feat(apps): find out when an app has fallen behind upstream

Nodes offer an update when the signed catalog pins something newer than
what's running, and that machinery is fine. The missing step was the one
before it: nothing told *us* when upstream shipped. A pin could sit at
fedimintd v0.10.0 for months while every node in the fleet correctly and
confidently reported "up to date".

The reason nothing could tell us is that a manifest records only our
mirror — `source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0`
says nothing about the project it was mirrored from. So this adds an
optional `app.upstream` block naming the real source, and a script that
asks each one what it has released.

Running it answers the question that prompted this. Of 58 apps, 28 are
behind, including LND v0.18.4-beta against v0.21.2-beta, Bitcoin Core
28.4 against 31.1, and fedimintd/gatewayd v0.10.0 against v0.10.1.

Two choices worth stating. An app with no `upstream` block is reported
as UNTRACKED rather than skipped — a silent skip is how this stayed
invisible, and before this commit all 58 were silently skipped. And a
suggestion prefers our own tag variant: telling someone pinned to
`postgres:16.13-alpine` that the newest tag is `18.6-trixie` is true and
useless, because swapping the base image is a different decision from
bumping a version.

Five apps are deliberately left untracked (barkd, immich-postgres,
indeedhub-minio, lightning-stack, pine-whisper): I could not establish
their upstream with confidence, and a wrong `repo` produces a confident
wrong verdict, which is worse than an honest gap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/aiui/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: aiui
   name: AI Assistant
   version: 0.1.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: Conversational AI interface for Archipelago. Quarantined — communicates only via context broker.
   internal: true  # System-managed, not shown in App Store
 

apps/alby-hub/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: alby-hub
   name: Alby Hub
   version: 1.23.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: getAlby/hub
   description: Self-custodial Lightning wallet hub. Runs its own Lightning node on your Archipelago and connects your apps to it over Nostr Wallet Connect — one hub, every app pays through it.
   category: money
 

apps/archy-btcpay-db/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: archy-btcpay-db
   name: BTCPay Postgres
   version: "15.17"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: dockerhub
+    repo: library/postgres
   description: Postgres backend for BTCPay and NBXplorer.
 
   container:

apps/archy-mempool-db/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: archy-mempool-db
   name: Mempool MariaDB
   version: 11.4.10
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: dockerhub
+    repo: library/mariadb
   description: MariaDB backend for the mempool explorer stack.
 
   container:

apps/archy-mempool-web/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: archy-mempool-web
   name: Mempool Web
   version: 3.0.1
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: mempool/mempool
   description: Frontend web UI for mempool explorer.
   container_name: mempool
 

apps/archy-nbxplorer/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: archy-nbxplorer
   name: NBXplorer
   version: 2.6.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: dgarage/NBXplorer
   description: BTCPay blockchain indexer service.
 
   container:

apps/bitcoin-core/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: bitcoin-core
   name: Bitcoin Core
   version: 28.4.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: bitcoin/bitcoin
   description: Reference Bitcoin Core node with dynamic prune/full-mode startup based on host disk.
 
   container_name: bitcoin-core

apps/bitcoin-knots/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: bitcoin-knots
   name: Bitcoin Knots
   version: 28.1.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: bitcoinknots/bitcoin
   description: Full Bitcoin Knots node with dynamic prune/full-mode startup based on host disk.
 
   container_name: bitcoin-knots

apps/bitcoin-ui/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: bitcoin-ui
   name: Bitcoin UI
   version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: |
     Archipelago-native HTTP proxy + static site for interacting with the
     Bitcoin Core / Bitcoin Knots JSON-RPC. Runs nginx inside a container

apps/botfights/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: botfights
   name: BotFights
   version: 1.2.11
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 

apps/btcpay-server/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: btcpay-server
   name: BTCPay Server
   version: 2.4.2
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: btcpayserver/btcpayserver
   description: Self-hosted Bitcoin payment processor. Accept Bitcoin payments without intermediaries.
 
   container:

apps/core-lightning/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: core-lightning
   name: Core Lightning (CLN)
   version: 23.08.2
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: ElementsProject/lightning
   description: Lightning Network implementation in C. Lightweight alternative to LND.
   
   container:

apps/did-wallet/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: did-wallet
   name: Web5 DID Wallet
   version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: Web5 wallet with Decentralized Identifier (DID) support. Manage your digital identity and Web5 assets.
   
   container:

apps/electrs-ui/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: electrs-ui
   name: Electrs UI
   version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: |
     Archipelago-native HTTP frontend for electrs/electrumx status. Runs
     nginx inside a container, serves static assets, and proxies

apps/electrumx/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: electrumx
   name: ElectrumX
   version: 1.18.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: spesmilo/electrumx
   description: Electrum server indexing Bitcoin chain data for lightweight wallet queries.
 
