detect newer version tags for pinned images and show them as a badge with release notes

src/lib/server/scheduler/tasks/env-update-check.ts

@@ -8,6 +8,7 @@
 import type { ScheduleTrigger, VulnerabilityCriteria } from '../../db';
 import {
 	getEnvUpdateCheckSettings,
+	getGlobalSemverConfig,
 	getEnvironment,
 	createScheduleExecution,
 	updateScheduleExecution,
@@ -37,7 +38,7 @@ import { sendEventNotification } from '../../notifications';
 import { getScannerSettings, scanImage, type VulnerabilitySeverity } from '../../scanner';
 import { parseImageNameAndTag, combineScanSummaries, isSystemContainer, isPodmanInfraContainer } from './update-utils';
 import { resolveBlockDecision } from './block-decision';
-import { isUpdateDisabledByLabel, isHiddenByLabel } from '../../container-labels';
+import { isUpdateDisabledByLabel, isHiddenByLabel, getVersionPatternOverride } from '../../container-labels';
 import { recreateContainer } from './container-update';
 
 interface UpdateInfo {
@@ -110,12 +111,14 @@ export async function runEnvUpdateCheckJob(
 		await log(`Starting update check for environment: ${env.name}`);
 		await log(`Auto-update mode: ${config.autoUpdate ? 'ON' : 'OFF'}`);
 
-		// Semver "newer version tag" detection rides this same pass when enabled.
-		const semverEnabled = !!config.checkPinnedVersions;
+		// Semver "newer version tag" detection is a global setting - it rides this
+		// same pass when enabled, and the manual check reads the same config.
+		const semverConfig = await getGlobalSemverConfig();
+		const semverEnabled = semverConfig.enabled;
 		const semverOptions = {
-			maxBump: config.semverMaxBump ?? 'major',
-			matchFlavor: config.semverMatchFlavor ?? true,
-			includePrerelease: config.semverIncludePrerelease ?? false
+			maxBump: semverConfig.maxBump,
+			matchFlavor: semverConfig.matchFlavor,
+			includePrerelease: semverConfig.includePrerelease
 		} as const;
 		// Remember the target we last surfaced per container, so we only notify when
 		// a NEW newer version appears - not on every scheduled run. Read before clear.
@@ -221,7 +224,10 @@ export async function runEnvUpdateCheckJob(
 				// Newer-version-tag (semver) detection - independent of the digest check.
 				// Skips floating tags without a registry call. Never throws.
 				if (semverEnabled) {
-					const newer = await checkNewerVersion(imageName, semverOptions).catch(() => null);
+					// A `dockhand.version.pattern` label lets a container teach the check
+					// how to read its own non-standard tags (CalVer+hash, etc.).
+					const versionPattern = getVersionPatternOverride(inspectData.Config?.Labels);
+					const newer = await checkNewerVersion(imageName, { ...semverOptions, versionPattern }).catch(() => null);
 					if (newer) {
 						semverByContainer.set(container.id, newer);
 						await log(`    NEWER VERSION: ${newer.tag} (${newer.bump})`);