Checks and workflows for a weekly update routine

[mksd0398]

Summary

Groundwork for a weekly routine that keeps Nitrogen current and releases the updates itself. Nothing here changes the published package, so there is no version bump.

• npm run check:updates compares what the repo pins with what is current, and names the lines to change.
  • It covers npm dependency ranges (CLI and both templates), the Shopify API version, the Functions Node runtime, GitHub Actions versions, and new majors of the Firebase and Shopify CLIs.
  • Each finding is auto, optional, manual or unknown.
  • It reads only npm's registry and raw.githubusercontent.com, the hosts a cloud routine can reach.
• npm run check:graphql validates every query the templates send against Shopify's real schema, for the pinned version or one passed with --version.
  • The templates' tests stub Shopify, so nothing else would notice a field a new API version removed.
  • It also lists deprecated fields.
• A Test workflow runs the full suite and the schema check on every pull request and on master, on Node 24.
• The publish workflow now also starts when package.json changes on master, and tags what it published.
  • A cloud routine can merge its own PR but cannot push a tag, so merging a version bump has to be a release.
  • Tag pushes and manual runs still work, and a version already on npm is still skipped.
  • Runs are serialised.
  • The tag is pushed by a separate job with its own write permission.
  • A manual run on a branch other than master publishes nothing.

What the checks say today

• check:updates: one finding, auto: Shopify API 2026-07 → 2026-10, across 8 lines. Everything else is current.
• check:graphql: all 6 queries are valid against both 2026-07 and 2026-10. Four deprecated fields are in use and still work:
  • Product.featuredImage
  • Product.images
  • ShopPlan.displayName
  • Shop.billingAddress

Test plan

• npm run test:e2e: 58/58 (42 existing, 16 new).
• Both checks run against live sources.
• Both workflow files parse; the Test workflow runs on this PR.
• The publish workflow's new trigger and tag job first run for real on the next version bump.

🤖 Generated with Claude Code