feat(update-check): add dunite-update-check leaf crate #38

Merged

nrupard merged 1 commit from feat/DEV-530-update-check-crate into main

2026-08-06 16:48:31 +02:00

nrupard commented

2026-08-06 16:33:05 +02:00

Owner

What

Adds the dunite-update-check leaf crate (DEV-530, under BUNYIP-340) - the self-hosted update checker extracted from bunyip-api's version.rs, made config-driven with no product identity.

UpdateChecker::new(url, token, current, user_agent) polls a Forgejo/Gitea releases/latest, reads tag_name, semver-compares it against current, and TTL-caches the result (1h on success, 60s on error). UpdateStatus serializes the operator-facing result. The running version, endpoint, token, and User-Agent are all caller-supplied. It only reports; applying an update stays a deliberate operator action.

The image-upload hardening (the other half of DEV-530's spec) already shipped as dunite-image-upload (DEV-531), so this issue's remaining scope is the update-checker.

Deps

No new workspace deps: reqwest / serde / serde_json / chrono were already present. The cache uses std::sync::RwLock (no parking_lot).

Validation

cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test -p dunite-update-check green in the pinned rust-builder image (semver parsing, newer-detection, tag_name extraction).

Consumer follow-up (bunyip, after merge)

bunyip keeps current_version() (its CARGO_PKG_VERSION) and git_revision() (BUNYIP_GIT_SHA); version.rs re-exports UpdateChecker / UpdateStatus from the crate, and the construction site passes current_version().to_string() plus the bunyip User-Agent. Leaf crate, so bunyip's dunite-core rev does not move.

#DEV-530

## What Adds the `dunite-update-check` leaf crate (DEV-530, under BUNYIP-340) - the self-hosted update checker extracted from bunyip-api's `version.rs`, made config-driven with no product identity. `UpdateChecker::new(url, token, current, user_agent)` polls a Forgejo/Gitea `releases/latest`, reads `tag_name`, semver-compares it against `current`, and TTL-caches the result (1h on success, 60s on error). `UpdateStatus` serializes the operator-facing result. The running version, endpoint, token, and `User-Agent` are all caller-supplied. It only reports; applying an update stays a deliberate operator action. The image-upload hardening (the other half of DEV-530's spec) already shipped as `dunite-image-upload` (DEV-531), so this issue's remaining scope is the update-checker. ## Deps No new workspace deps: `reqwest` / `serde` / `serde_json` / `chrono` were already present. The cache uses `std::sync::RwLock` (no `parking_lot`). ## Validation `cargo fmt --all --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test -p dunite-update-check` green in the pinned rust-builder image (semver parsing, newer-detection, `tag_name` extraction). ## Consumer follow-up (bunyip, after merge) bunyip keeps `current_version()` (its `CARGO_PKG_VERSION`) and `git_revision()` (`BUNYIP_GIT_SHA`); `version.rs` re-exports `UpdateChecker` / `UpdateStatus` from the crate, and the construction site passes `current_version().to_string()` plus the bunyip `User-Agent`. Leaf crate, so bunyip's `dunite-core` rev does not move. #DEV-530

nrupard added 1 commit

2026-08-06 16:33:05 +02:00

feat(update-check): add dunite-update-check leaf crate

Check / fmt + clippy + test (pull_request) Successful in 41s

Details

create-release / create-release (pull_request) Has been skipped

Details

dfde2ec905

Extracts the self-hosted update checker from bunyip-api's version.rs into a leaf crate (DEV-530), config-driven and with no product identity.

UpdateChecker::new(url, token, current, user_agent) polls a Forgejo/Gitea releases/latest, reads tag_name, semver-compares against current, and TTL-caches (1h success / 60s error). UpdateStatus serializes the operator-facing result. The running version, endpoint, token and User-Agent are caller-supplied; the crate only reports.

The image-upload half of DEV-530's spec already shipped as dunite-image-upload (DEV-531), so this covers the remaining update-checker. No new workspace deps (reqwest/serde/serde_json/chrono already present); the cache uses std::sync::RwLock. CLAUDE.md crates block and dependency-direction note updated.

#DEV-530