updatecheck

Documentation

Overview

Package updatecheck provides GitHub release checking for CLI application updates.

Index

• Constants
• func DefaultCachePath(owner, repo string) string
• func NewSecureClient() *http.Client
• func NewSecureClientWithTimeout(timeout time.Duration) *http.Client
• type Asset
• type Checker
  • func NewChecker(owner, repo string) *Checker
  • func (c *Checker) Check(ctx context.Context, currentVersion string) (*Release, error)
  • func (c *Checker) CheckWithForce(ctx context.Context, currentVersion string, force bool) (*Release, error)
• type Release

Constants

const (
	// DefaultCacheTTL is the default time-to-live for cached update check results.
	DefaultCacheTTL = 24 * time.Hour

	// DefaultAPITimeout bounds a release-metadata request. The payload is a
	// few KB, so a short timeout is appropriate.
	DefaultAPITimeout = 3 * time.Second

	// DefaultDownloadTimeout bounds a release asset download. http.Client's
	// Timeout covers the response body, so this has to accommodate a
	// multi-megabyte binary over a slow link — not the API timeout.
	DefaultDownloadTimeout = 15 * time.Minute
)

Functions

func DefaultCachePath

func DefaultCachePath(owner, repo string) string

DefaultCachePath returns the stable on-disk cache path for a GitHub release checker. It honors an absolute XDG_CACHE_HOME and otherwise uses ~/.cache. The repository identity is hashed so owner/repo input cannot escape the updatecheck cache directory through path traversal.

func NewSecureClient

func NewSecureClient() *http.Client

NewSecureClient returns the hardened HTTP client used for GitHub release requests: TLS 1.3 minimum, a short request timeout suited to the release metadata API, and a redirect policy that refuses to leave GitHub hosts.

Use NewSecureClientWithTimeout for asset downloads, which need a far longer timeout than a metadata call.

func NewSecureClientWithTimeout

func NewSecureClientWithTimeout(timeout time.Duration) *http.Client

NewSecureClientWithTimeout returns a client with the same hardening as NewSecureClient but a caller-chosen overall timeout. http.Client.Timeout covers reading the response body too, so a download needs a much larger value than a metadata request — see DefaultDownloadTimeout.

A non-positive timeout means no timeout.

The redirect policy refuses any redirect that leaves a GitHub host. The initial request URL is not restricted, so a consumer pointing at a different host still works; only being bounced off GitHub mid-request is refused.

Types

type Asset

type Asset struct {
	Name               string
	BrowserDownloadURL string
	Size               int64
}

Asset represents a release asset.

type Checker

type Checker struct {
	HTTPClient       httpDoer
	LatestReleaseURL string
	CacheTTL         time.Duration
	// CachePath is the JSON file used for the cross-process update cache. New
	// checkers receive a stable XDG cache path; set it to an empty string to
	// disable persistence or to an explicit path for isolated consumers.
	CachePath string
	// contains filtered or unexported fields
}

Checker checks for application updates via GitHub releases.

func NewChecker

func NewChecker(owner, repo string) *Checker

NewChecker creates a new update checker for the given GitHub repo. The URL format is https://api.github.com/repos/{owner}/{repo}/releases/latest.

func (*Checker) Check

func (c *Checker) Check(ctx context.Context, currentVersion string) (*Release, error)

Check checks for updates. Returns nil release if currentVersion is latest or if the version cannot be parsed as a stable semver.

func (*Checker) CheckWithForce

func (c *Checker) CheckWithForce(ctx context.Context, currentVersion string, force bool) (*Release, error)

CheckWithForce forces a check, bypassing the in-memory cache when force is true.

type Release

type Release struct {
	TagName string
	Body    string
	HTMLURL string
	Assets  []Asset
}

Release represents a GitHub release.