release: v1.5.0 — daily PyPI poll for newer engine + version realignment (#47)

Adds a non-blocking notifier that checks PyPI once per day for a newer
`pipeline-check` engine and surfaces an Upgrade prompt when one is
available. Action runs the existing `upgradeInTerminal` flow (terminal
opens, command typed, user reviews and presses Enter) — the "no silent
pip mutations" invariant from src/install.ts holds. Failure paths
(offline, 5xx, malformed JSON, timeout) are silent and logged. New
`pipelineCheck.engineUpdates.checkEnabled` setting (default true)
turns the check off entirely.

Independent of the hard `MIN_ENGINE_VERSION` floor in src/preflight.ts:
the floor still drives the Upgrade welcome panel when the installed
engine is too old to support the extension's features; the new
notifier covers the "preflight succeeded but newer is available" gap.

Version jumps 1.1.0 → 1.5.0 to align the extension stream with the
upstream pipeline-check engine's 1.5.x line so users can read the
two side-by-side. No skipped functionality between 1.1.0 and 1.5.0;
the engine-update notifier is the only user-visible change.

391/391 tests pass (+27 in src/engineUpdates.test.ts), typecheck and
lint clean, prod-only npm audit clean. Bundle smoke OK at 376.3 KB.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dmartinochoa

CHANGELOG.md

@@ -11,6 +11,39 @@ versions follow [SemVer](https://semver.org/).
 > section **above** Unreleased, or remove the Unreleased block for the
 > release commit. Otherwise the GitHub release ships boilerplate.
 
+## [1.5.0] — 2026-05-27
+
+Aligns the extension's version stream with the upstream
+[`pipeline-check`](https://pypi.org/project/pipeline-check/) engine's
+1.5.x line so users can read the two side-by-side without doing the
+mapping in their head. No skipped functionality between 1.1.0 and
+1.5.0 — the only user-visible change is the engine-update notifier
+below.
+
+### Added
+
+- **Daily PyPI poll for a newer engine.** Once per 24 h (per-session
+  latch + per-day `globalState` timestamp), the extension queries
+  `https://pypi.org/pypi/pipeline-check/json` after a successful
+  preflight and surfaces a non-blocking notification when PyPI's
+  latest stable is newer than the engine the user has installed.
+  The **Upgrade in terminal** action runs the existing
+  [`upgradeInTerminal`](src/install.ts) flow — terminal opens,
+  `python -m pip install --upgrade "pipeline-check[lsp]"` is typed
+  but **not** auto-executed, same review-then-Enter pattern as the
+  install CTA. **Skip this version** silences the prompt for that
+  exact version only; a later release re-prompts. Dismissing the
+  toast (no choice) re-prompts on the next per-day window. Every
+  failure path (offline, PyPI 5xx, malformed JSON, timeout) is
+  silent — failures land in the Pipeline-Check output channel, not
+  in a user-facing toast for a background nicety they didn't ask
+  about. Independent of the hard `MIN_ENGINE_VERSION` floor in
+  [src/preflight.ts](src/preflight.ts), which still drives the
+  Upgrade welcome panel when the installed engine is too old to
+  support the extension's features. New setting
+  `pipelineCheck.engineUpdates.checkEnabled` (default `true`) turns
+  the check off entirely.
+
 ## [1.1.0] — 2026-05-25
 
 Feature batch on top of v1.0.3. Three user-visible additions plus

package-lock.json

@@ -2,7 +2,7 @@
   "name": "pipeline-check",
   "displayName": "Pipeline-Check",
   "description": "Lint CI/CD pipelines for 22 providers against OWASP Top 10 CI/CD Risks and 14 other compliance frameworks. 810+ rules, inline in your editor.",
-  "version": "1.1.0",
+  "version": "1.5.0",
   "publisher": "greylag-ci",
   "license": "MIT",
   "icon": "icon.png",
@@ -333,6 +333,11 @@
           ],
           "default": "off",
           "markdownDescription": "Traces LSP traffic between the editor and the `pipeline_check.lsp` server. Set to `verbose` when debugging."
+        },
+        "pipelineCheck.engineUpdates.checkEnabled": {
+          "type": "boolean",
+          "default": true,
+          "markdownDescription": "Check PyPI once per day for a newer `pipeline-check` engine and surface a non-blocking notification when one is available. The notification's **Upgrade in terminal** action opens a terminal with `python -m pip install --upgrade \"pipeline-check[lsp]\"` typed (but not auto-run, same pattern as the install CTA). **Skip this version** silences the prompt for the offered version only — a later release re-prompts. Set to `false` to disable the check entirely; this is independent of the hard `MIN_ENGINE_VERSION` floor that still drives the **Upgrade in terminal** welcome panel when the installed engine is too old to support the extension."
         }
       }
     }