feat(workflow): restore workflows to previous versions by jordan-umusu · Pull Request #2581 · TracecatHQ/tracecat

jordan-umusu · 2026-04-29T20:55:21Z

Summary by cubic

Restore a workflow to any saved version without altering history. Adds a Versions tab in the builder and an API to set the current published version.

New Features
- API: POST /workflows/{workflow_id}/definitions/{version}/restore returns WorkflowRead; maps duplicate alias to HTTP 409; rejects non-positive version with HTTP 422.
- Backend: restore_workflow_definition sets version and registry_lock, updates fields, rebuilds actions, and bumps graph_version.
- Frontend: Versions tab lists history and lets you restore; shows “Current vX”, relative timestamps, loading states, tooltips, and toasts.
- Hooks/client: useWorkflowDefinitions, useRestoreWorkflowDefinition, and workflowsRestoreWorkflowDefinition with types.
- Tests: ensure restoring (e.g., v2 from v7) keeps v3–v7 intact; next save becomes v8; execution by alias runs the restored version; API returns 409 on alias conflicts and 422 for invalid versions.
Refactors
- Definition fetching and alias resolution now prefer the workflow’s version pointer; fall back to latest for legacy workflows.

^{Written for commit c17808d701acab815bd6d8804f031762a85e5b04. Summary will update on new commits. Review in cubic}

zeropath-ai · 2026-04-29T20:58:54Z

✅ No security or compliance issues detected. Reviewed everything up to 95b42e2.

Security Overview

🔎 Scanned files: 13 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=2ce71b17-1046-4dfe-b01d-32c5af427b72&codeScanTypes=PrScan&tab=issues

Detected Code Changes

| Change Type | Relevant files

... (code changes summary truncated to fit VCS comment limits.)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 77b0b5e51f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

4 issues found across 8 files

Confidence score: 3/5

There is a concrete regression risk around version selection: in tracecat/workflow/management/definitions.py, falling back to latest when a pointed version row is missing can return the wrong workflow definition instead of the intended version.
Restore-path validation and alias handling need hardening: tracecat/workflow/management/router.py allows version=0 to bypass exact filtering, and tracecat/workflow/management/management.py can trigger an IntegrityError/500 by overwriting an alias now owned by another workflow.
This lands at moderate merge risk because multiple medium-severity, high-confidence issues are user-facing (wrong restore target, potential restore failure) rather than purely cosmetic.
Pay close attention to tracecat/workflow/management/definitions.py, tracecat/workflow/management/router.py, tracecat/workflow/management/management.py, frontend/src/hooks/use-workflow-definitions.ts - version/restore correctness and cache key consistency could cause wrong data to be restored or shown stale in the UI.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/workflow/management/definitions.py">

<violation number="1" location="tracecat/workflow/management/definitions.py:53">
P2: If the workflow has a version pointer but that version row is missing, this code silently falls back to the latest definition and can return the wrong version. Restrict the fallback to only `current_version is None` and return the pointer-target lookup result directly.</violation>
</file>

<file name="frontend/src/hooks/use-workflow-definitions.ts">

<violation number="1" location="frontend/src/hooks/use-workflow-definitions.ts:67">
P2: Use a consistent workflow key source for cache updates/invalidation. Mixing `workflowId` for reads and `workflow.id` for writes can leave stale query data after restore.</violation>
</file>

<file name="tracecat/workflow/management/router.py">

<violation number="1" location="tracecat/workflow/management/router.py:736">
P2: Validate restore version as a positive integer before lookup; `version=0` currently bypasses exact version filtering and can restore the wrong definition.</violation>
</file>

<file name="tracecat/workflow/management/management.py">

<violation number="1" location="tracecat/workflow/management/management.py:894">
P2: Avoid blindly overwriting the workflow alias during restore; if the snapshot alias is now owned by another workflow, this commit will raise an IntegrityError and return 500. Either preserve the current alias or catch alias conflicts and return a 409.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed4a49a6fc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2e8fec199f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

2 issues found across 5 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/workflow/management/layout.py">