   container:

apps/fedimint-clientd/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: fedimint-clientd
   name: Fedimint Client
   version: 0.8.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: fedimint/fedimint-clientd
   description: Fedimint ecash client daemon (fmcd). Lets the node hold Fedimint ecash and join federations; the wallet talks to it over a local REST API.
 
   container:

apps/fedimint-gateway/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: fedimint-gateway
   name: Fedimint Gateway
   version: 0.10.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: fedimint/fedimint
   description: Fedimint gateway service with automatic LND-or-LDK backend selection.
 
   container:

apps/fedimint/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: fedimint
   name: Fedimint Guardian
   version: 0.10.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: fedimint/fedimint
   description: Federated Bitcoin minting service with built-in Guardian UI. Privacy-preserving Bitcoin custody.
 
   container:

apps/filebrowser/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: filebrowser
   name: File Browser
   version: 2.27.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: filebrowser/filebrowser
   description: Baseline Archipelago file manager service.
 
   container:

apps/fips-ui/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: fips-ui
   name: FIPS Mesh
   version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: |
     Archipelago-native dashboard for the FIPS mesh transport. Runs nginx
     inside a container with host networking, serves a static dashboard on

apps/gitea/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: gitea
   name: Gitea
   version: "1.23"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: go-gitea/gitea
   description: Self-hosted Git service with built-in container registry, CI/CD, and package hosting.
   category: development
 

apps/grafana/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: grafana
   name: Grafana
   version: 10.2.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: grafana/grafana
   description: Analytics and monitoring platform. Visualize metrics and create dashboards.
   
   container:

apps/home-assistant/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: homeassistant
   name: Home Assistant
   version: 2026.7.3
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: home-assistant/core
   description: Open source home automation platform. Control and monitor your smart home devices.
   
   container:

apps/immich-redis/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: immich-redis
   name: Immich Redis
   version: "7-alpine"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: dockerhub
+    repo: valkey/valkey
   description: Valkey (Redis-compatible) cache for Immich.
 
   # Container named immich_redis (underscore) to match runtime per-app references

apps/immich/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: immich
   name: Immich
   version: "2.7.4"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: immich-app/immich
   description: Self-hosted photo and video backup with mobile apps and search.
 
   # app_id "immich" = the user-facing launcher (matches the catalog entry's title

apps/indeedhub-api/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: indeedhub-api
   name: IndeedHub API
   version: "1.0.0"
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: IndeedHub backend API (Nostr auth, media, payments).
   category: community
 

apps/indeedhub-ffmpeg/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: indeedhub-ffmpeg
   name: IndeedHub FFmpeg Worker
   version: "1.0.0"
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: IndeedHub background media transcoding worker.
   category: community
 

apps/indeedhub-postgres/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: indeedhub-postgres
   name: IndeedHub Postgres
   version: "16.13-alpine"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: dockerhub
+    repo: library/postgres
   description: Postgres database backend for IndeedHub.
   category: community
 

apps/indeedhub-redis/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: indeedhub-redis
   name: IndeedHub Redis
   version: "7.4.8-alpine"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: dockerhub
+    repo: library/redis
   description: Redis queue/cache backend for IndeedHub.
   category: community
 

apps/indeedhub-relay/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: indeedhub-relay
   name: IndeedHub Nostr Relay
   version: "0.9.0"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: scsibug/nostr-rs-relay
   description: nostr-rs-relay backing IndeedHub's Nostr identity + comments.
   category: community
 

apps/indeedhub/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: indeedhub
   name: IndeeHub
   version: "1.0.0"
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: Bitcoin documentary streaming platform featuring God Bless Bitcoin and other educational content about Bitcoin, sovereignty, and decentralized technology. Sign in with your Nostr identity.
   category: community
 

apps/jellyfin/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: jellyfin
   name: Jellyfin
   version: 10.8.13
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: jellyfin/jellyfin
   description: Free media server. Stream movies, music, and photos.
 
   container:

apps/lnd-ui/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: lnd-ui
   name: LND UI
   version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: |
     Archipelago-native HTTP frontend for LND. Runs nginx inside a
     container and serves static assets. LND connection info is fetched

apps/lnd/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: lnd
   name: LND
   version: 0.18.4
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: lightningnetwork/lnd
   description: Lightning Network implementation by Lightning Labs. Enables instant, low-cost Bitcoin payments.
 
   container:

apps/mempool-api/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: mempool-api
   name: Mempool API
   version: 3.0.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: mempool/mempool
   description: Backend API for mempool explorer.
 
   container:

apps/mempool/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: mempool
   name: Mempool Explorer
   version: 3.0.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: mempool/mempool
   description: Bitcoin mempool and blockchain explorer. Real-time transaction and block visualization.
   
