Tell people when an addon has a newer release - #393
Merged
Conversation
An addon can name where it is published, as `owner/repo`, and the addons page says when that repository has a release newer than the version installed. The check runs when the page opens rather than on a timer. Nobody needs to learn an addon is out of date mid-call, and a check that only runs while somebody is looking at the answer cannot spend their rate limit in the background. It reads the tag out of the redirect on /releases/latest rather than calling api.github.com, which is the same trick the app's own update check uses and for the same reason: 60 unauthenticated calls an hour, shared with everything else on that address. `repository` is validated where the manifest is read, not where the fetch happens. A manifest is a file anybody can drop in the addons folder and this value picks a URL, so the shape is the check: two path segments of the characters GitHub allows in a name. No scheme, no host, no traversal, no query string. The button opens the release. Replacing an addon's files means running whatever that repository publishes next, so the step where somebody reads it first is the point rather than a gap. Installing in place is a separate decision and wants its own thinking about what is verified before it runs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An addon can name where it is published, and the addons page says when that
repository has a release newer than what is installed.
{ "id": "face-framing", "version": "1.0.0", "repository": "Gryt-chat/addon-face-framing" }The card then shows a
v1.1.0 availablechip and a button to the release.Decisions worth arguing with
The button opens the release, it does not install it. Replacing an addon's
files means running whatever that repository publishes next, on the next launch,
in the renderer. Installing that on one click is a different decision from
noticing it exists, and it wants its own thinking about what gets verified
before it runs. This PR does the noticing.
repositoryis validated where the manifest is read, not where the fetchhappens. A manifest is a file anybody can drop in the addons folder, and this
value decides what gets requested — so the check is the shape: two path segments
of the characters GitHub allows in a name. No scheme, no host, no
.., no querystring to point it elsewhere.
No
api.github.com./releases/latestredirects to/releases/tag/<tag>,so the tag comes out of the Location header of a request that never follows it.
Same approach as the app's own update check, for the same reason — 60
unauthenticated calls an hour, shared with everything else on that address.
Checked when the page opens, not on a timer. Nobody needs to learn an addon
is out of date during a call.
Behaviour at the edges
repositoryin the manifest: never reports an update. Right default forsomething somebody wrote for themselves.
latestandv2-finalare real tag names and neither says anything about ordering./releases/latestredirects to/releases, notag in it, reads as nothing to report.
skips.
Verified
Typecheck and lint pass. I have not exercised it against a real addon with a
real repository — there isn't one yet — so the network path is reasoned rather
than run. Worth pointing at a repo once an addon actually has one.
🤖 Generated with Claude Code