feat(apps): find out when an app has fallen behind upstream

lfg2025/archy

Nodes offer an update when the signed catalog pins something newer than
what's running, and that machinery is fine. The missing step was the one
before it: nothing told *us* when upstream shipped. A pin could sit at
fedimintd v0.10.0 for months while every node in the fleet correctly and
confidently reported "up to date".

The reason nothing could tell us is that a manifest records only our
mirror — `source.archipelago-foundation.org/lfg2025/fedimintd:v0.10.0`
says nothing about the project it was mirrored from. So this adds an
optional `app.upstream` block naming the real source, and a script that
asks each one what it has released.

Running it answers the question that prompted this. Of 58 apps, 28 are
behind, including LND v0.18.4-beta against v0.21.2-beta, Bitcoin Core
28.4 against 31.1, and fedimintd/gatewayd v0.10.0 against v0.10.1.

Two choices worth stating. An app with no `upstream` block is reported
as UNTRACKED rather than skipped — a silent skip is how this stayed
invisible, and before this commit all 58 were silently skipped. And a
suggestion prefers our own tag variant: telling someone pinned to
`postgres:16.13-alpine` that the newest tag is `18.6-trixie` is true and
useless, because swapping the base image is a different decision from
bumping a version.

Five apps are deliberately left untracked (barkd, immich-postgres,
indeedhub-minio, lightning-stack, pine-whisper): I could not establish
their upstream with confidence, and a wrong `repo` produces a confident
wrong verdict, which is worse than an honest gap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

This commit is contained in:

archipelago

2026-08-17 08:04:33 -04:00

co-authored by

Claude Opus 5

parent 59fffc809f

commit eb48eab946

55 changed files with 662 additions and 0 deletions

									
										apps/archy-mempool-web/manifest.yml
									
		+6
		
												View File
												
				@@ -2,6 +2,12 @@ app:

				  id: archy-mempool-web

				  name: Mempool Web

				  version: 3.0.1

				  # Where this app comes from, so scripts/check-upstream-releases.py can

				  # tell us when the pin below has fallen behind. Without it nothing can:

				  # container.image names our mirror, not the project it was mirrored from.

				  upstream:

				    kind: github

				    repo: mempool/mempool

				  description: Frontend web UI for mempool explorer.

				  container_name: mempool