[PR #211] [MERGED] Add comfy-mcp and comfy-complete to the public-repo-hygiene allowlist #219

New issue

Closed

opened 2026-10-26 22:37:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:37:28 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/211
Author: @claude[bot]
Created: 8/22/2026
Status: ✅ Merged
Merged: 8/22/2026
Merged by: @mattmillerai

Base: main ← Head: allowlist/comfy-mcp-comfy-complete

📝 Commits (1)

7d0dbef feat(public-repo-hygiene): allowlist comfy-mcp and comfy-complete

📊 Changes

1 file changed (+9 additions, -0 deletions)

View changed files

📝 .github/public-repo-hygiene/check_public_repo_hygiene.py (+9 -0)

📄 Description

Requested by Matt Miller · Slack thread

What

Adds comfy-mcp and comfy-complete to PUBLIC_COMFY_ORG_REPOS in
.github/public-repo-hygiene/check_public_repo_hygiene.py, the org-wide
known-public repo allowlist behind the public-repo-hygiene.yml reusable
workflow.

Why

Both repos are genuinely public and were confirmed independently:

Comfy-Org/comfy-mcp — GET https://api.github.com/repos/Comfy-Org/comfy-mcp
returns "private": false.
Comfy-Org/comfy-complete — an unauthenticated
GET https://raw.githubusercontent.com/Comfy-Org/comfy-complete/main/README.md
(and /master/README.md) returns 200 with real README content — only
possible for a public repo.

Without the allowlist entries, the hygiene checker's default-deny rule flags
any Comfy-Org/comfy-mcp or Comfy-Org/comfy-complete reference as a
possible internal-only leak, which is a false positive here:

comfy-mcp references itself in its own README, CI comments, and issue
templates — self-references that became findings the moment comfy-mcp
adopted the public-repo-hygiene caller workflow (comfy-mcp#254).
comfy-complete is referenced from comfy-cli's
.github/workflows/refresh-cql-catalogs.yml, which became a finding when
comfy-cli adopted the same caller workflow (comfy-cli#758).

Both PRs are currently blocked on these false-positive hygiene-check
failures. Adding the two names here — the single org-wide edit point per the
workflow's own docs (docs/callers/public-repo-hygiene.md) — unblocks both
without weakening the default-deny control (the allowlist stays a
reviewed, non-caller-editable list of confirmed-public names only).

Testing

python3 -m unittest discover -s .github/public-repo-hygiene/tests -p 'test_*.py' — 115 tests, all pass.

No other changes.

Generated by Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/211 **Author:** [@claude[bot]](https://github.com/apps/claude) **Created:** 8/22/2026 **Status:** ✅ Merged **Merged:** 8/22/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `allowlist/comfy-mcp-comfy-complete` --- ### 📝 Commits (1) - [`7d0dbef`](https://github.com/Comfy-Org/github-workflows/commit/7d0dbef8610c1bb4620a1091668e2b7836d54538) feat(public-repo-hygiene): allowlist comfy-mcp and comfy-complete ### 📊 Changes **1 file changed** (+9 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/public-repo-hygiene/check_public_repo_hygiene.py` (+9 -0) </details> ### 📄 Description  _Requested by **Matt Miller** · [Slack thread](https://comfy-organization.slack.com/archives/C0BD6BR53QX/p1787439508587399?thread_ts=1787439508.587399&cid=C0BD6BR53QX)_ ## What Adds `comfy-mcp` and `comfy-complete` to `PUBLIC_COMFY_ORG_REPOS` in `.github/public-repo-hygiene/check_public_repo_hygiene.py`, the org-wide known-public repo allowlist behind the `public-repo-hygiene.yml` reusable workflow. ## Why Both repos are genuinely public and were confirmed independently: - **`Comfy-Org/comfy-mcp`** — `GET https://api.github.com/repos/Comfy-Org/comfy-mcp` returns `"private": false`. - **`Comfy-Org/comfy-complete`** — an unauthenticated `GET https://raw.githubusercontent.com/Comfy-Org/comfy-complete/main/README.md` (and `/master/README.md`) returns `200` with real README content — only possible for a public repo. Without the allowlist entries, the hygiene checker's default-deny rule flags any `Comfy-Org/comfy-mcp` or `Comfy-Org/comfy-complete` reference as a possible internal-only leak, which is a false positive here: - `comfy-mcp` references itself in its own README, CI comments, and issue templates — self-references that became findings the moment `comfy-mcp` adopted the `public-repo-hygiene` caller workflow (comfy-mcp#254). - `comfy-complete` is referenced from comfy-cli's `.github/workflows/refresh-cql-catalogs.yml`, which became a finding when `comfy-cli` adopted the same caller workflow (comfy-cli#758). Both PRs are currently blocked on these false-positive hygiene-check failures. Adding the two names here — the single org-wide edit point per the workflow's own docs (`docs/callers/public-repo-hygiene.md`) — unblocks both without weakening the default-deny control (the allowlist stays a reviewed, non-caller-editable list of confirmed-public names only). ## Testing `python3 -m unittest discover -s .github/public-repo-hygiene/tests -p 'test_*.py'` — 115 tests, all pass. No other changes. --- _Generated by [Claude Code](https://claude.ai/code/session_01HAnJzLdAQ8be9R3cKzfJFr)_ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:37:28 +00:00