Post the command that tests a ct/ or install/ change

Reviewing a script change meant working out the URL yourself, and the
obvious guess is wrong: curling the branch URL alone gives you the ct/
script from the PR and the install/ script from main, because each script
pins _CS_DEFAULT_URL to main and that pin is what fills
COMMUNITY_SCRIPTS_URL when it is unset. Frequently the install script is
the only thing that changed.

So the comment spells out both lines, per changed app.

Only for scripts already on the core bootstrap. The older one-liner
resolves everything from ProxmoxVE/main and ignores the variable, so a
command built for it would install main and look like it passed --  worse
than no comment. Those are named instead, with what to do about them.

pull_request_target for fork PRs, and nothing from the PR is checked out
or executed: the file list and the bootstrap line come from the API, and
a branch name that is not [A-Za-z0-9._/-]+ stops the run rather than
reaching a fenced code block.

.github/workflows/pr-test-command.yml

@@ -0,0 +1,179 @@
+name: PR test command
+
+# A reviewer should not have to work out which URL exercises a pull request.
+# The engine and the scripts resolve independently, so pointing
+# COMMUNITY_SCRIPTS_URL at this PR's branch runs the changed ct/ and install/
+# scripts against the production engine. This posts that command, filled in.
+#
+# Only for scripts that already bootstrap from community-scripts/core: the older
+# one-liner ignores COMMUNITY_SCRIPTS_URL entirely, so a command built for it
+# would quietly install main and look like it passed.
+#
+# pull_request_target, so the comment can be posted on PRs from forks -- which is
+# most of them. Nothing from the pull request is checked out or executed here.
+# The file list, the branch name and the bootstrap line all come from the API,
+# the branch name is pattern-checked before it reaches the comment, and the body
+# is assembled in JavaScript, so no attacker-controlled string reaches a shell.
+
+on:
+  pull_request_target:
+    branches: ["main"]
+    types: [opened, synchronize, reopened]
+    paths:
+      - "ct/**"
+      - "install/**"
+
+jobs:
+  comment:
+    if: github.repository == 'community-scripts/ProxmoxVE'
+    runs-on: self-hosted
+    permissions:
+      pull-requests: write
+      contents: read
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const MARKER = '<!-- pr-test-command -->';
+            const MAX_APPS = 10;
+
+            const pr = context.payload.pull_request;
+            const head = pr.head.repo;            // null when the fork is gone
+            if (!head) return;
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Git allows backticks in a ref name, and this one ends up inside a
+            // fenced block. Anything outside the ordinary set is not worth
+            // rendering, so bail rather than escape.
+            const ref = pr.head.ref;
+            if (!/^[A-Za-z0-9._\/-]+$/.test(ref)) return;
+            const base = `https://raw.githubusercontent.com/${head.full_name}/${ref}`;
+
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner, repo, pull_number: pr.number, per_page: 100,
+            });
+
+            // ct/foo.sh and install/foo-install.sh are the same app. A removed
+            // file has nothing left to run.
+            const apps = new Map();               // slug -> {ct, install}
+            for (const f of files) {
+              if (f.status === 'removed') continue;
+              let m = f.filename.match(/^ct\/([a-z0-9][a-z0-9._-]*)\.sh$/);
+              if (m) { apps.set(m[1], { ...apps.get(m[1]), ct: true }); continue; }
+              m = f.filename.match(/^install\/([a-z0-9][a-z0-9._-]*)-install\.sh$/);
+              if (m) apps.set(m[1], { ...apps.get(m[1]), install: true });
+            }
+            if (apps.size === 0) return;
+
+            // Read the ct script at the PR head to see which engine it loads.
+            // Read only -- it is never sourced or run.
+            async function bootstrapOf(slug) {
+              try {
+                const res = await github.rest.repos.getContent({
+                  owner: head.owner.login, repo: head.name,
+                  path: `ct/${slug}.sh`, ref: pr.head.sha,
+                });
+                if (!res.data.content) return 'unknown';
+                const text = Buffer.from(res.data.content, 'base64').toString('utf8');
+                const firstLines = text.split('\n').slice(0, 12).join('\n');
+                return /_cs_boot=/.test(firstLines) ? 'core' : 'legacy';
+              } catch (e) {
+                return e.status === 404 ? 'missing' : 'unknown';
+              }
+            }
+
+            const ready = [], legacy = [], missing = [];
+            for (const slug of [...apps.keys()].sort()) {
+              const kind = await bootstrapOf(slug);
+              if (kind === 'core') ready.push(slug);
+              else if (kind === 'legacy') legacy.push(slug);
+              else if (kind === 'missing') missing.push(slug);
+            }
+
