ComfyUI to Python Extension

The Problem

ComfyUI lets users compose image‑generation pipelines visually, but moving those pipelines into a reproducible Python script requires manual copying of node names, wiring, and parameter values. The effort is error‑prone and slows down automation, testing, and deployment.

What This Does

ComfyUI-to-Python-Extension reads a ComfyUI workflow JSON file and emits a ready‑to‑run Python script that reproduces the same node graph. The core logic lives in comfyui_to_python.py (workflow parsing, load‑order determination, code generation) and comfyui_to_python_utils.py (helper utilities such as import_custom_nodes, find_path, and sys‑path adjustments). The public API is exposed through __init__.py via the save_as_script function, which ultimately calls the ComfyUItoPython class defined in comfyui_to_python.py.

How It Is Wired

Execution starts at the execute function in comfyui_to_python.py (line 547). Its call chain is:

1. execute → reads the workflow JSON with read_json_file.
2. Determines node load order via determine_load_order, which uses _dfs and _load_special_functions_first.
3. Generates Python source with generate_workflow, which calls: clean_variable_name (used twice), create_function_call_code (twice), * get_class_info, get_function_parameters, update_inputs, assemble_python_code.
4. Writes the produced script to disk through write_code_to_file, which creates the target directory with os.makedirs.

Only write_code_to_file reaches outside the repository (filesystem write). No network or database calls are present.

The internal call graph contains 26 intra‑repo edges. The most connected modules are:

comfyui_to_python is the hub; changes there affect many downstream helpers. No circular dependencies were detected, simplifying refactoring.

File responsibilities (ranked by routing count):

• comfyui_to_python.py – orchestrates the whole conversion, handles I/O, and defines the bulk of the public API.
• comfyui_to_python_utils.py – supplies import handling, path tweaks, and generic helpers.
• __init__.py – thin wrapper exposing save_as_script.
• install.py – auxiliary installer script (writes files without a context manager).
• js/save-as-script.js – UI helper for the browser extension (outside the Python flow).

How To Use It

# Clone the repo (use the exact URL from the spec)
git clone https://github.com/moses-y/ComfyUI-to-Python-Extension
cd ComfyUI-to-Python-Extension

# Install dependencies (pyproject.toml defines the package)
python -m pip install -e .

# Optional: run the helper installer (if you need extra model paths)
python install.py

The primary API is the execute function:

from comfyui_to_python import execute

# Convert a ComfyUI workflow JSON to a Python script
execute(
    workflow_path="path/to/workflow.json",
    output_dir="generated_code"
)

The generated script can be run directly (python generated_code/script.py). No environment variables or external configuration files are required by the core library.

Real‑World Use

A CI pipeline that validates a set of ComfyUI experiments can call execute for each JSON definition, commit the resulting Python scripts, and then run them in parallel on a GPU cluster. The conversion is deterministic, so the same JSON always yields identical Python code, enabling reproducible benchmarking.

- name: Convert workflows
  run: |
    python -c "from comfyui_to_python import execute; \
               execute('tests/exp1.json', 'out/exp1')"

Code Health & Issues

• High – Pin GitHub Actions – .github/workflows/publish.yml uses Comfy-Org/publish-node-action@v1. Replace @v1 with a fixed 40‑character SHA to avoid supply‑chain drift.
• High – Missing lockfile – pyproject.toml declares dependencies without a lockfile. Generate and commit poetry.lock (or requirements.txt from pip freeze) to guarantee reproducible builds.
• Medium – Enable Dependabot/Renovate – No automated version‑bump config; add .github/dependabot.yml for Python and GitHub‑Actions.
• Medium – No vulnerability scan in CI – The workflow lacks a dependency‑review or OSV scanner; add one to block PRs that introduce known‑vulnerable packages.
• Low – No job timeout – publish.yml omits timeout-minutes; set a reasonable bound (e.g., timeout-minutes: 30) to prevent runaway builds.

Additional observations:

• No test suite present; all code paths are untested.
• CI exists (GitHub Actions) but does not cover security or dependency checks.
• License file is included, but the repository lacks a lockfile and any documented secret handling.

The Bottom Line

The extension reliably converts ComfyUI JSON workflows into executable Python scripts, with a clear single‑entry point (execute) and modest code size. However, the lack of tests, an unlocked dependency manifest, and missing security hardening in CI make it risky for production use without remediation. It is best suited for internal tooling or experimentation where rapid prototyping outweighs the need for hardened supply‑chain guarantees.