An App private key is not scoped: it can mint tokens for every repo its
App is installed on, with the App's full entitlement. The owner and
repositories inputs are step arguments, not a boundary.
cloud-code-bot is entitled to cloud's production release and migration
workflows, so storing its key in this public repo would join the two
repos' trust boundaries at the weaker one. Use a single-purpose App
holding only contents:write on Comfy-Org/cloud instead -- the same
minimal scope the outgoing PAT had, without the silent expiry.
FEN_RELEASE_* are environment secrets on the 'backport release'
environment, which is gated on required reviewers. A tag dispatch must
not wait on a human approval, so that environment is not usable here.
cloud-code-bot already authors the bump PRs on the cloud side, so its
write access to Comfy-Org/cloud is established.
The PAT behind CLOUD_REPO_DISPATCH_TOKEN was regenerated without the
Actions secret being updated, so the stored copy went stale. Every tag
from v0.25.0 through v0.29.0 returned 401 and opened no cloud bump PR,
which went unnoticed for six weeks because the bumps were filed by hand.
Mint an installation token per run instead, scoped to Comfy-Org/cloud,
so there is no stored credential left to drift or expire.
* Add Spectral lint CI gate for openapi.yaml
Adds a blocking Spectral lint check that runs on PRs touching
openapi.yaml or the ruleset itself. The ruleset mirrors the one used
for other Comfy-Org service specs: spectral:oas plus conventions for
snake_case properties, camelCase operationIds, and response/schema
shape. Gate runs at --fail-severity=error, which the spec currently
passes with zero errors (a small number of non-blocking
warnings/hints remain for WebSocket 101 responses, the existing loose
error schema, and two snake_case wire fields).
* ci: set least-privilege contents:read permissions on openapi-lint workflow
Per CodeRabbit review on #13410. The job only checks out the repo and
runs Spectral, so contents:read is sufficient and avoids inheriting any
permissive repo/org default token scope.
---------
Co-authored-by: guill <jacob.e.segal@gmail.com>
Fires on v* tag push (earlier than release.published, which can lag)
and triggers a repository_dispatch on Comfy-Org/cloud with event_type
comfyui_tag_pushed. Legacy desktop dispatch in release-webhook.yml
is left untouched.
Add a GitHub Actions workflow and shell script that scan all commits
in a pull request for Co-authored-by trailers from known AI coding
agents (Claude, Cursor, Copilot, Codex, Aider, Devin, Gemini, Jules,
Windsurf, Cline, Amazon Q, Continue, OpenCode, etc.).
The check fails with clear instructions on how to remove the trailers
via interactive rebase.
* feat: add CI container version bump automation
Adds a workflow that triggers on releases to create PRs in the
comfyui-ci-container repo, updating the ComfyUI version in the Dockerfile.
Supports both release events and manual workflow dispatch for testing.
* feat: add CI container version bump automation
Adds a workflow that triggers on releases to create PRs in the
comfyui-ci-container repo, updating the ComfyUI version in the Dockerfile.
Supports both release events and manual workflow dispatch for testing.
* ci: update CI container repository owner
* refactor: rename `update-ci-container.yaml` workflow to `update-ci-container.yml`
* Remove post-merge instructions from the CI container update workflow.
