Tell a pending ComfyUI upload apart from one that never happened

The check read `latest_version` on the node object, which reports only the
ACTIVE version. The registry reviews an upload before activating it, so for the
length of that review a correctly published version looks exactly like a release
that was never synced -- and 0.37.0 hit precisely that: the node repo bumped to
0.1.37 requiring >=0.37.0, the registry accepted it as
NodeVersionStatusPending, and the check called it missing.

Read the versions list instead and branch on the status: active passes, pending
passes while saying so in the summary rather than claiming the node is live, and
anything else fails. A missing version still fails hard, which is the case this
check exists for. Sort the matches by createdAt rather than trusting the
endpoint's current newest-first ordering.

Verified against the live registry in all three states: 0.37.0 pending, 0.36.0
active, 0.99.0 absent and erroring.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/verify-release.yml

@@ -106,28 +106,52 @@ jobs:
         run: |
           set -euo pipefail
           echo "Checking the ComfyUI Registry node..."
-          # The registry publishes the node as JSON, including the dependency the
-          # published version declares. Read that directly instead of proxying
-          # through the sync workflow's run status: the node repo runs
-          # sync-library.yml on a daily schedule too, so a green nightly run says
-          # nothing about whether THIS release was ever synced.
-          node=$(curl -fsSL "https://api.comfy.org/nodes/remove-ai-watermarks")
-          echo "$node" | VERSION="$VERSION" python3 -c "
+          # Read the published versions directly. Do NOT proxy through the sync
+          # workflow's run status: the node repo runs that workflow on a daily
+          # schedule too, so a green nightly says nothing about THIS release.
+          #
+          # And read the versions list, not `latest_version` on the node object.
+          # The registry reviews a new upload before activating it, and
+          # `latest_version` reports only the active one -- so for the whole
+          # review window a correctly published version looks identical to one
+          # that was never uploaded. Those are opposite situations: one is a
+          # queue nobody here controls, the other is a broken release.
+          versions=$(curl -fsSL "https://api.comfy.org/nodes/remove-ai-watermarks/versions")
+          status=$(printf '%s' "$versions" | VERSION="$VERSION" python3 -c "
           import json, os, sys
           version = os.environ['VERSION']
-          latest = json.load(sys.stdin).get('latest_version') or {}
-          deps = latest.get('dependencies') or []
           floor = f'>={version}'
-          if latest.get('status') != 'NodeVersionStatusActive':
-              sys.exit(f\"::error::ComfyUI node {latest.get('version')} is {latest.get('status')}, not active\")
-          if not any(floor in d for d in deps):
-              sys.exit(
-                  f'::error::ComfyUI node {latest.get(\"version\")} does not require '
-                  f'{version}; it declares {deps}'
-              )
-          print(f'  ComfyUI: node {latest[\"version\"]} requires {version}')
-          "
-          echo "- ComfyUI: registry node requires $VERSION" >> "$GITHUB_STEP_SUMMARY"
+          matches = [
+              v for v in json.load(sys.stdin)
+              if any(floor in d for d in (v.get('dependencies') or []))
+          ]
+          if not matches:
+              sys.exit(f'::error::No ComfyUI node version requires {version}; the sync never published one')
+          # Sort rather than trusting the response order: the endpoint happens to
+          # return newest-first today and nothing documents that it must.
+          newest = max(matches, key=lambda v: v.get('createdAt') or '')
+          print(f\"{newest.get('version')} {newest.get('status')}\")
+          ")
+          node_version=${status%% *}
+          node_status=${status##* }
+          echo "  ComfyUI: node $node_version requires $VERSION (status $node_status)"
+          case "$node_status" in
+            NodeVersionStatusActive)
+              echo "- ComfyUI: registry node $node_version requires $VERSION and is live" >> "$GITHUB_STEP_SUMMARY"
+              ;;
+            NodeVersionStatusPending)
+              # Published and waiting on the registry's own review. Say exactly
+              # that in the summary rather than reporting it as live, and do not
+              # fail: an external moderation queue going red on every release
+              # trains everyone to ignore this workflow.
+              echo "::notice::ComfyUI node $node_version is published and awaiting registry review."
+              echo "- ComfyUI: registry node $node_version requires $VERSION, awaiting registry activation" >> "$GITHUB_STEP_SUMMARY"
+              ;;
+            *)
+              echo "::error::ComfyUI node $node_version is $node_status"
+              exit 1
+              ;;
+          esac
 
       # -- HF Space -------------------------------------------------------------------
       - name: Verify the HF Space serves this release

docs/release-and-distribution.md

@@ -137,12 +137,20 @@ After publication, the `verify-release.yml` workflow runs automatically once
 `distribute.yml` completes and checks every surface below. It can also be
 dispatched manually with a specific version. Every check fails the job; none of
 them warns and continues, because a surface nobody can confirm is not a verified
-surface. The ComfyUI check reads the published node from the registry's JSON API
-(`https://api.comfy.org/nodes/remove-ai-watermarks`) and asserts the active
-version declares this library release. It deliberately does NOT proxy through
-the sync workflow's run status: the node repository also runs that workflow on a
-daily schedule, so a green nightly run says nothing about whether this release
-was synced. The full checklist for completeness:
+surface, with one deliberate exception noted below. The ComfyUI check reads the
+registry's JSON API and asserts that some published node version declares this
+library release. It deliberately does NOT proxy through the sync workflow's run
+status: the node repository also runs that workflow on a daily schedule, so a
+green nightly run says nothing about whether this release was synced.
+
+Read `/nodes/remove-ai-watermarks/versions`, not `latest_version` on the node
+object. The registry reviews an upload before activating it, and
+`latest_version` reports only the active version, so during that review window a
+correctly published version is indistinguishable from one that was never
+uploaded. A new version therefore sits in `NodeVersionStatusPending` for a while
+after a release; the check reports that state in the run summary and passes,
+because it is the registry's queue rather than an incomplete release. A missing
+version, or any other status, fails. The full checklist for completeness:
 
 - both wheel and source distribution exist on PyPI;
 - the package version matches the tag;