Publish workflow (.github/workflows/publish.yml) already existed and was
already push-to-main-only / workflow_dispatch with no pull_request_target.
Hardened further:
- permissions: issues: write -> contents: read (the action never uses
GITHUB_TOKEN at all; checkout only needs read access, nothing else)
- drop the unused 'master' branch trigger (repo only has main)
- add a concurrency group so overlapping publish runs can't race
- document, inline, why pull_request_target must never be added here and
how the REGISTRY_ACCESS_TOKEN secret is handled (never echoed/logged,
passed only as the action's declared input)
Also adds docs/registry-compatibility-audit.md: a code-only audit (no
README, no template comments) answering the four compatibility questions
for pyproject.toml (min Python version, OS support, GPU/CUDA usage, ComfyUI
min-version API), each with file:line evidence, plus a proposed
pyproject.toml block for manual review. pyproject.toml itself is NOT
touched by this PR.
No secret is configured or requested by this change, and nothing is
published. Node runtime behavior is unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
