[BackStacked]

Requested by Himanshu · project thread

What

Images per release. .github/workflows/release.yml: a v* tag (admin-only) or a manual run on main checks the tag equals package.json, builds ghcr.io/mgpl-diagnostics/api for linux/amd64 and arm64 (tags 1.2.3, 1.2, 1 from 1.0, latest; kits read with the workflow token as a build secret) and creates the GitHub release with generated notes.

Easy hosting. docker-compose.yml now pulls the released api and dashboard images (MGPL_API_VERSION / MGPL_DASHBOARD_VERSION, default latest) and adds the dashboard. nginx serves both on one origin: /graphql and /health → api replicas, the rest → dashboard, so TRUST_PROXY=1 stays right and there is no CORS. Building from a checkout moved to docker-compose.build.yml.

Update notices. New query systemUpdates(dashboardVersion, refresh) (permission settings:manage: owner and admin) compares this api's version and the dashboard's with the newest published GitHub releases of both repos, and returns the changelog in between plus the update steps. One GET per repo per UPDATE_CHECK_INTERVAL_MS (6 h) per process, "refresh" at most once a minute, last good answer kept on failure; UPDATE_CHECK=false makes no outbound call. Feed data is typed and capped; non-https links dropped; pre-releases and drafts ignored. New module system (schema, controller, service), no change to existing modules.

Fix. health.version read ../../package.json relative to the bundled chunk, so production images answered 0.0.0; src/version.ts now reads the right file in both tsx and dist.

Docs: new docs/18-updates.md (images, hosting, updating, releasing, the check), config table, .env.example, 12/17 updated. schema.graphql, API reference and llms-full.txt regenerated.

Merge order

@mgpl-diagnostics/client 1.6.0 (mgpl-diagnostics/client PR) has the systemUpdates operation, which the "every root field has a client operation" check needs, so this PR bumps the client to ^1.6.0. Client main already includes the operations of #23 and #24, so: merge #24 and #23, then client 1.6.0 (tag it), then this. kits.json/package.json/lock will conflict with #24 on the client line; take 1.6.0, then npm install to refresh the lock and npm run schema && npm run docs:reference && npm run llms.

Tests

TEST_BACKENDS=pg npm test with kits built from local checkouts: 16 new [updates] checks pass (versions, changelog window, cache, refresh limit, unknown dashboard version, UNAUTHENTICATED, FORBIDDEN for front desk, 403 feed, UPDATE_CHECK=false, repo validation). The one failure is the client-contract check against today's main, which lacks #23/#24's fields (goes away in the merge order above). docker compose config passes for both compose files; nginx -t passes; nginx routing checked with stub containers. The image build itself runs for the first time in CI on the first tag.

After merging

• First release only: GitHub → org → Packages → api → change visibility to Public (or docker login ghcr.io on servers).
• One-click updates are not included (the api never gets the Docker socket); asked in the project thread.

---

Generated by Claude Code