Repo Improvement Sweep: comfy-cli — 2026-08-17

Repo improvement sweep, 2026-08-17. Findings below are filed as separate issues and linked back here.

## Profile

**mature** — 695 commits, created 2024-04-14, 45 contributors, 30 published releases, 91 closed bug issues, 51.8k lines of Python across 283 files with 151 test files. This repo got the full mature lens set, unlike the five greenfield repos swept alongside it.

## Findings

- [ ] #724 — Enable branch protection — 13 workflows, none of them required `critical` `trivial`
- [ ] #725 — `tar.extractall()` runs with the extraction filter disabled on both paths `recommended` `medium`
- [ ] #726 — `execute` (complexity 48) and `execute_cloud` (44) in `command/run/__init__.py` `recommended` `large`
- [ ] #727 — Widen the ruff ruleset — `B` and `S` are off and surface 350+ real hits `recommended` `medium`
- [ ] #728 — 23 blocks of commented-out code, half of them in one file `recommended` `small`
- [ ] #729 — Add CONTRIBUTING.md `recommended` `small`
- [ ] #730 — Add a CHANGELOG `nice-to-have` `small`

## Lenses run

`repo-audit`, `repo-hygiene-audit`, `audit-code`, `improve-codebase-architecture`

## Lenses skipped

| Lens | Reason |
| --- | --- |
| `fallow-risk-cleanup` | TypeScript/JS only — this is a Python repo |
| `closed-bug-regression-audit` | Deferred, not skipped for lack of signal: 91 closed bugs is the largest regression-audit surface of the six repos and deserves its own pass rather than a corner of a config sweep |
| `repo-doc-audit` | It rewrites docs — belongs in its own PR, not a filing sweep |

Recorded here rather than only in chat: six months from now this is the only record of whether a gap was checked-and-clear or never looked at.

## Deliberately not filed

- **`yaml.load` at `command/generate/spec.py:288,520` is a false positive.** Ruff's `S506` flags `_YamlLoader` as unsafe, but it subclasses `yaml.SafeLoader` and only strips YAML 1.1's `on`/`off`/`yes`/`no` bool aliases. Not a deserialization risk. Deliberately not filed.
- **`S105 hardcoded-password-string` (7 hits) are variable-name matches, not credentials.** No committed `.env` or key material found.
- **CI coverage is good** — pytest, ruff, build-and-test, mac/windows/GPU matrices, CLA, AGENTS.md integrity. The gap is that none of it is required, which is filed separately.
- Issue templates, Dependabot config, pre-commit hooks, `AGENTS.md`, `CLAUDE.md`, LICENSE and repo topics are all already present — not filed.

_Filed by the `repo-improvement-sweep` skill._