Replaces the Endpoints enum and checker's per-host dispatch: checker.rs now
holds only the ReleaseSource trait (latest release + API root), each host
implements it in its own module (github.rs, forgejo.rs), and source.rs is a
factory returning a Box<dyn ReleaseSource> per package. Adding a host no
longer touches existing ones, and the pipeline only sees the trait.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Fix stale ARCHITECTURE/config docs, soften source.rs's overclaim, trim the
SPEC's crate paragraph (no brittle counts), and merge the duplicate
same-origin Package test helper into test_support.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Packages can now declare source = "forgejo-release" plus a base_url and be
checked, fetched and verified against a Forgejo instance's releases API,
alongside the existing GitHub source. This is what lets pkgwatch track its
own releases from the self-hosted Forgejo.
- config: Source enum (github-release default, forgejo-release) + base_url,
validated once at load (base_url pairing, http(s) scheme, and no
github-attestation on a Forgejo source).
- source: new module mapping a package to its Endpoints.
- checker: latest_forgejo_release, one call to releases/latest; latest_release
dispatches per source.
- fetcher/verifier: take the releases API root instead of GithubEndpoints,
since GitHub and Forgejo serve the same releases/tags/<tag> shape.
- pipeline: endpoints are resolved per package.
- docs: SPEC documents the source key and why the HTTP is hand-rolled rather
than an API-client crate.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Ignore relative XDG_* values and reject a relative HOME, per the XDG
spec; add a hint to the missing-config error; tighten docs and comments.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Paths no longer resolve relative to the cwd, so the unit's comment and
the SPEC's explanation of it were stale.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
An installed pkgwatch has no checkout to run from, so packages.d/,
state/ and work/ can no longer be relative to the working directory.
New paths module resolves them per the XDG base-directory spec, with
PKGWATCH_{CONFIG,STATE,WORK}_DIR overrides for dry runs.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Hourly user-level pkgwatch.timer/.service, an OnFailure= notifier, and a
notifier module that sends notify-send alerts when a tier 4-6 release is
queued for review or a tier 1-3 release is published.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
SPEC.md and ARCHITECTURE.md were sitting at the repo root alongside
Cargo.toml/Makefile.toml/packages.d — moved both into docs/ (doubleo7
already does this for its own supplementary docs, so this matches an
existing convention in the fleet rather than inventing a new one).
Updated every doc-comment cross-reference across src/*.rs and
Makefile.toml (23 references) to the new docs/SPEC.md / docs/
ARCHITECTURE.md paths. The two files' own cross-references to each other
didn't need changing — they're still same-directory relative references.
Also updated the project reference memory pointing at ARCHITECTURE.md's
location, so it doesn't go stale pointing at a path that no longer exists.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
