From 9bb4e9cd54879f7072f14be6560a4b7a54d7d7a8 Mon Sep 17 00:00:00 2001 From: Victor Kuznetsov Date: Tue, 1 Sep 2026 18:00:53 -0700 Subject: [PATCH] Tell a pending ComfyUI upload apart from one that never happened The check read `latest_version` on the node object, which reports only the ACTIVE version. The registry reviews an upload before activating it, so for the length of that review a correctly published version looks exactly like a release that was never synced -- and 0.37.0 hit precisely that: the node repo bumped to 0.1.37 requiring >=0.37.0, the registry accepted it as NodeVersionStatusPending, and the check called it missing. Read the versions list instead and branch on the status: active passes, pending passes while saying so in the summary rather than claiming the node is live, and anything else fails. A missing version still fails hard, which is the case this check exists for. Sort the matches by createdAt rather than trusting the endpoint's current newest-first ordering. Verified against the live registry in all three states: 0.37.0 pending, 0.36.0 active, 0.99.0 absent and erroring. Co-Authored-By: Claude Opus 5 --- .github/workflows/verify-release.yml | 62 +++++++++++++++++++--------- docs/release-and-distribution.md | 20 ++++++--- 2 files changed, 57 insertions(+), 25 deletions(-) diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml index 8578392..c356f0a 100644 --- a/.github/workflows/verify-release.yml +++ b/.github/workflows/verify-release.yml @@ -106,28 +106,52 @@ jobs: run: | set -euo pipefail echo "Checking the ComfyUI Registry node..." - # The registry publishes the node as JSON, including the dependency the - # published version declares. Read that directly instead of proxying - # through the sync workflow's run status: the node repo runs - # sync-library.yml on a daily schedule too, so a green nightly run says - # nothing about whether THIS release was ever synced. - node=$(curl -fsSL "https://api.comfy.org/nodes/remove-ai-watermarks") - echo "$node" | VERSION="$VERSION" python3 -c " + # Read the published versions directly. Do NOT proxy through the sync + # workflow's run status: the node repo runs that workflow on a daily + # schedule too, so a green nightly says nothing about THIS release. + # + # And read the versions list, not `latest_version` on the node object. + # The registry reviews a new upload before activating it, and + # `latest_version` reports only the active one -- so for the whole + # review window a correctly published version looks identical to one + # that was never uploaded. Those are opposite situations: one is a + # queue nobody here controls, the other is a broken release. + versions=$(curl -fsSL "https://api.comfy.org/nodes/remove-ai-watermarks/versions") + status=$(printf '%s' "$versions" | VERSION="$VERSION" python3 -c " import json, os, sys version = os.environ['VERSION'] - latest = json.load(sys.stdin).get('latest_version') or {} - deps = latest.get('dependencies') or [] floor = f'>={version}' - if latest.get('status') != 'NodeVersionStatusActive': - sys.exit(f\"::error::ComfyUI node {latest.get('version')} is {latest.get('status')}, not active\") - if not any(floor in d for d in deps): - sys.exit( - f'::error::ComfyUI node {latest.get(\"version\")} does not require ' - f'{version}; it declares {deps}' - ) - print(f' ComfyUI: node {latest[\"version\"]} requires {version}') - " - echo "- ComfyUI: registry node requires $VERSION" >> "$GITHUB_STEP_SUMMARY" + matches = [ + v for v in json.load(sys.stdin) + if any(floor in d for d in (v.get('dependencies') or [])) + ] + if not matches: + sys.exit(f'::error::No ComfyUI node version requires {version}; the sync never published one') + # Sort rather than trusting the response order: the endpoint happens to + # return newest-first today and nothing documents that it must. + newest = max(matches, key=lambda v: v.get('createdAt') or '') + print(f\"{newest.get('version')} {newest.get('status')}\") + ") + node_version=${status%% *} + node_status=${status##* } + echo " ComfyUI: node $node_version requires $VERSION (status $node_status)" + case "$node_status" in + NodeVersionStatusActive) + echo "- ComfyUI: registry node $node_version requires $VERSION and is live" >> "$GITHUB_STEP_SUMMARY" + ;; + NodeVersionStatusPending) + # Published and waiting on the registry's own review. Say exactly + # that in the summary rather than reporting it as live, and do not + # fail: an external moderation queue going red on every release + # trains everyone to ignore this workflow. + echo "::notice::ComfyUI node $node_version is published and awaiting registry review." + echo "- ComfyUI: registry node $node_version requires $VERSION, awaiting registry activation" >> "$GITHUB_STEP_SUMMARY" + ;; + *) + echo "::error::ComfyUI node $node_version is $node_status" + exit 1 + ;; + esac # -- HF Space ------------------------------------------------------------------- - name: Verify the HF Space serves this release diff --git a/docs/release-and-distribution.md b/docs/release-and-distribution.md index d78c1e3..922c7d0 100644 --- a/docs/release-and-distribution.md +++ b/docs/release-and-distribution.md @@ -137,12 +137,20 @@ After publication, the `verify-release.yml` workflow runs automatically once `distribute.yml` completes and checks every surface below. It can also be dispatched manually with a specific version. Every check fails the job; none of them warns and continues, because a surface nobody can confirm is not a verified -surface. The ComfyUI check reads the published node from the registry's JSON API -(`https://api.comfy.org/nodes/remove-ai-watermarks`) and asserts the active -version declares this library release. It deliberately does NOT proxy through -the sync workflow's run status: the node repository also runs that workflow on a -daily schedule, so a green nightly run says nothing about whether this release -was synced. The full checklist for completeness: +surface, with one deliberate exception noted below. The ComfyUI check reads the +registry's JSON API and asserts that some published node version declares this +library release. It deliberately does NOT proxy through the sync workflow's run +status: the node repository also runs that workflow on a daily schedule, so a +green nightly run says nothing about whether this release was synced. + +Read `/nodes/remove-ai-watermarks/versions`, not `latest_version` on the node +object. The registry reviews an upload before activating it, and +`latest_version` reports only the active version, so during that review window a +correctly published version is indistinguishable from one that was never +uploaded. A new version therefore sits in `NodeVersionStatusPending` for a while +after a release; the check reports that state in the run summary and passes, +because it is the registry's queue rather than an incomplete release. A missing +version, or any other status, fails. The full checklist for completeness: - both wheel and source distribution exist on PyPI; - the package version matches the tag;