   container:

apps/morphos-server/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: morphos-server
   name: MorphOS Server
   version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: MorphOS server platform. Decentralized application server.
   
   container:

apps/netbird-dashboard/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: netbird-dashboard
   name: NetBird Dashboard
   version: "2.38.0"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: netbirdio/dashboard
   description: NetBird management dashboard (SPA). Internal stack member served through the netbird proxy.
   category: networking
 

apps/netbird-server/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: netbird-server
   name: NetBird Server
   version: "0.71.2"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: netbirdio/netbird
   description: NetBird combined management / signal / relay server with an embedded identity provider and STUN. Backend for the self-hosted NetBird mesh VPN.
   category: networking
 

apps/netbird/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: netbird
   name: NetBird
   version: "2.38.0"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: dockerhub
+    repo: library/nginx
   description: Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.
   category: networking
 

apps/nextcloud/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: nextcloud
   name: Nextcloud
   version: "29"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: nextcloud/server
   description: Your own private cloud. File sync, calendars, contacts.
 
   container:

apps/nostr-rs-relay/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: nostr-rs-relay
   name: Nostr Relay (Rust)
   version: 0.8.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: scsibug/nostr-rs-relay
   description: High-performance Nostr relay written in Rust. Host your own decentralized social media relay and earn networking profits.
   
   container:

apps/phoenixd/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: phoenixd
   name: phoenixd
   version: 0.9.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: ACINQ/phoenixd
   description: Headless Lightning daemon by ACINQ (the Phoenix wallet team). No screen of its own — it exposes a small local API that other apps and tools use to send and receive Lightning payments. Channel liquidity is managed automatically for a fee.
   category: money
 

apps/photoprism/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: photoprism
   name: PhotoPrism
   version: "240915"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: photoprism/photoprism
   description: AI-powered photo management with facial recognition.
 
   container:

apps/pine-openwakeword/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: pine-openwakeword
   name: Pine Wake Word (openWakeWord)
   version: "2.1.0"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: rhasspy/wyoming-openwakeword
   description: Wyoming-protocol openWakeWord wake-word engine. Internal Pine voice-assistant stack member — lets Assist pipelines run wake-word detection on the node (groundwork for the custom "Yo Archy" wake word; stock models like "ok nabu" ship with the image).
   category: home
 

apps/pine-piper/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: pine-piper
   name: Pine Piper (TTS)
   version: "2.2.2"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: rhasspy/wyoming-piper
   description: Wyoming-protocol Piper text-to-speech engine. Internal Pine voice-assistant stack member — gives Home Assistant Assist a natural voice for spoken responses on the PineVoice satellite.
   category: home
 

apps/pine/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: pine
   name: Pine
   version: "1.3.0"
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: dockerhub
+    repo: library/nginx
   description: A private voice assistant for your home. Pine runs speech-to-text (Whisper), text-to-speech (Piper) and wake-word detection (openWakeWord) on your own node and pairs with a PineVoice satellite speaker, so Home Assistant Assist works locally with nothing sent to the cloud. Ask it about your node — block height, sync, peers, Lightning balance — and, when a Claude API key is set, anything else.
   category: home
 

apps/portainer/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: portainer
   name: Portainer
   version: 2.19.4
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: portainer/portainer
   description: Container management web UI for the local Podman socket.
   category: development
 

apps/router/manifest.yml

@@ -2,6 +2,9 @@ app:
   id: router
   name: Mesh Router
   version: 1.0.0
+  # Built by this project — there is no upstream release feed to watch.
+  upstream:
+    kind: internal
   description: Mesh routing and local network management. Provides device discovery, routing, and network topology visualization.
   
   container:

apps/searxng/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: searxng
   name: SearXNG
   version: 1.0.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: searxng/searxng
   description: Privacy-respecting metasearch engine. Search the web without tracking.
   
   container:

apps/strfry/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: strfry
   name: Strfry Nostr Relay
   version: 0.9.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: hoytech/strfry
   description: Lightweight Nostr relay written in C++. Alternative to nostr-rs-relay with lower resource usage.
 
   container:

apps/uptime-kuma/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: uptime-kuma
   name: Uptime Kuma
   version: 1.23.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: louislam/uptime-kuma
   description: Self-hosted uptime monitoring.
 
   container:

apps/vaultwarden/manifest.yml

@@ -2,6 +2,12 @@ app:
   id: vaultwarden
   name: Vaultwarden
   version: 1.30.0
+  # Where this app comes from, so scripts/check-upstream-releases.py can
+  # tell us when the pin below has fallen behind. Without it nothing can:
+  # container.image names our mirror, not the project it was mirrored from.
+  upstream:
+    kind: github
+    repo: dani-garcia/vaultwarden
   description: Self-hosted password vault with zero-knowledge encryption.
 
   container: