+                owner,
+                repo,
+                comment_id: existing.id,
+                body,
+              });
+              console.log('Updated existing comment with new message');
+            } else {
+              console.log('Comment already exists — skipping');
+            }
+
+            // Close the PR
+            if (context.payload.pull_request.state === 'open') {
+              await github.rest.pulls.update({
+                owner,
+                repo,
+                pull_number: prNumber,
+                state: 'closed',
+              });
+              console.log(`Closed PR #${prNumber}`);
+            }
+
+            // Cancel all other in-progress and queued workflow runs for this PR
+            const headSha = context.payload.pull_request.head.sha;
+            for (const status of ['in_progress', 'queued']) {
+              const runs = await github.paginate(
+                github.rest.actions.listWorkflowRunsForRepo,
+                { owner, repo, head_sha: headSha, status, per_page: 100 },
+              );
+              for (const run of runs) {
+                if (run.id === context.runId) continue;
+                try {
+                  await github.rest.actions.cancelWorkflowRun({
+                    owner, repo, run_id: run.id,
+                  });
+                  console.log(`Cancelled ${status} run ${run.id} (${run.name})`);
+                } catch (err) {
+                  console.log(`Could not cancel run ${run.id}: ${err.message}`);
+                }
+              }
+            }
+
+            const reason = !hasLink
+              ? 'PR must reference an issue using auto-close keywords (e.g., "Fixes #123").'
+              : 'PR author must be assigned to the linked issue.';
+            core.setFailed(reason);
@@ -0,0 +1,402 @@
+# Automatically tag issues as "external" or "internal" based on whether
+# the author is a member of the langchain-ai GitHub organization, and
+# apply contributor tier labels to external contributors based on their
+# merged PR history.
+#
+# PR labeling is handled by tag-external-prs.yml.
+# PR + issue backfill lives in the backfill job below (workflow_dispatch).
+#
+# Setup Requirements:
+# 1. Create a GitHub App with permissions:
+#    - Repository: Issues (write), Pull requests (write)
+#    - Organization: Members (read)
+# 2. Install the app on your organization and this repository
+# 3. Add these repository secrets:
+#    - ORG_MEMBERSHIP_APP_ID: Your app's ID
+#    - ORG_MEMBERSHIP_APP_PRIVATE_KEY: Your app's private key
+#
+# The GitHub App token is required to check private organization membership.
+# Without it, the workflow will fail.
+
+name: Tag External Issues
+
+on:
+  issues:
+    types: [opened]
+  workflow_dispatch:
+    inputs:
+      backfill_type:
+        description: "Backfill type (for initial run)"
+        default: "both"
+        type: choice
+        options:
+          - prs
+          - issues
+          - both
+      max_items:
+        description: "Maximum number of items to process"
+        default: "100"
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  tag-external:
+    if: github.event_name == 'issues'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ORG_MEMBERSHIP_APP_ID }}
+          private-key: ${{ secrets.ORG_MEMBERSHIP_APP_PRIVATE_KEY }}
+
+      - name: Check if contributor is external
+        if: steps.app-token.outcome == 'success'
+        id: check-membership
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const author = context.payload.sender.login;
+            const senderType = context.payload.sender.type;
+
+            if (senderType === 'Bot') {
+              console.log(`${author} is a Bot — treating as internal`);
+              core.setOutput('is-external', 'false');
+              return;
+            }
+
+            try {
+              const membership = await github.rest.orgs.getMembershipForUser({
+                org: 'langchain-ai',
+                username: author,
+              });
+              const isExternal = membership.data.state !== 'active';
+              console.log(
+                isExternal
+                  ? `${author} has pending membership — treating as external`
+                  : `${author} is an active member of langchain-ai`,
+              );
+              core.setOutput('is-external', isExternal ? 'true' : 'false');
+            } catch (e) {
+              if (e.status === 404) {
+                console.log(`${author} is not a member of langchain-ai`);
+                core.setOutput('is-external', 'true');
+              } else {
+                throw new Error(
+                  `Membership check failed for ${author} (${e.status}): ${e.message}`,
+                );
+              }
+            }
+
+      - name: Apply contributor tier label
+        if: steps.check-membership.outputs.is-external == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const issue = context.payload.issue;
+            const author = issue.user.login;
+            const issueNumber = issue.number;
+
+            const TRUSTED_THRESHOLD = 5;
+            const LABEL_COLOR = 'b76e79';
+
+            let mergedCount;
+            try {
+              const result = await github.rest.search.issuesAndPullRequests({
+                q: `repo:${owner}/${repo} is:pr is:merged author:"${author}"`,
+                per_page: 1,
+              });
+              mergedCount = result?.data?.total_count;
+            } catch (error) {
+              if (error?.status !== 422) throw error;
+              core.warning(`Search failed for ${author}; skipping tier label.`);
