LuqP2andClaude Sonnet 5
e9d210ee45
Publish workflow (.github/workflows/publish.yml) already existed and was already push-to-main-only / workflow_dispatch with no pull_request_target. Hardened further: - permissions: issues: write -> contents: read (the action never uses GITHUB_TOKEN at all; checkout only needs read access, nothing else) - drop the unused 'master' branch trigger (repo only has main) - add a concurrency group so overlapping publish runs can't race - document, inline, why pull_request_target must never be added here and how the REGISTRY_ACCESS_TOKEN secret is handled (never echoed/logged, passed only as the action's declared input) Also adds docs/registry-compatibility-audit.md: a code-only audit (no README, no template comments) answering the four compatibility questions for pyproject.toml (min Python version, OS support, GPU/CUDA usage, ComfyUI min-version API), each with file:line evidence, plus a proposed pyproject.toml block for manual review. pyproject.toml itself is NOT touched by this PR. No secret is configured or requested by this change, and nothing is published. Node runtime behavior is unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
name: Publish to Comfy registry
|
|
|
|
# Publishes this node to the ComfyUI Registry using Comfy-Org/publish-node-action.
|
|
#
|
|
# Security notes:
|
|
# - Trigger is intentionally push-to-main (paths: pyproject.toml) or manual
|
|
# workflow_dispatch ONLY. Never pull_request_target: that trigger runs with
|
|
# this repo's secrets against a PR head from a fork, which would hand
|
|
# REGISTRY_ACCESS_TOKEN to any third-party PR author. Do not add it.
|
|
# - REGISTRY_ACCESS_TOKEN is passed only as the action's declared input; it is
|
|
# never echoed, printed, or exported to a shell step. GitHub Actions masks
|
|
# the literal secret value in all logs regardless.
|
|
# - GITHUB_TOKEN permissions are minimal: read-only, and only what
|
|
# actions/checkout needs to fetch the repo. The publish step itself does not
|
|
# use GITHUB_TOKEN at all — it authenticates to the Registry solely with
|
|
# REGISTRY_ACCESS_TOKEN.
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "pyproject.toml"
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: publish-to-registry
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish-node:
|
|
name: Publish Custom Node to registry
|
|
runs-on: ubuntu-latest
|
|
# Belt-and-suspenders: even if this workflow file were ever present on a
|
|
# fork, publishing only ever runs in the canonical repo.
|
|
if: ${{ github.repository_owner == 'LuqP2' }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v4
|
|
with:
|
|
submodules: true
|
|
|
|
- name: Publish Custom Node
|
|
uses: Comfy-Org/publish-node-action@v1
|
|
with:
|
|
# Configure this once in Settings -> Secrets and variables -> Actions.
|
|
# Never place the token value directly in this file.
|
|
personal_access_token: ${{ secrets.REGISTRY_ACCESS_TOKEN }}
|