Publish workflow (.github/workflows/publish.yml) already existed and was
already push-to-main-only / workflow_dispatch with no pull_request_target.
Hardened further:
- permissions: issues: write -> contents: read (the action never uses
GITHUB_TOKEN at all; checkout only needs read access, nothing else)
- drop the unused 'master' branch trigger (repo only has main)
- add a concurrency group so overlapping publish runs can't race
- document, inline, why pull_request_target must never be added here and
how the REGISTRY_ACCESS_TOKEN secret is handled (never echoed/logged,
passed only as the action's declared input)
Also adds docs/registry-compatibility-audit.md: a code-only audit (no
README, no template comments) answering the four compatibility questions
for pyproject.toml (min Python version, OS support, GPU/CUDA usage, ComfyUI
min-version API), each with file:line evidence, plus a proposed
pyproject.toml block for manual review. pyproject.toml itself is NOT
touched by this PR.
No secret is configured or requested by this change, and nothing is
published. Node runtime behavior is unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a workflow_dispatch + daily-cron GitHub Action that GETs
https://api.comfy.org/nodes/imagemetahub-comfyui-save and appends an
append-only JSONL record (timestamp, downloads, github_stars, rating,
search_ranking, latest_version, status, plus delta vs the previous
record) to metrics/registry-history.jsonl, then commits it back.
- No external service, no secret, no paid dependency (stdlib urllib + git).
- permissions: contents: write only.
- Bot commit message includes [skip ci] so it cannot trigger other
push-triggered workflows (e.g. the registry publish workflow already
scoped to pyproject.toml changes only).
- Does not touch node runtime behavior.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
LuqP2