+              return;
+            }
+
+            if (mergedCount == null) {
+              core.warning(`Search response missing total_count for ${author}; skipping tier label.`);
+              return;
+            }
+
+            const tierLabel = mergedCount >= TRUSTED_THRESHOLD ? 'trusted-contributor' : null;
+
+            if (tierLabel) {
+              try {
+                await github.rest.issues.getLabel({ owner, repo, name: tierLabel });
+              } catch (e) {
+                if (e.status !== 404) throw e;
+                try {
+                  await github.rest.issues.createLabel({ owner, repo, name: tierLabel, color: LABEL_COLOR });
+                } catch (createErr) {
+                  if (createErr.status !== 422) throw createErr;
+                }
+              }
+              await github.rest.issues.addLabels({
+                owner, repo, issue_number: issueNumber, labels: [tierLabel],
+              });
+              console.log(`Applied '${tierLabel}' to #${issueNumber} (${mergedCount} merged PRs)`);
+            } else {
+              console.log(`No tier label for ${author} (${mergedCount} merged PRs)`);
+            }
+
+      - name: Add external label
+        if: steps.check-membership.outputs.is-external == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.issue.number;
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number, labels: ['external'],
+            });
+            console.log(`Added 'external' label to issue #${issue_number}`);
+
+      - name: Add internal label
+        if: steps.check-membership.outputs.is-external == 'false'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.issue.number;
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number, labels: ['internal'],
+            });
+            console.log(`Added 'internal' label to issue #${issue_number}`);
+
+  backfill:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ORG_MEMBERSHIP_APP_ID }}
+          private-key: ${{ secrets.ORG_MEMBERSHIP_APP_PRIVATE_KEY }}
+
+      - name: Backfill labels
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const rawMax = '${{ inputs.max_items }}';
+            const maxItems = parseInt(rawMax, 10);
+            if (isNaN(maxItems) || maxItems <= 0) {
+              core.setFailed(`Invalid max_items: "${rawMax}" — must be a positive integer`);
+              return;
+            }
+            const backfillType = '${{ inputs.backfill_type }}';
+
+            const TRUSTED_THRESHOLD = 5;
+            const LABEL_COLOR = 'b76e79';
+
+            const tierLabels = ['trusted-contributor'];
+
+            // ── Helpers ─────────────────────────────────────────────────
+
+            async function ensureLabel(name) {
+              try {
+                await github.rest.issues.getLabel({ owner, repo, name });
+              } catch (e) {
+                if (e.status !== 404) throw e;
+                try {
+                  await github.rest.issues.createLabel({ owner, repo, name, color: LABEL_COLOR });
+                } catch (createErr) {
+                  if (createErr.status !== 422) throw createErr;
+                }
+              }
+            }
+
+            async function checkMembership(author, userType) {
+              if (userType === 'Bot') {
+                console.log(`${author} is a Bot — treating as internal`);
+                return { isExternal: false };
+              }
+              try {
+                const membership = await github.rest.orgs.getMembershipForUser({
+                  org: 'langchain-ai',
+                  username: author,
+                });
+                const isExternal = membership.data.state !== 'active';
+                console.log(
+                  isExternal
+                    ? `${author} has pending membership — treating as external`
+                    : `${author} is an active member of langchain-ai`,
+                );
+                return { isExternal };
+              } catch (e) {
+                if (e.status === 404) {
+                  console.log(`${author} is not a member of langchain-ai`);
+                  return { isExternal: true };
+                }
+                throw new Error(
+                  `Membership check failed for ${author} (${e.status}): ${e.message}`,
+                );
+              }
+            }
+
+            async function getContributorInfo(contributorCache, author, userType) {
+              if (contributorCache.has(author)) return contributorCache.get(author);
+
+              const { isExternal } = await checkMembership(author, userType);
+
+              let mergedCount = null;
+              if (isExternal) {
+                try {
+                  const result = await github.rest.search.issuesAndPullRequests({
+                    q: `repo:${owner}/${repo} is:pr is:merged author:"${author}"`,
+                    per_page: 1,
+                  });
+                  mergedCount = result?.data?.total_count ?? null;
+                } catch (e) {
+                  if (e?.status !== 422) throw e;
+                  core.warning(`Search failed for ${author}; skipping tier.`);
+                }
+              }
+
+              const info = { isExternal, mergedCount };
+              contributorCache.set(author, info);
+              return info;
+            }
+
+            // ── Setup ────────────────────────────────────────────────────
+
+            for (const name of tierLabels) {
+              await ensureLabel(name);
+            }
+
+            const contributorCache = new Map();
+
+            let processed = 0;
+            let failures = 0;
