feat: daily update notifier

README.md

@@ -39,6 +39,20 @@ go install github.com/devlyft/cli/cmd/devlyft@latest
 
 Or download an archive or package from [Releases](https://github.com/devlyft/cli/releases). Every release file is listed in a cosign-signed checksum file; see [docs/releasing.md](docs/releasing.md#verifying-a-download) to verify a download.
 
+## Privacy and update checks
+
+devlyft has no telemetry in v1: it does not collect or send usage data.
+
+The only network call it makes besides your own API requests is a check
+for a newer release, at most once a day: an unauthenticated request to
+`https://api.github.com/repos/devlyft/cli/releases/latest`. If a newer
+version exists, a one-line notice is printed to stderr after the command
+finishes. The check runs alongside the command and never delays it.
+
+It is skipped when `CI` is set, when stderr is not a terminal, for
+development builds, and for `devlyft version` and `devlyft completion`.
+To turn it off, set `DEVLYFT_NO_UPDATE_NOTIFIER=1`.
+
 ## Development
 
 Requires Go 1.26 or later.

go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/spf13/cobra v1.10.2
 	go.uber.org/mock v0.6.0
 	go.yaml.in/yaml/v3 v3.0.5
+	golang.org/x/mod v0.42.0
 	golang.org/x/term v0.47.0
 	sigs.k8s.io/yaml v1.6.0
 )
@@ -37,11 +38,10 @@ require (
 	github.com/vmware-labs/yaml-jsonpath v0.3.2 // indirect
 	github.com/woodsbury/decimal128 v1.3.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/mod v0.30.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
+	golang.org/x/tools v0.51.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

go.sum

@@ -134,22 +134,22 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -179,8 +179,8 @@ golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

internal/cli/root.go

@@ -95,7 +95,10 @@ func setup(f *cmdutil.Factory, flags *globalFlags) error {
 // the only place errors are printed and mapped to exit codes.
 func Execute(ctx context.Context, ios *iostreams.IOStreams, args []string) int {
 	f := &cmdutil.Factory{IO: ios}
-	return execute(ctx, f, NewRootCmd(f), args)
+	notifier := startUpdateCheck(ctx, ios, args)
+	code := execute(ctx, f, NewRootCmd(f), args)
+	notifier.finish(code)
+	return code
 }
 
 func execute(ctx context.Context, f *cmdutil.Factory, root *cobra.Command, args []string) int {

internal/cli/update.go

@@ -0,0 +1,102 @@
+package cli
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/devlyft/cli/internal/exitcode"
+	"github.com/devlyft/cli/internal/iostreams"
+	updatecheck "github.com/devlyft/cli/internal/update"
+	"github.com/devlyft/cli/internal/version"
+)
+
+const (
+	// updateTimeout bounds the release lookup.
+	updateTimeout = 2 * time.Second
+	// updateGrace is how long a finished command waits for the lookup
+	// before giving up on the notice for this run.
+	updateGrace = 250 * time.Millisecond
+)
+
+// skipUpdateCommands never show the notice: their output is often captured
+// or sourced by a shell.
+var skipUpdateCommands = map[string]bool{
+	"version":          true,
+	"completion":       true,
+	"__complete":       true,
+	"__completeNoDesc": true,
+}
+
+// updateNotifier runs the update check alongside a command and prints the
+// notice to stderr afterwards if it is ready.
+type updateNotifier struct {
+	result  chan *updatecheck.Release
+	current string
+	errOut  io.Writer
+	brew    bool
+}
+
+// startUpdateCheck starts the daily update check in the background, or
+// returns nil when the notifier is disabled for this invocation.
+func startUpdateCheck(ctx context.Context, ios *iostreams.IOStreams, args []string) *updateNotifier {
+	current := version.Get().Version
+	if !updatecheck.Enabled(os.Getenv, ios.IsStderrTTY(), current) || skipUpdateCommands[firstArg(args)] {
+		return nil
+	}
+	statePath, err := updatecheck.DefaultStatePath()
+	if err != nil {
+		return nil
+	}
+	exe, _ := os.Executable()
+	n := &updateNotifier{
+		result:  make(chan *updatecheck.Release, 1),
+		current: current,
+		errOut:  ios.ErrOut,
+		brew:    exe != "" && updatecheck.IsHomebrew(exe),
+	}
+	checker := &updatecheck.Checker{
+		Current:   current,
+		StatePath: statePath,
+		Client:    &http.Client{Timeout: updateTimeout},
+	}
+	go func() {
+		ctx, cancel := context.WithTimeout(ctx, updateTimeout)
+		defer cancel()
+		rel, _ := checker.Check(ctx) // failures are silent by design
+		n.result <- rel
+	}()
+	return n
+}
+
+// finish prints the notice after a successful command. It waits at most
+// updateGrace for the check to complete.
+func (n *updateNotifier) finish(code int) {
+	if n == nil || code != exitcode.OK {
+		return
+	}
+	select {
+	case rel := <-n.result:
+		if rel != nil {
+			_, _ = io.WriteString(n.errOut, updatecheck.Notice(n.current, rel, n.brew))
+		}
+	case <-time.After(updateGrace):
+	}
+}
+
+// firstArg returns the first argument that is not a flag: the top-level
+// command name.
+func firstArg(args []string) string {
+	for _, a := range args {
+		if a == "--" {
+			return ""
+		}
+		if !strings.HasPrefix(a, "-") {
+			return a
+		}
+	}
+	return ""
+}

