feat(publication): support scheduled ComfyUI candidates

kiyi commented

2026-09-23 19:19:21 -05:00

Member

ComfyUI weekly checks currently stop at a source PR because image and bundle publication require owner dispatch. This adds an opt-in candidate mode for Homelab/Comfy-UI while retaining manual deployment. It verifies the original scheduled/manual run on protected main, the immutable kiyi source commit, permitted file changes, unchanged upstream identities, and image-only manifest changes. Existing callers remain on the owner-dispatch default; scans, signing and exact mitigations remain required.

Requested in Homelab/Comfy-UI#1: automatically publish weekly candidates, support the same update-only check from Run workflow, and notify through existing Forgejo watch/email settings.

Validation: full Linux suite, 188 tests, passed with one existing skip; git diff --check passed. Tests cover provenance tampering, stale/unprotected main, unauthorized events/actors, default behavior, actual Git snapshots, and rejection of source-identity/deployment changes.

Release order: review/merge, publish the next unused minor release (proposed v1.16.0), then merge the paired ComfyUI caller. Live candidate publication and email delivery remain unverified.

ComfyUI weekly checks currently stop at a source PR because image and bundle publication require owner dispatch. This adds an opt-in candidate mode for Homelab/Comfy-UI while retaining manual deployment. It verifies the original scheduled/manual run on protected main, the immutable kiyi source commit, permitted file changes, unchanged upstream identities, and image-only manifest changes. Existing callers remain on the owner-dispatch default; scans, signing and exact mitigations remain required. Requested in Homelab/Comfy-UI#1: automatically publish weekly candidates, support the same update-only check from Run workflow, and notify through existing Forgejo watch/email settings. Validation: full Linux suite, 188 tests, passed with one existing skip; git diff --check passed. Tests cover provenance tampering, stale/unprotected main, unauthorized events/actors, default behavior, actual Git snapshots, and rejection of source-identity/deployment changes. Release order: review/merge, publish the next unused minor release (proposed v1.16.0), then merge the paired ComfyUI caller. Live candidate publication and email delivery remain unverified.

kiyi added 1 commit

2026-09-23 19:19:21 -05:00

feat(publication): support scheduled ComfyUI candidates

Workflow acceptance / acceptance (pull_request) Successful in 2m51s

Details

Library checks / tests (pull_request) Successful in 4m7s

Details

Repository security / security-1 (pull_request) Successful in 8m57s

Details

Repository security / security (pull_request) Successful in 0s

Details

fe278024d4