+            const lines = [MARKER];
+
+            if (ready.length > 0) {
+              const shown = ready.slice(0, MAX_APPS);
+              lines.push(
+                '### Try this branch',
+                '',
+                'The engine and the scripts resolve independently, so this runs the changed',
+                '`ct/` and `install/` scripts against the **production** engine:',
+                '',
+              );
+              for (const slug of shown) {
+                lines.push(
+                  '```bash',
+                  `export COMMUNITY_SCRIPTS_URL=${base}`,
+                  `bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/${slug}.sh")"`,
+                  '```',
+                  '',
+                );
+              }
+              if (ready.length > shown.length) {
+                lines.push(
+                  `${ready.length - shown.length} more script(s) changed; same command, different slug.`,
+                  '',
+                );
+              }
+              lines.push(
+                'Both lines are needed. Each script pins `_CS_DEFAULT_URL` to `main`, and that',
+                'pin is what fills `COMMUNITY_SCRIPTS_URL` when the variable is unset — so',
+                'curling the branch URL on its own gives you the `ct/` script from this PR and',
+                'the `install/` script from `main`. Frequently the one you meant to test.',
+                '',
+                'The same command works on an Incus host: the engine detects the platform and',
+                'loads the matching backend, while the scripts still come from this branch.',
+                '',
+                '<details><summary>Useful while testing</summary>',
+                '',
+                '`dev_mode=net` logs every fetch with status and URL, which is the quickest way',
+                'to confirm the branch is really being used. `dev_mode=keep` stops a failed',
+                'build from deleting the container along with the evidence.',
+                '',
+                '```bash',
+                `export COMMUNITY_SCRIPTS_URL=${base}`,
+                `dev_mode=net,keep bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/${shown[0]}.sh")"`,
+                '```',
+                '</details>',
+              );
+            }
+
+            if (legacy.length > 0) {
+              lines.push(
+                '',
+                ready.length > 0 ? '---' : '### Not testable this way yet',
+                '',
+                `\`${legacy.join('`, `')}\` still uses the older one-liner bootstrap, which`,
+                'resolves everything from `ProxmoxVE/main` and ignores `COMMUNITY_SCRIPTS_URL`.',
+                'There is no way to point it at this branch — test it from a checkout on the',
+                'host instead, or migrate the script to the `_cs_boot` bootstrap first.',
+              );
+            }
+
+            if (missing.length > 0) {
+              lines.push(
+                '',
+                `No \`ct/\` script found for \`${missing.join('`, `')}\`, so there is nothing to`,
+                'run. If the install script was renamed, its `ct/` counterpart needs the same',
+                'name.',
+              );
+            }
+
+            if (lines.length === 1) return;   // marker only, nothing worth saying
+            const body = lines.join('\n');
+
+            // Update in place rather than posting again on every push.
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number: pr.number, per_page: 100,
+            });
+            const mine = comments.find(c => c.body.includes(MARKER));
+            if (mine) {
+              if (mine.body !== body) {
+                await github.rest.issues.updateComment({ owner, repo, comment_id: mine.id, body });
+              }
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body });
+            }

CHANGELOG.md

@@ -527,6 +527,34 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-28
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - pve-ups: fix: add pip binary  [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16820](https://github.com/community-scripts/ProxmoxVE/pull/16820))
+
+## 2026-08-27
+
+### 🆕 New Scripts
+
+  - Seanime ([#16777](https://github.com/community-scripts/ProxmoxVE/pull/16777))
+- Yopass ([#16778](https://github.com/community-scripts/ProxmoxVE/pull/16778))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - excalidash: Add a sed to switch to the correct DB Provider [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#16814](https://github.com/community-scripts/ProxmoxVE/pull/16814))
+    - fix(stirling-pdf): remove broken ExecStop using %n [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#16813](https://github.com/community-scripts/ProxmoxVE/pull/16813))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Fix: Incorporate the new update functions to prevent a empty grep on … [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#16809](https://github.com/community-scripts/ProxmoxVE/pull/16809))
+
 ## 2026-08-26
 
