alvred

It's not that I'm unsure about any workflows as is, I can usually figure that out from reading the script as you said. I just want to make sure that I am informed of any automatic updates to a workflow.

Sorry about that! So following on @Vero's answer above, I'm assuming that non-Gallery workflows do not have the "update available" arrows? I noticed that when I double click on a workflow's name, some of them (both Gallery and non-Gallery) have "Bundle Id" specified, and it says "When importing a workflow, Alfred uses the Bundle Id to know which workflow to upgrade". Does this mean that for any workflows I don't fully trust, I can just make sure that field is empty to rest assured that it will never autoupdate?

There are quite a few non-Gallery third-party workflows that are useful enough that not using them entirely is not an option for me. I found this page on updates in the docs but I'm having trouble understanding it At the top it says "Add self-updating capabilities to your workflow. It regularly (every day by default) fetches the latest releases from the specified GitHub repository and then asks the user if they want to update the workflow if a newer version is available." and later it says "Alfred-Workflow will automatically check in the background if a newer version of your workflow is available, but will not automatically inform the user nor download and install the update." This seems to imply that I can be sure that no workflows I add will ever update without my knowledge. However, under the "Usage" and "Under the Hood" sections it says "... or you could roll your own update handling using Workflow.update_available and Workflow.start_update() to check for and install newer versions respectively." and "Workflow.start_update() returns False if no update is available, or if one is, it will return True, then download the newer version and tell Alfred to install it in the background.", which seem to contradict the earlier statements. In this case what would I do to see if any scripts are auto-fetching/installing updates in the background? Would I just go through all the "Run Scripts" or "Script Filter" elements in a given workflow's graph and check if the code contains the "start_update()" function?

Is there a way to get notified of workflow automatic updates, and to easily see the changes in a diff? I'm worried about enabling Full Disk Access for Alfred if a malicious actor could update a workflow at any time to start grabbing arbitrary local data from those that have installed it and enabled FDA.