octosentry.git/octosentry/AuthStore.swift, branch 0.6.0macos menu bar app. github security alerts in one feed.
http://git.krz.sh/krz/octosentry.git/atom?h=0.6.02026-07-17T22:34:57+00:00Add repo picker, update checker, and distribution tooling2026-07-17T22:34:57+00:00Christian Cleberghello@cleberg.net2026-07-17T22:34:22+00:00urn:sha1:705c6029ab30adf094e6324006b9fb682d8189f2
Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).
- Repo picker: on-demand broader OAuth scope (security_events repo),
requested only when the "Browse your repos" action is used, never by
default. Lists /user/repos via the existing pagination helper. Granted
scope persisted with backward-compatible decoding for existing state
files. Fixed a bug where a failed re-auth force-signed-out a user who
already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
banner linking to new releases. Skipped on the Mac App Store build via
a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
staple) and Casks/octosentry.rb (Homebrew Cask template), plus
DISTRIBUTION.md documenting both channels end to end.
Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.
Replace env-var PAT with GitHub device authorization flow + Keychain2026-07-17T22:04:15+00:00Christian Cleberghello@cleberg.net2026-07-17T22:04:15+00:00urn:sha1:8e6d29f1806cc569b48d913564c7d80a1c2f2355
Closes #6, #7 (milestone 0.4.0).
- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
grant (device code request + poll for token) against GitHub's OAuth
App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
Keychain item (not synced to iCloud Keychain), no shared entitlement
needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
awaitingAuthorization / signedIn) and a new SignInView replaces the
old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
classic OAuth Apps (no read-only variant exists at this level, unlike
fine-grained PATs). Private-repo Dependabot alerts may need broader
repo scope — to be confirmed with real-world testing.