ci: adopt the shared public-repo-hygiene workflow, drop the in-tree copy

.github/workflows/ci.yml

@@ -93,20 +93,3 @@ jobs:
       - name: Verify distribution metadata (publish dry run)
         run: twine check dist/*
 
-  # NEW -- regression guard for the internal-reference leak this repo already
-  # had once (see scripts/check_public_repo_hygiene.py for what it looks for
-  # and why). Public repo, so this stays a permanent gate, not a one-time fix.
-  public-repo-hygiene:
-    name: public-repo-hygiene
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Scan for internal-only references
-        run: python3 scripts/check_public_repo_hygiene.py

.github/workflows/public-repo-hygiene.yml

@@ -0,0 +1,29 @@
+# Description: Thin caller for the shared public-repo-hygiene reusable workflow
+# in Comfy-Org/github-workflows, which owns the checker AND its known-public
+# allowlist. This replaces the in-tree copy this repo used to carry.
+#
+# Why the checker is not in this repo any more: the old job ran
+# `scripts/check_public_repo_hygiene.py` straight out of the PR's own checkout,
+# so a PR could widen the allowlist — or disable the scan — and go green. The
+# reusable loads the checker from the pinned `workflows_ref` commit instead, so
+# a PR here cannot reach it through this workflow's inputs. The allowlist is
+# deliberately NOT an input, for the same reason.
+#
+# The pin is kept fresh by bump-public-repo-hygiene-callers.yml once this repo is
+# enrolled in the PUBLIC_REPO_HYGIENE_CALLERS roster.
+name: Public Repo Hygiene
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  hygiene:
+    permissions:
+      contents: read
+    uses: Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml@aad06972e20732d6a9167552c5b3247c4f5bac58 # github-workflows main (aad0697)
+    with:
+      # REQUIRED, and must equal the `uses:` SHA above — the reusable asserts
+      # they match, which is what pins the checker to the reviewed commit.
+      workflows_ref: aad06972e20732d6a9167552c5b3247c4f5bac58

AGENTS.md

@@ -100,12 +100,40 @@ for `py310`. Anything newer than 3.10 syntax breaks a quarter of the matrix.
 
 ### `public-repo-hygiene`
 
-This repo is public. [`scripts/check_public_repo_hygiene.py`](scripts/check_public_repo_hygiene.py)
-scans every git-tracked file (except its own source and
-`src/comfy_low/models/`) and fails on three categories:
+This repo is public. [`.github/workflows/public-repo-hygiene.yml`](.github/workflows/public-repo-hygiene.yml)
+is a thin caller into the shared reusable workflow in `Comfy-Org/github-workflows`,
+which owns both the checker and its known-public allowlist — this repo used to
+carry its own copy of the checker (`scripts/check_public_repo_hygiene.py`), but
+that let a PR widen the allowlist or disable the scan and still go green. The
+reusable loads the checker from a pinned `workflows_ref` commit instead, so a
+PR here cannot reach it through this workflow's inputs.
+
+**What the pin does and does not buy.** `workflows_ref` binds the checker to the
+commit the caller's own `uses:` line selected — the reusable asserts the two
+match, and that is all it asserts. A `pull_request` run executes the workflow
+file from the PR head, so a PR that rewrites *both* the `uses:` SHA and
+`workflows_ref` (or replaces the caller job outright) still satisfies that
+equality check while running a checker of its own choosing. That is true of
+every reusable workflow on GitHub, not a quirk of this one.
+
+The control for it is out of band, and it is a branch-protection setting rather
+than a file in this repo: `main` requires an approving **code-owner** review and
+dismisses stale approvals on every new push, so a change under
+`.github/workflows/` cannot land on its author's say-so.
+[`.github/CODEOWNERS`](.github/CODEOWNERS) owns `*`, which is what puts the
+workflow directory under that requirement — but CODEOWNERS *alone* enforces
+nothing, it only names reviewers. The rule is not absolute either: it is not
+enforced for administrators. Relax the branch-protection setting and the pin's
+guarantee relaxes with it, silently.
+
+The job runs from its own workflow file, not `ci.yml`, so the status-check
+context it reports is `hygiene / public-repo-hygiene`.
+
+The checker scans every git-tracked file (except `src/comfy_low/models/`) and
+fails on three categories:
 
 1. **Ticket-shaped identifiers** — anything matching `[A-Z]{2,6}-\d{2,6}`.
-   Common tech acronyms are handled by an explicit allowlist in the script.
+   Common tech acronyms are handled by an explicit allowlist.
 2. **Internal collaboration-tool links/markers** — Notion, Slack archive and
    client links, Google Docs/Drive, Datadog, PostHog project links, Linear, and
    `incident-<n>` strings.
@@ -116,14 +144,8 @@ scans every git-tracked file (except its own source and
 Practical consequence: **do not paste internal context into code comments,
 docstrings, commit-adjacent docs, or test fixtures.** Describe *why* in plain
 prose instead of linking to where the discussion happened. If a flag is a
-genuine false positive, extend the allowlist in the script with a comment
-explaining why — do not loosen the regex.
-
-Run it locally with plain Python; it needs no dependencies:
-
-```bash
-python3 scripts/check_public_repo_hygiene.py
-```
+genuine false positive, the allowlist lives in `Comfy-Org/github-workflows`,
+not this repo — file the fix there.
 
 ### `build-check`
 

CHANGELOG.md

@@ -178,10 +178,10 @@ Maintenance release. No API changes — existing code needs no updates.
   empty package metadata.
 - Stop sweeping local dev droppings into the sdist — it now contains only what is
   needed to build and run the tests.
-- The repository moved from `Comfy-Org/ComfyPythonSDK` to
-  `Comfy-Org/comfy-python-sdk`. GitHub redirects the old URLs and the PyPI
-  package name is unchanged (`comfy-sdk`). This is the first release to carry
-  the corrected repository/issues URLs in its published metadata.
+- The repository moved from `ComfyPythonSDK` to `Comfy-Org/comfy-python-sdk`.
+  GitHub redirects the old URLs and the PyPI package name is unchanged
+  (`comfy-sdk`). This is the first release to carry the corrected
+  repository/issues URLs in its published metadata.
 - Docstrings for the public methods that had none; README aligned with the
   TypeScript and Swift SDK READMEs.
 

CONTRIBUTING.md

@@ -56,9 +56,11 @@ CI runs two more jobs beyond the four above:
 
 - **`build-check`** — builds the sdist and wheel and runs `twine check`, so a
   broken distribution is caught in PR CI instead of at release time.
-- **`public-repo-hygiene`** — `python3 scripts/check_public_repo_hygiene.py`
-  scans for internal-only references. This is a public repo; the check is a
-  permanent gate, not a one-time cleanup.
+- **`public-repo-hygiene`** — a thin caller into the shared reusable workflow
+  in `Comfy-Org/github-workflows`, which scans for internal-only references.
+  This is a public repo; the check is a permanent gate, not a one-time
+  cleanup. It lives in its own workflow file rather than `ci.yml`, so it
+  reports as `hygiene / public-repo-hygiene`. See AGENTS.md for details.
 
 ## The codegen trap: `src/comfy_low/models/_generated.py`