+
+            // ── Backfill PRs ─────────────────────────────────────────────
+
+            if (backfillType === 'prs' || backfillType === 'both') {
+              const prs = await github.paginate(github.rest.pulls.list, {
+                owner, repo, state: 'open', per_page: 100,
+              });
+
+              for (const pr of prs) {
+                if (processed >= maxItems) break;
+
+                try {
+                  const author = pr.user.login;
+                  const info = await getContributorInfo(contributorCache, author, pr.user.type);
+
+                  const labels = [info.isExternal ? 'external' : 'internal'];
+                  if (info.isExternal && info.mergedCount != null && info.mergedCount >= TRUSTED_THRESHOLD) {
+                    labels.push('trusted-contributor');
+                  }
+
+                  // Ensure all labels exist before batch add
+                  for (const name of labels) {
+                    await ensureLabel(name);
+                  }
+
+                  // Remove stale tier labels
+                  const currentLabels = (await github.paginate(
+                    github.rest.issues.listLabelsOnIssue,
+                    { owner, repo, issue_number: pr.number, per_page: 100 },
+                  )).map(l => l.name ?? '');
+                  for (const name of currentLabels) {
+                    if (tierLabels.includes(name) && !labels.includes(name)) {
+                      try {
+                        await github.rest.issues.removeLabel({
+                          owner, repo, issue_number: pr.number, name,
+                        });
+                      } catch (e) {
+                        if (e.status !== 404) throw e;
+                      }
+                    }
+                  }
+
+                  await github.rest.issues.addLabels({
+                    owner, repo, issue_number: pr.number, labels,
+                  });
+                  console.log(`PR #${pr.number} (${author}): ${labels.join(', ')}`);
+                  processed++;
+                } catch (e) {
+                  failures++;
+                  core.warning(`Failed to process PR #${pr.number}: ${e.message}`);
+                }
+              }
+            }
+
+            // ── Backfill issues ──────────────────────────────────────────
+
+            if (backfillType === 'issues' || backfillType === 'both') {
+              const issues = await github.paginate(github.rest.issues.listForRepo, {
+                owner, repo, state: 'open', per_page: 100,
+              });
+
+              for (const issue of issues) {
+                if (processed >= maxItems) break;
+                if (issue.pull_request) continue;
+
+                try {
+                  const author = issue.user.login;
+                  const info = await getContributorInfo(contributorCache, author, issue.user.type);
+
+                  const labels = [info.isExternal ? 'external' : 'internal'];
+                  if (info.isExternal && info.mergedCount != null && info.mergedCount >= TRUSTED_THRESHOLD) {
+                    labels.push('trusted-contributor');
+                  }
+
+                  // Ensure all labels exist before batch add
+                  for (const name of labels) {
+                    await ensureLabel(name);
+                  }
+
+                  // Remove stale tier labels
+                  const currentLabels = (await github.paginate(
+                    github.rest.issues.listLabelsOnIssue,
+                    { owner, repo, issue_number: issue.number, per_page: 100 },
+                  )).map(l => l.name ?? '');
+                  for (const name of currentLabels) {
+                    if (tierLabels.includes(name) && !labels.includes(name)) {
+                      try {
+                        await github.rest.issues.removeLabel({
+                          owner, repo, issue_number: issue.number, name,
+                        });
+                      } catch (e) {
+                        if (e.status !== 404) throw e;
+                      }
+                    }
+                  }
+
+                  await github.rest.issues.addLabels({
+                    owner, repo, issue_number: issue.number, labels,
+                  });
+                  console.log(`Issue #${issue.number} (${author}): ${labels.join(', ')}`);
+                  processed++;
+                } catch (e) {
+                  failures++;
+                  core.warning(`Failed to process issue #${issue.number}: ${e.message}`);
+                }
+              }
+            }
+
+            console.log(`\nBackfill complete. Processed ${processed} items, ${failures} failures. ${contributorCache.size} unique authors.`);
@@ -0,0 +1,173 @@
+# Automatically tag pull requests as "external" or "internal" based on
+# whether the author is a member of the langchain-ai GitHub organization,
+# and apply contributor tier labels to external contributors based on
+# their merged PR history.
+#
+# Issue labeling is handled by tag-external-issues.yml.
+# Backfill (workflow_dispatch) also lives in tag-external-issues.yml.
+#
+# Setup Requirements:
+# 1. Create a GitHub App with permissions:
+#    - Repository: Pull requests (write)
+#    - Organization: Members (read)
+# 2. Install the app on your organization and this repository
+# 3. Add these repository secrets:
+#    - ORG_MEMBERSHIP_APP_ID: Your app's ID
+#    - ORG_MEMBERSHIP_APP_PRIVATE_KEY: Your app's private key
+#
+# The GitHub App token is required to check private organization membership.
+# Without it, the workflow will fail.