 ### 🆕 New Scripts

ct/excalidash.sh

@@ -42,6 +42,7 @@ function update_script() {
     msg_info "Configuring Database Provider (${DATABASE_PROVIDER:-sqlite})"
     cd /opt/excalidash/backend
     sed -i '/datasource db {/,/}/ s/provider = env("[^"]*")/provider = "'"${DATABASE_PROVIDER:-sqlite}"'"/' prisma/schema.prisma
+    sed -i '/datasource db {/,/}/ s/provider = "[^"]*"/provider = "'"${DATABASE_PROVIDER:-sqlite}"'"/' prisma/schema.prisma
     mv prisma/migrations/"${DATABASE_PROVIDER:-sqlite}"/* prisma/migrations/
     rm -rf prisma/migrations/postgresql prisma/migrations/sqlite
     msg_ok "Configured Database Provider"

ct/headers/seanime

@@ -0,0 +1,6 @@
+   _____                  _              
+  / ___/___  ____ _____  (_)___ ___  ___ 
+  \__ \/ _ \/ __ `/ __ \/ / __ `__ \/ _ \
+ ___/ /  __/ /_/ / / / / / / / / / /  __/
+/____/\___/\__,_/_/ /_/_/_/ /_/ /_/\___/ 
+                                         

ct/headers/yopass

@@ -0,0 +1,6 @@
+__  __                           
+\ \/ /___  ____  ____ ___________
+ \  / __ \/ __ \/ __ `/ ___/ ___/
+ / / /_/ / /_/ / /_/ (__  |__  ) 
+/_/\____/ .___/\__,_/____/____/  
+       /_/                       

ct/pve-ups.sh

@@ -41,7 +41,7 @@ function update_script() {
 
     msg_info "Updating Application"
     cd /opt/pve-usv
-    $STD uv venv --clear venv
+    $STD uv venv --clear --seed venv
     $STD uv pip install --python venv/bin/python .
     chown -R pveusv:pveusv /opt/pve-usv
     chmod 0755 deploy/pve-usv-agent.sh

ct/seanime.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: hasan-ismail
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://seanime.app/
+
+APP="Seanime"
+var_tags="${var_tags:-media;anime;manga}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+var_gpu="${var_gpu:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/seanime ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "seanime" "5rahim/seanime"; then
+    msg_info "Stopping Service"
+    systemctl stop seanime
+    msg_ok "Stopped Service"
+
+    create_backup /opt/seanime-data/config.toml
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "seanime" "5rahim/seanime" "prebuild" "latest" "/opt/seanime" "seanime-[0-9]*_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+    chmod +x /opt/seanime/seanime
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start seanime
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:43211${CL}"

ct/yopass.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/jhaals/yopass
+
+APP="Yopass"
+var_tags="${var_tags:-security;secrets}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/yopass ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "yopass" "jhaals/yopass"; then
+    msg_info "Stopping Service"
+    systemctl stop yopass
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+
+    msg_info "Building Yopass"
+    cd /opt/yopass
+    $STD go build -ldflags "-X main.version=$(cat ~/.yopass)" ./cmd/yopass-server
+    cd /opt/yopass/website
+    $STD yarn install --network-timeout 600000
+    $STD yarn build
+    msg_ok "Built Yopass"
+
+    msg_info "Starting Service"
+    systemctl start yopass
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}:1337${CL}"

install/pve-ups-install.sh

@@ -27,7 +27,7 @@ install -d -o pveusv -g pveusv -m 0750 \
   /var/lib/pve-usv/updates
 chown -R pveusv:pveusv /opt/pve-usv
 cd /opt/pve-usv
-$STD uv venv --clear venv
+$STD uv venv --clear --seed venv
 $STD uv pip install --python venv/bin/python .
 chmod 0755 deploy/pve-usv-agent.sh
 msg_ok "Set up Application"

