feat(cli): notify once a day when a newer jamf-cli release is available

[neilmartin83]

Why

jamf-cli ships weekly-ish (v1.23.0 → v1.25.2 in two weeks) across four install channels — Homebrew tap, .pkg, release tarball, go install — and none of them tells a user their build is stale. Admins then hit "no such command" on endpoints a newer build already generates. checkTenantVersion already warns about the mirror case (tenant older than the baked-in spec); this closes the other half.

What it does

Once a day, an interactive release build prints one hint to stderr after the command's own output:

hint: new jamf-cli release: v1.25.2 → v1.26.0 (brew upgrade jamf-cli)
      https://github.com/Jamf-Concepts/jamf-cli/releases/tag/v1.26.0

Design decisions worth reviewing

Module proxy, not the GitHub API. api.github.com caps unauthenticated callers at 60 requests/hour per IP — a budget every admin behind one corporate egress IP shares, so it would fail silently and unpredictably. proxy.golang.org/.../@latest is CDN-backed, uncapped, credential-free, and already canonical for go install. Fallback is the github.com/<repo>/releases/latest 302, also not an API call. Nothing tenant-, profile-, or credential-related leaves the machine: the module path plus the current version in User-Agent is the whole request.

Notify, never self-update. A Homebrew- or pkg-managed binary lives in a path the invoking user often cannot write, and replacing a notarized binary under Homebrew's manifest breaks brew doctor. The notice instead names the upgrade that works for that install (brew upgrade / go install / releases URL), detected by path rather than by shelling out to brew --prefix. Homebrew installs get a 24h grace period so the hint never points at a version the tap hasn't picked up.

One gate, printed from PostRun. updateCheckGate holds the policy as data, so it's testable without a terminal or a network. It stays silent unless: the version is an exact release tag (not dev, a git describe suffix, -dirty, or a prerelease), both stdout and stderr are TTYs, no CI marker is set, the command isn't machine-facing (mcp speaks JSON-RPC on stdio; also completion, agent-context, version, help, __complete*), and neither --quiet nor --no-hints is in play. Printing from PersistentPostRunE means it can't delay or interleave with real output, and says nothing when the command failed.

Cost is bounded. Probe runs in a goroutine with a 2s deadline; results cache for 24h — 1h for failures, cached on purpose so an offline machine stops paying the timeout on every command. Cache is .update-cache.json beside the config file, 0600, temp-file-then-rename: same shape as the tenant version cache.

resolveVersion fallback. go install github.com/Jamf-Concepts/jamf-cli/cmd/jamf-cli@latest gets no -ldflags, so it reported dev — untraceable in bug reports, and silently opted out of this check. Now falls back to debug.ReadBuildInfo.

Opt-outs

--no-update-check · JAMF_CLI_NO_UPDATE_CHECK=1 (value-parsed, so =0 leaves it on) · update-check: false in config.yaml, for admins who deploy jamf-cli by package and don't want a nag users can't act on. Surfaced in config show.

Tests

38 new cases in internal/commands/update_check_test.go plus 7 in cmd/jamf-cli/main_test.go: version-shape classification, comparison ordering, cache TTL/round-trip/permissions/corruption, both fetch sources against httptest (including proxy-path capital escaping, HEAD-only fallback, proxy→GitHub failover, source preference, context cancellation), install-kind detection, notice formatting and every silent case, the full gate veto matrix, CI-marker detection, all three opt-outs, command-skip walking, probe/cache/notify integration, timeout behaviour, and root wiring.

Also verified on a real binary under a pty: notice appears, cache lands, and it goes silent when piped, in CI, under --quiet, with the flag, with either env value, with update-check: false, on version, and when already on the latest release.

make test (28 packages), make lint (0 issues), make verify-generated, make verify-site, go test -race, go fix, make fmt all clean.

Dependency

golang.org/x/mod v0.37.0 promoted from indirect to direct (semver + module.EscapePath). No new modules in the graph.

🤖 Generated with Claude Code