+
+name: Tag External PRs
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  tag-external:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ORG_MEMBERSHIP_APP_ID }}
+          private-key: ${{ secrets.ORG_MEMBERSHIP_APP_PRIVATE_KEY }}
+
+      - name: Check if contributor is external
+        if: steps.app-token.outcome == 'success'
+        id: check-membership
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const author = context.payload.sender.login;
+            const senderType = context.payload.sender.type;
+
+            if (senderType === 'Bot') {
+              console.log(`${author} is a Bot — treating as internal`);
+              core.setOutput('is-external', 'false');
+              return;
+            }
+
+            try {
+              const membership = await github.rest.orgs.getMembershipForUser({
+                org: 'langchain-ai',
+                username: author,
+              });
+              const isExternal = membership.data.state !== 'active';
+              console.log(
+                isExternal
+                  ? `${author} has pending membership — treating as external`
+                  : `${author} is an active member of langchain-ai`,
+              );
+              core.setOutput('is-external', isExternal ? 'true' : 'false');
+            } catch (e) {
+              if (e.status === 404) {
+                console.log(`${author} is not a member of langchain-ai`);
+                core.setOutput('is-external', 'true');
+              } else {
+                throw new Error(
+                  `Membership check failed for ${author} (${e.status}): ${e.message}`,
+                );
+              }
+            }
+
+      # Apply tier label BEFORE the external label so that
+      # "trusted-contributor" is already present when the "external" labeled
+      # event fires and triggers require_issue_link.yml.
+      - name: Apply contributor tier label
+        if: steps.check-membership.outputs.is-external == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          # Use App token so the "labeled" event propagates to downstream
+          # workflows (e.g. require_issue_link.yml).
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const pr = context.payload.pull_request;
+            const author = pr.user.login;
+            const prNumber = pr.number;
+
+            const TRUSTED_THRESHOLD = 5;
+            const LABEL_COLOR = 'b76e79';
+
+            let mergedCount;
+            try {
+              const result = await github.rest.search.issuesAndPullRequests({
+                q: `repo:${owner}/${repo} is:pr is:merged author:"${author}"`,
+                per_page: 1,
+              });
+              mergedCount = result?.data?.total_count;
+            } catch (error) {
+              if (error?.status !== 422) throw error;
+              core.warning(`Search failed for ${author}; skipping tier label.`);
+              return;
+            }
+
+            if (mergedCount == null) {
+              core.warning(`Search response missing total_count for ${author}; skipping tier label.`);
+              return;
+            }
+
+            const tierLabel = mergedCount >= TRUSTED_THRESHOLD ? 'trusted-contributor' : null;
+
+            if (tierLabel) {
+              try {
+                await github.rest.issues.getLabel({ owner, repo, name: tierLabel });
+              } catch (e) {
+                if (e.status !== 404) throw e;
+                try {
+                  await github.rest.issues.createLabel({ owner, repo, name: tierLabel, color: LABEL_COLOR });
+                } catch (createErr) {
+                  if (createErr.status !== 422) throw createErr;
+                }
+              }
+              await github.rest.issues.addLabels({
+                owner, repo, issue_number: prNumber, labels: [tierLabel],
+              });
+              console.log(`Applied '${tierLabel}' to PR #${prNumber} (${mergedCount} merged PRs)`);
+            } else {
+              console.log(`No tier label for ${author} (${mergedCount} merged PRs)`);
+            }
+
+      - name: Add external label
+        if: steps.check-membership.outputs.is-external == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          # Use App token so the "labeled" event propagates to downstream
+          # workflows (e.g. require_issue_link.yml). Events created by the
+          # default GITHUB_TOKEN do not trigger additional workflow runs.
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request.number;
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number, labels: ['external'],
+            });
+            console.log(`Added 'external' label to PR #${issue_number}`);
+
+      - name: Add internal label
+        if: steps.check-membership.outputs.is-external == 'false'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request.number;
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number, labels: ['internal'],
+            });
+            console.log(`Added 'internal' label to PR #${issue_number}`);
@@ -0,0 +1,43 @@
+name: UV Lock Upgrade
+
+on:
+  schedule:
+    # run at midnight every Sunday
+    - cron: '0 0 * * 0'
+  # allow manual triggering
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade-dependencies:
+    runs-on: ubuntu-latest
+    
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      
+      - name: Set up uv
+        uses: ./.github/actions/uv_setup
+        with:
+          python-version: "3.10"
+          cache-suffix: "uv-lock-upgrade"
+          
+      - name: Run uv lock --upgrade in all Python packages
+        run: make lock-upgrade
+          
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore(deps): upgrade dependencies with `uv lock --upgrade`"
+          title: "chore(deps): upgrade dependencies with `uv lock --upgrade`"
+          body: |
+            This PR updates the dependencies in all Python packages using `uv lock --upgrade`.
+            
+            This is an automated PR created by the UV Lock Upgrade workflow.
+          branch: deps/uv-lock-upgrade
+          delete-branch: true
+          labels: |
+            dependencies