macos menu bar app. github security alerts in one feed. http://git.krz.sh/krz/octosentry.git/atom?h=0.5.0 2026-07-17T22:04:15+00:00 2026-07-17T22:04:15+00:00 Christian Cleberg hello@cleberg.net 2026-07-17T22:04:15+00:00 urn:sha1:8e6d29f1806cc569b48d913564c7d80a1c2f2355 Closes #6, #7 (milestone 0.4.0). - GitHubDeviceAuthClient implements the OAuth 2.0 device authorization grant (device code request + poll for token) against GitHub's OAuth App endpoints. Verified against the real endpoints directly. - KeychainTokenStore stores the resulting token in the app's own Keychain item (not synced to iCloud Keychain), no shared entitlement needed since nothing else reads it. - AuthStore drives the sign-in state machine (signedOut / awaitingAuthorization / signedIn) and a new SignInView replaces the old "missing token" error state with an actual sign-in UI. - SecurityEventStore now reads the token from Keychain instead of the GITHUB_TOKEN environment variable, which is fully retired. - Scope requested is security_events, the narrowest available for classic OAuth Apps (no read-only variant exists at this level, unlike fine-grained PATs). Private-repo Dependabot alerts may need broader repo scope — to be confirmed with real-world testing.