install/seanime-install.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: hasan-ismail
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://seanime.app/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_hwaccel
+
+msg_info "Installing FFmpeg"
+setup_deb822_repo \
+  "jellyfin" \
+  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
+  "https://repo.jellyfin.org/debian" \
+  "$(get_os_info codename)"
+$STD apt install -y jellyfin-ffmpeg7
+ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
+ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe
+msg_ok "Installed FFmpeg"
+
+fetch_and_deploy_gh_release "seanime" "5rahim/seanime" "prebuild" "latest" "/opt/seanime" "seanime-[0-9]*_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+chmod +x /opt/seanime/seanime
+
+msg_info "Configuring Seanime"
+SEANIME_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+mkdir -p /opt/seanime-data
+cat <<EOF >/opt/seanime-data/config.toml
+[server]
+password = "${SEANIME_PASSWORD}"
+EOF
+cat <<EOF >/root/seanime.creds
+Seanime URL: http://${LOCAL_IP}:43211
+Password: ${SEANIME_PASSWORD}
+EOF
+msg_ok "Configured Seanime"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/seanime.service
+[Unit]
+Description=Seanime
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/seanime
+ExecStart=/opt/seanime/seanime --datadir /opt/seanime-data --host 0.0.0.0
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now seanime
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/stirling-pdf-install.sh

@@ -147,7 +147,6 @@ Group=root
 EnvironmentFile=/opt/Stirling-PDF/.env
 WorkingDirectory=/opt/Stirling-PDF
 ExecStart=/usr/bin/java -jar Stirling-PDF.jar
-ExecStop=/bin/kill -15 %n
 Restart=always
 RestartSec=10
 

install/yopass-install.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/jhaals/yopass
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y redis-server
+systemctl enable -q --now redis-server
+msg_ok "Installed Dependencies"
+
+setup_go
+NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
+
+fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+
+msg_info "Building Yopass"
+cd /opt/yopass
+$STD go build -ldflags "-X main.version=$(cat ~/.yopass)" ./cmd/yopass-server
+cd /opt/yopass/website
+$STD yarn install --network-timeout 600000
+$STD yarn build
+msg_ok "Built Yopass"
+
+msg_info "Generating SSL Certificate"
+mkdir -p /opt/yopass/certificates
+openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+  -keyout /opt/yopass/certificates/key.pem \
+  -out /opt/yopass/certificates/cert.pem \
+  -subj "/C=US/ST=State/L=City/O=Yopass/CN=${LOCAL_IP}" \
+  -addext "subjectAltName=IP:${LOCAL_IP},DNS:localhost,IP:127.0.0.1" \
+  2>/dev/null
+chmod 600 /opt/yopass/certificates/key.pem
+chmod 644 /opt/yopass/certificates/cert.pem
+msg_ok "Generated SSL Certificate"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/yopass.service
+[Unit]
+Description=Yopass
+Wants=network-online.target
+After=network-online.target redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/yopass
+ExecStart=/opt/yopass/yopass-server --address 0.0.0.0 --port 1337 --tls-cert /opt/yopass/certificates/cert.pem --tls-key /opt/yopass/certificates/key.pem --database redis --redis redis://127.0.0.1:6379/0 --asset-path /opt/yopass/website/dist
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now yopass
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

tools/pve/update-apps.sh

@@ -173,7 +173,11 @@ function detect_service() {
     rm -rf "$tmpdir"
     return 1
   fi
-  service=$(grep -oE '/ct/[a-zA-Z0-9._-]+\.sh' "$update_file" 2>/dev/null | head -n1 | sed 's|.*/ct/||; s|\.sh$||')
+
+  service=$(sed -n -E 's/^[[:space:]]*export[[:space:]]+UPDATE_SCRIPT_NAME=["'"'"']?([a-zA-Z0-9._-]+).*/\1/p' "$update_file" | head -n1)
+  [[ -z "$service" ]] && service=$(sed -n -E 's/^[[:space:]]*export[[:space:]]+SCRIPT_SLUG=["'"'"']?([a-zA-Z0-9._-]+).*/\1/p' "$update_file" | head -n1)
+  [[ -z "$service" ]] && service=$(grep -oE '/ct/[a-zA-Z0-9._-]+\.sh' "$update_file" 2>/dev/null | head -n1 | sed 's|.*/ct/||; s|\.sh$||')
+
   rm -rf "$tmpdir"
 }