[SoulEater]

Summary

Add two paired community plugins maintained under the SoulEater account:

Component	Repository	Version	Pinned commit
Backend	https://github.com/SoulEater/app_update	0.2.0	b862a5eb5c92b8fa4ea2c66de6e52387e95c696d
Frontend	https://github.com/SoulEater/app_update_ui	0.2.0	29d1a6d9a232e42d304639975f3dadb5012efcc8

The plugins provide multi-application, multi-channel release management and an electron-updater generic-provider feed. Administrators can upload an installer, blockmap and release manifest, publish releases, pause them and select an eligible previous release for the feed. The frontend targets the official web-antdv-next application.

Both repositories are public and include MIT licenses, applicable upstream notices, installation documentation and tests. This PR only adds the two HTTPS submodule registrations and their pinned commits. It does not modify catalog validation, generation code or generated plugin data.

Plugin integration

• Application-level backend plugin with management API routes and a public latest.yml feed.
• JWT/RBAC-protected management operations; the public feed uses the host's IP rate limiting. FBA 1.16 uses the host Redis SDK limiter, while older hosts use the legacy limiter when available.
• Server-side SHA-256/SHA-512 recomputation and manifest identity checks. Displayed certificate/signature information is a build-side declaration, not independent server-side Authenticode verification.
• Typed plugin-local settings; no edits to the host's core configuration or plugin loader are required.
• MySQL/PostgreSQL init/destroy scripts for both autoincrement and Snowflake modes, plus separate manual schema scripts. Installation and uninstall differences between CLI and the management UI are documented.
• Frontend workspace package declares its component-test dependency. Adding it requires the usual host workspace lockfile update and frontend rebuild, not changes to the root dependency declarations.

Validation performed

• Official catalog check: pnpm validate app_update app_update_ui — 2 passed, 0 failed.
• Verified host baseline: FBA 1.16.0 (26dd3cb7f11ea01b3f9e40597da20fed33b9be2e), official UI 9f4040ce6b86ef414d9b47a243661049f0dd945f, Python 3.12.10, PostgreSQL 17.4 / autoincrement, Node 22.22.2 and pnpm 11.7.0.
• Backend plugin tests: 324 passed, 7 skipped. The skipped tests require dedicated integration/optional SQL-execution environments; they are not counted as successful validation.
• Frontend plugin tests: 82 passed / 10 files; type checking, lint and production build passed on the clean host.
• Live local API verification: 17 checks passed, covering registration, authorization rejection, pagination, multipart upload/digests, signature-information fallback, public YAML, publication/pause behavior, disabled-channel responses, Redis-backed 429 responses and test-data cleanup.
• Plugin-only table/menu initialization and repeat seed were verified without rebuilding the host database or changing existing users/menu grants. Administrator browser pages and permission buttons after re-login were checked.

Detailed backend validation record: https://github.com/SoulEater/app_update/blob/main/docs/VALIDATION_2026-10-28.md

Current scope and unverified areas

• Current artifact contract: Windows x64 / NSIS, strict x.y.z version numbers and the documented application-key-based filenames. This is not a general macOS/Linux/ARM release manager.
• MySQL and Snowflake SQL variants are provided and checked by parser/structural tests, but real MySQL/Snowflake installation has not yet been validated. This submission does not claim all four database/ID combinations have passed runtime acceptance.
• Live upload verification used protocol-test bytes, not installable or genuinely signed software. Real NSIS download, Nginx Range/206, CDN behavior and Electron automatic updating remain unverified.
• Full destructive uninstall/restore and non-admin role acceptance remain pending; the limitations are documented. The management UI's uninstall is not treated as a full rollback.
• Downloaded/static artifacts are public, including known URLs after pause; pausing controls the feed and does not revoke existing downloads or guarantee client downgrade.

We welcome review and requests to narrow the advertised support or supply additional evidence before inclusion.

[SoulEater]

Thanks for reviewing this submission. The initial validate run stopped at Checkout repository, before dependency installation or plugin validation:

Refusing to check out fork pull request code from a 'pull_request_target' workflow.

Run: https://github.com/fastapi-practices/plugins/actions/runs/40809413432/job/123235918792

The current workflow uses pull_request_target with the PR head SHA, and actions/checkout@v5 rejects that trusted-context checkout by default. This PR does not modify workflows or request broader permissions. Could maintainers review the checkout trigger/security context and run validation through an appropriate safe path? We are not requesting that the security safeguard be disabled without review.

For reference, I ran the catalog's unchanged validator locally on the submitted submodule commits:

pnpm validate app_update app_update_ui
Result: 2 passed, 0 failed

This local result does not replace the upstream check; the GitHub run has not reached the TOML validation step yet.

[github-actions]

Plugin TOML Validation Report

Status: ✅ Passed

Validation details

## Plugin TOML Validation Report

**Status**: ✅ All Passed

**Summary**: 2 validated, 0 skipped

### ✅ `app_update`

| Field | Value | Status |
|-------|-------|--------|
| `name` | app_update | ✅ |
| `summary` | 应用管理 | ✅ |
| `version` | 0.2.0 | ✅ |
| `description` | 管理桌面应用版本、更新渠道和 Electron 更新产物 | ✅ |
| `author` | as-fba | ✅ |
| `icon` | - | ➖ |
| `tags` | `storage` | ✅ |
| `database` | `mysql`, `postgresql` | ✅ |

### ✅ `app_update_ui`

| Field | Value | Status |
|-------|-------|--------|
| `name` | app_update_ui | ✅ |
| `summary` | 应用更新管理前端 UI 插件（web-antdv-next） | ✅ |
| `version` | 0.2.0 | ✅ |
| `description` | 管理桌面应用版本、更新渠道和 Electron 更新产物 | ✅ |
| `author` | as-fba | ✅ |
| `icon` | - | ➖ |
| `tags` | `storage` | ✅ |
| `database` | - | ➖ |

View workflow logs