<violation number="1" location="tracecat/workflow/management/layout.py:54">
P1: Edge-qualified `depends_on` entries (e.g. `action_ref.error`) are ignored because the code checks the raw dep string instead of its source component, causing missing dependents and incorrect layout ordering.</violation>
</file>

<file name="tracecat/workflow/management/management.py">

<violation number="1" location="tracecat/workflow/management/management.py:940">
P2: `restore_workflow_definition` now commits once before layout updates and then runs a second version-checked graph mutation. If that second step fails, the restore is already persisted, causing a partial-success/failed-response outcome.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 895e3741ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f95d6c1c28

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…fallback

jordan-umusu temporarily deployed to internal-registry-ci April 29, 2026 20:55 — with GitHub Actions Inactive

jordan-umusu added the engine Improvements or additions to the workflow engine label Apr 29, 2026

jordan-umusu temporarily deployed to internal-registry-ci April 29, 2026 20:55 — with GitHub Actions Inactive

jordan-umusu marked this pull request as ready for review April 29, 2026 20:55

chatgpt-codex-connector Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread tracecat/workflow/management/management.py

cubic-dev-ai Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread tracecat/workflow/management/definitions.py Outdated

Comment thread frontend/src/hooks/use-workflow-definitions.ts Outdated

Comment thread tracecat/workflow/management/router.py

Comment thread tracecat/workflow/management/management.py

jordan-umusu force-pushed the feat/restore-workflow-version branch from 77b0b5e to ed4a49a Compare April 29, 2026 21:16

jordan-umusu temporarily deployed to internal-registry-ci April 29, 2026 21:16 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread tracecat/workflow/management/management.py

Comment thread tracecat/workflow/management/router.py Outdated

jordan-umusu requested a review from daryllimyt April 29, 2026 21:23

jordan-umusu temporarily deployed to internal-registry-ci April 29, 2026 22:00 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/management/management.py Outdated

cubic-dev-ai Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/management/layout.py Outdated

Comment thread tracecat/workflow/management/management.py

jordan-umusu force-pushed the feat/restore-workflow-version branch from 2e8fec1 to 94ddaef Compare April 30, 2026 16:35

jordan-umusu added 4 commits April 30, 2026 12:37

feat(workflow): restore workflows to previous versions

26e20d4

fix(agents): bound min workflow version

e52be26

fix(workflow): auto position retored worfklwos

51c48ee

fix(workflow): confirmation dialog to restore

3106a95

jordan-umusu force-pushed the feat/restore-workflow-version branch from 4def0f6 to 3106a95 Compare April 30, 2026 16:38

jordan-umusu temporarily deployed to internal-registry-ci April 30, 2026 16:38 — with GitHub Actions Inactive

jordan-umusu temporarily deployed to internal-registry-ci April 30, 2026 16:39 — with GitHub Actions Inactive

fix(workflow): atomic restore_workflow_definition

895e374

jordan-umusu temporarily deployed to internal-registry-ci April 30, 2026 16:51 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/management/management.py

fix(workflow): revalidate graph_version under lock on restore

f95d6c1

jordan-umusu temporarily deployed to internal-registry-ci April 30, 2026 17:13 — with GitHub Actions Inactive

jordan-umusu temporarily deployed to internal-registry-ci April 30, 2026 17:14 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/management/management.py

Comment thread tracecat/workflow/management/layout.py

fix(workflows): prefer current definition and constrain legacy alias …

95b42e2

…fallback

jordan-umusu temporarily deployed to internal-registry-ci April 30, 2026 18:16 — with GitHub Actions Inactive

daryllimyt approved these changes Apr 30, 2026

View reviewed changes

jordan-umusu merged commit bb1677b into main Apr 30, 2026
19 checks passed

jordan-umusu deleted the feat/restore-workflow-version branch April 30, 2026 18:33

Conversation

jordan-umusu commented Apr 29, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

zeropath-ai Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jordan-umusu commented Apr 29, 2026 •

edited by cubic-dev-ai Bot

Loading

zeropath-ai Bot commented Apr 29, 2026 •

edited

Loading