detect newer version tags for pinned images and show them as a badge with release notes

src/lib/server/db.ts

@@ -4868,12 +4868,48 @@ export interface EnvUpdateCheckSettings {
 	cron: string;
 	autoUpdate: boolean;
 	vulnerabilityCriteria: VulnerabilityCriteria;
-	// Semver (newer-version-tag) detection — optional so pre-existing rows (which
-	// never had these) parse as "off" without any migration.
-	checkPinnedVersions?: boolean;
-	semverMaxBump?: 'patch' | 'minor' | 'major';
-	semverMatchFlavor?: boolean;
-	semverIncludePrerelease?: boolean;
+}
+
+/**
+ * Global newer-version-tag (semver) detection config. Per-env settings decide
+ * WHEN/whether to check on a schedule; this decides HOW versions are read, and
+ * applies to every check - scheduled and manual alike.
+ */
+export interface GlobalSemverConfig {
+	enabled: boolean;
+	maxBump: 'patch' | 'minor' | 'major';
+	matchFlavor: boolean;
+	includePrerelease: boolean;
+}
+
+const GLOBAL_SEMVER_KEY = 'global_semver_check';
+const DEFAULT_SEMVER_CONFIG: GlobalSemverConfig = {
+	enabled: false,
+	maxBump: 'major',
+	matchFlavor: true,
+	includePrerelease: false
+};
+
+export async function getGlobalSemverConfig(): Promise<GlobalSemverConfig> {
+	const result = await db.select().from(settings).where(eq(settings.key, GLOBAL_SEMVER_KEY));
+	if (!result[0]) return { ...DEFAULT_SEMVER_CONFIG };
+	try {
+		return { ...DEFAULT_SEMVER_CONFIG, ...JSON.parse(result[0].value) };
+	} catch {
+		return { ...DEFAULT_SEMVER_CONFIG };
+	}
+}
+
+export async function setGlobalSemverConfig(config: GlobalSemverConfig): Promise<void> {
+	const value = JSON.stringify(config);
+	const existing = await db.select().from(settings).where(eq(settings.key, GLOBAL_SEMVER_KEY));
+	if (existing.length > 0) {
+		await db.update(settings)
+			.set({ value, updatedAt: new Date().toISOString() })
+			.where(eq(settings.key, GLOBAL_SEMVER_KEY));
+	} else {
+		await db.insert(settings).values({ key: GLOBAL_SEMVER_KEY, value });
+	}
 }
 
 export async function getEnvUpdateCheckSettings(envId: number): Promise<EnvUpdateCheckSettings | null> {