internal/cli/update_test.go

@@ -0,0 +1,80 @@
+package cli
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/devlyft/cli/internal/exitcode"
+	"github.com/devlyft/cli/internal/iostreams"
+	updatecheck "github.com/devlyft/cli/internal/update"
+)
+
+func TestStartUpdateCheckDisabled(t *testing.T) {
+	t.Parallel()
+
+	// Test streams are not terminals and test builds are "dev", so the
+	// notifier must not start.
+	ios, _, _, _ := iostreams.Test()
+	if n := startUpdateCheck(t.Context(), ios, []string{"widgets"}); n != nil {
+		t.Error("update check started for a non-terminal dev build")
+	}
+}
+
+func TestUpdateNotifierFinish(t *testing.T) {
+	t.Parallel()
+
+	rel := &updatecheck.Release{Version: "0.2.0", URL: "https://example.com/v0.2.0"}
+	tests := []struct {
+		name   string
+		result *updatecheck.Release
+		ready  bool
+		code   int
+		want   string
+	}{
+		{name: "newer release after success", result: rel, ready: true, code: exitcode.OK, want: "0.1.0 → 0.2.0"},
+		{name: "no newer release", result: nil, ready: true, code: exitcode.OK},
+		{name: "command failed", result: rel, ready: true, code: exitcode.NotFound},
+		{name: "check not ready within grace", ready: false, code: exitcode.OK},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			var errOut bytes.Buffer
+			n := &updateNotifier{result: make(chan *updatecheck.Release, 1), current: "0.1.0", errOut: &errOut}
+			if tt.ready {
+				n.result <- tt.result
+			}
+			n.finish(tt.code)
+			if tt.want == "" && errOut.Len() != 0 {
+				t.Errorf("stderr = %q, want empty", errOut.String())
+			}
+			if tt.want != "" && !strings.Contains(errOut.String(), tt.want) {
+				t.Errorf("stderr = %q, want %q", errOut.String(), tt.want)
+			}
+		})
+	}
+
+	// A nil notifier (disabled) is a no-op.
+	var n *updateNotifier
+	n.finish(exitcode.OK)
+}
+
+func TestFirstArg(t *testing.T) {
+	t.Parallel()
+
+	for args, want := range map[string]string{
+		"version":            "version",
+		"--no-color version": "version",
+		"completion bash":    "completion",
+		"-- version":         "",
+		"":                   "",
+	} {
+		if got := firstArg(strings.Fields(args)); got != want {
+			t.Errorf("firstArg(%q) = %q, want %q", args, got, want)
+		}
+	}
+	if !skipUpdateCommands["version"] || !skipUpdateCommands["completion"] || skipUpdateCommands["deploys"] {
+		t.Error("unexpected skip list")
+	}
+}