v2.4.1: queue-time validation, absolute pixel ceiling, CI hardening

- Reject invalid configs in validate_inputs instead of mid-execution:
  Strict-mode multiple_of above max_res, out-of-range min_res/max_res/
  multiple_of, and unknown constraint modes
- Share the resolution and multiple_of bounds between define_schema() and
  validate_inputs() so the widget and the queue-time check cannot drift
- Cap the min-res pixel budget at an absolute 64 MP, floored at max_res
  squared; the multiplier alone permitted ~12 GB outputs at max_res=8192
- Warn on large upscales in Strict mode as well as min-res mode
- Pin GitHub Actions by commit SHA on node24-native majors; drop issues:write
  from the publish workflow and set contents:read on both
- Pin Comfy-Org/publish-node-action to the commit @v1 resolves to; the 1.0.1
  tag calls `comfy tracking disable`, removed from comfy-cli
- Add requirements-ci.txt with pip caching; add ruff config and a CI lint step
- Add schema-contract, tooltip, budget, crop-guard and validation tests
- Replace typing.Tuple with tuple
- Bump version to 2.4.1

.github/workflows/publish_action.yml

@@ -7,8 +7,10 @@ on:
     paths:
       - "pyproject.toml"
 
+# The publish action only reads the repo and authenticates to the registry API
+# with its own token input; it never touches issues or any other scope.
 permissions:
-  issues: write
+  contents: read
 
 jobs:
   publish-node:
@@ -17,8 +19,12 @@ jobs:
     if: ${{ github.repository_owner == 'EnragedAntelope' }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        # actions/checkout v7.0.1 (node24), pinned by SHA for supply-chain safety.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Publish Custom Node
-        uses: Comfy-Org/publish-node-action@v1
+        # The SHA the upstream-documented @v1 branch points at (verified 2026-08-24).
+        # Do NOT pin the 1.0.1 tag instead: that commit predates the v1 branch and
+        # still calls `comfy tracking disable`, which current comfy-cli no longer has.
+        uses: Comfy-Org/publish-node-action@0eb6cd742945443bee7f79eeddd4f732780029a1
         with:
           personal_access_token: ${{ secrets.REGISTRY_ACCESS_TOKEN }}

.github/workflows/test.yml

@@ -19,14 +19,19 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        # actions/checkout v7.0.1 (node24), pinned by SHA for supply-chain safety.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Set up Python
-        uses: actions/setup-python@v5
+        # actions/setup-python v7.0.0 (node24)
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: requirements-ci.txt
       - name: Install test dependencies
         # comfy_api is mocked in conftest.py, so a full ComfyUI install isn't needed.
-        # numpy silences torch's "Failed to initialize NumPy" import warning.
-        run: python -m pip install --upgrade pip pytest torch numpy
+        run: python -m pip install --upgrade pip -r requirements-ci.txt
+      - name: Lint
+        run: python -m ruff check .
       - name: Run tests
         run: python -m pytest -q