feat(plugins): ✨ daily update checks and security advisories from public JSON manifests

.github/workflows/bump_publish.yml

@@ -32,13 +32,20 @@ on:
         required: false
         type: boolean
 
+env:
+  # Every package this workflow publishes. The publish steps and the update
+  # manifest both read it, so the manifest never names a package npm did not get.
+  PUBLISHED_PACKAGES: "create-vitnode-app @vitnode/core @vitnode/config @vitnode/blog @vitnode/nodemailer @vitnode/resend @vitnode/node-cron"
+
 jobs:
   bump-version:
     name: "Bump Version"
     runs-on: ubuntu-latest
     permissions:
       contents: write
       id-token: write
+    outputs:
+      sha: ${{ steps.published.outputs.sha }}
 
     steps:
       - name: Checkout
@@ -83,21 +90,21 @@ jobs:
 
       - name: Publish canary
         if: ${{ (github.event.inputs.mode == 'bump_and_publish' || github.event.inputs.mode == 'publish') && github.event.inputs.release == 'canary' }}
-        run: pnpm publish --filter create-vitnode-app --filter @vitnode/core --filter @vitnode/config --filter @vitnode/blog --filter @vitnode/nodemailer --filter @vitnode/resend --filter @vitnode/node-cron --tag canary --no-git-checks --access public
+        run: pnpm publish $(printf -- "--filter %s " $PUBLISHED_PACKAGES) --tag canary --no-git-checks --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
 
       - name: Publish release candidate
         if: ${{ (github.event.inputs.mode == 'bump_and_publish' || github.event.inputs.mode == 'publish') && github.event.inputs.release == 'release-candidate' }}
-        run: pnpm publish --filter create-vitnode-app --filter @vitnode/core --filter @vitnode/config --filter @vitnode/blog --filter @vitnode/nodemailer --filter @vitnode/resend --filter @vitnode/node-cron --tag rc --no-git-checks --access public
+        run: pnpm publish $(printf -- "--filter %s " $PUBLISHED_PACKAGES) --tag rc --no-git-checks --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
 
       - name: Publish stable
         if: ${{ (github.event.inputs.mode == 'bump_and_publish' || github.event.inputs.mode == 'publish') && github.event.inputs.release == 'stable' }}
-        run: pnpm publish --filter create-vitnode-app --filter @vitnode/core --filter @vitnode/config --filter @vitnode/blog --filter @vitnode/nodemailer --filter @vitnode/resend --filter @vitnode/node-cron --tag latest --no-git-checks --access public
+        run: pnpm publish $(printf -- "--filter %s " $PUBLISHED_PACKAGES) --tag latest --no-git-checks --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
@@ -113,3 +120,48 @@ jobs:
         run: gh release create ${{ steps.version-bump.outputs.newTag }} --generate-notes
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Remember the published commit
+        id: published
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  publish-update-manifest:
+    name: "Publish update manifest"
+    needs: bump-version
+    # Only after npm has the packages: a bump-only run publishes nothing, so it
+    # advertises nothing.
+    if: ${{ github.event.inputs.mode == 'bump_and_publish' || github.event.inputs.mode == 'publish' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    # Shared with the security updates workflow: one writer of updates.json at a time.
+    concurrency:
+      group: vitnode-update-manifest
+      cancel-in-progress: false
+
+    steps:
+      - name: Checkout the published commit
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.bump-version.outputs.sha }}
+
+      - uses: pnpm/action-setup@v6.1.0
+        name: Install pnpm
+        with:
+          version: 11.9.0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v7.0.0
+        with:
+          node-version: 24
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Add the published versions to updates.json
+        run: pnpm run release:update-manifest release
+        env:
+          RELEASE_TYPE: ${{ github.event.inputs.release }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/publish-security-updates.yml

@@ -0,0 +1,50 @@
+name: Publish security updates
+
+on:
+  pull_request:
+    paths:
+      - "security/security-updates.json"
+  push:
+    branches:
+      - canary
+    paths:
+      - "security/security-updates.json"
+  workflow_dispatch:
+
+jobs:
+  security-updates:
+    name: "Validate and publish security updates"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    # Shared with the release workflow: one writer of updates.json at a time.
+    concurrency:
+      group: vitnode-update-manifest
+      cancel-in-progress: false
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v6.1.0
+        name: Install pnpm
+        with:
+          version: 11.9.0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v7.0.0
+        with:
+          node-version: 24
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate security/security-updates.json
+        run: pnpm run release:update-manifest check
+
+      - name: Publish security updates to updates.json
+        if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/canary' }}
+        run: pnpm run release:update-manifest security-updates
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

apps/api/migrations/20261015193600_add_core_update_checks/migration.sql

@@ -0,0 +1,33 @@
+CREATE TABLE "core_update_lock" (
+	"name" varchar(50) PRIMARY KEY,
+	"owner" varchar(64),
+	"expiresAt" timestamp,
+	"lastManualAt" timestamp
+);
+--> statement-breakpoint
+ALTER TABLE "core_update_lock" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE TABLE "core_update_results" (
+	"componentId" varchar(214) PRIMARY KEY,
+	"sourceUrl" varchar(2048) NOT NULL,
+	"channel" varchar(20),
+	"versions" jsonb NOT NULL,
+	"hasUnknownVersion" boolean DEFAULT false NOT NULL,
+	"coreVersion" varchar(256),
+	"result" jsonb,
+	"lastAttemptAt" timestamp NOT NULL,
+	"lastSuccessAt" timestamp,
+	"lastError" jsonb
+);
+--> statement-breakpoint
+ALTER TABLE "core_update_results" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+CREATE TABLE "core_update_sources" (
+	"url" varchar(2048) PRIMARY KEY,
+	"etag" varchar(512),
+	"lastModified" varchar(128),
+	"document" jsonb,
+	"lastAttemptAt" timestamp NOT NULL,
+	"lastSuccessAt" timestamp,
+	"lastError" jsonb
+);
+--> statement-breakpoint
+ALTER TABLE "core_update_sources" ENABLE ROW LEVEL SECURITY;