Require Manager clone gate before Registry publish

tests/test_publish_release.py

@@ -0,0 +1,58 @@
+from pathlib import Path
+
+import pytest
+
+from tools import publish_registry_release
+
+
+def test_publish_stops_before_registry_when_manager_gate_fails(monkeypatch, tmp_path):
+    calls = []
+
+    def fail_gate(source):
+        raise RuntimeError("public clone failed")
+
+    monkeypatch.setattr(publish_registry_release, "verify_manager_install", fail_gate)
+    monkeypatch.setattr(
+        publish_registry_release.subprocess,
+        "run",
+        lambda *args, **kwargs: calls.append((args, kwargs)),
+    )
+
+    with pytest.raises(RuntimeError, match="public clone failed"):
+        publish_registry_release.publish_release(
+            tmp_path,
+            comfy="comfy",
+            token="private-token",
+            changelog="release",
+        )
+    assert calls == []
+
+
+def test_publish_keeps_token_out_of_arguments_and_environment(monkeypatch, tmp_path):
+    calls = []
+    monkeypatch.setattr(
+        publish_registry_release,
+        "verify_manager_install",
+        lambda source: ("1.0.3", "https://example.test/owner/repo", "abc123"),
+    )
+
+    def record_run(command, **kwargs):
+        calls.append((command, kwargs))
+
+    monkeypatch.setattr(publish_registry_release.subprocess, "run", record_run)
+    publish_registry_release.publish_release(
+        Path(tmp_path),
+        comfy="comfy",
+        token="private-token",
+        changelog="release notes",
+    )
+
+    assert [command for command, _ in calls] == [
+        ["comfy", "node", "validate"],
+        ["comfy", "node", "publish"],
+    ]
+    publish_kwargs = calls[1][1]
+    assert publish_kwargs["input"] == "private-token\n"
+    assert "private-token" not in repr(calls[1][0])
+    assert "private-token" not in repr(publish_kwargs["env"])
+    assert publish_kwargs["env"]["COMFY_NODE_CHANGELOG"] == "release notes"