octosentry.git/octosentry.xcodeproj/project.pbxproj, branch 1.0.1

Normalize repo watch-list entries in addRepo

2026-07-25T21:47:21+00:00

Store the canonical "owner/repo" reconstructed from the parsed parts instead of the raw input, so stray slashes (e.g. "owner/repo/") can't create an entry that silently 404s on refresh. Also compare case-insensitively for duplicates, since GitHub owner/repo names are case-insensitive. Bumps marketing version to 1.0.1. Co-Authored-By: Claude Opus 4.8

Add repo picker, update checker, and distribution tooling

2026-07-17T22:34:57+00:00

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0). - Repo picker: on-demand broader OAuth scope (security_events repo), requested only when the "Browse your repos" action is used, never by default. Lists /user/repos via the existing pagination helper. Granted scope persisted with backward-compatible decoding for existing state files. Fixed a bug where a failed re-auth force-signed-out a user who already had a valid narrower-scope token. - Update checker: polls this repo's GitHub Releases API, surfaces a banner linking to new releases. Skipped on the Mac App Store build via a runtime receipt check rather than a separate build configuration. - Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole time unrelated to our git tags — now 1.0.0, matching this release. - Added PrivacyInfo.xcprivacy (no tracking, no collected data). - Added scripts/build-dmg.sh (archive, Developer ID export, notarize, staple) and Casks/octosentry.rb (Homebrew Cask template), plus DISTRIBUTION.md documenting both channels end to end. Entitlements were already identical across all builds — no divergence needed there. What remains for actual App Store submission and notarized DMG builds is account-specific (Apple Developer Program membership, certificates, App Store Connect submission) and can't be done from here; documented clearly in DISTRIBUTION.md.

Scaffold octosentry MVP: unified GitHub security alert feed

2026-07-17T21:06:47+00:00

MenuBarExtra popover aggregating Dependabot, code scanning, and secret scanning alerts for a single repo into one severity-ranked stream. Swift 6 strict concurrency, zero third-party dependencies, PAT-via-env-var auth as a dev-only shortcut ahead of the device authorization flow.