From 8e6d29f1806cc569b48d913564c7d80a1c2f2355 Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Fri, 17 Jul 2026 17:04:15 -0500 Subject: Replace env-var PAT with GitHub device authorization flow + Keychain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #6, #7 (milestone 0.4.0). - GitHubDeviceAuthClient implements the OAuth 2.0 device authorization grant (device code request + poll for token) against GitHub's OAuth App endpoints. Verified against the real endpoints directly. - KeychainTokenStore stores the resulting token in the app's own Keychain item (not synced to iCloud Keychain), no shared entitlement needed since nothing else reads it. - AuthStore drives the sign-in state machine (signedOut / awaitingAuthorization / signedIn) and a new SignInView replaces the old "missing token" error state with an actual sign-in UI. - SecurityEventStore now reads the token from Keychain instead of the GITHUB_TOKEN environment variable, which is fully retired. - Scope requested is security_events, the narrowest available for classic OAuth Apps (no read-only variant exists at this level, unlike fine-grained PATs). Private-repo Dependabot alerts may need broader repo scope — to be confirmed with real-world testing. --- README.md | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 2415317..2b9497e 100644 --- a/README.md +++ b/README.md @@ -14,33 +14,32 @@ just a fast triage view that deep-links out to github.com to act. - Click an alert to open it directly on github.com - Errors and unavailable sources (e.g. an alert type disabled for a repo) are surfaced in the popover instead of failing silently +- Add or remove watched repos from the popover; a background poll keeps + the feed fresh even while it's closed +- Sign in with GitHub via device authorization — no password or manually + generated token needed, and nothing is ever typed into the app itself - Zero third-party dependencies — pure SwiftUI and URLSession ## Requirements - macOS 14 or later -- A GitHub personal access token (fine-grained or classic) with read - access to Dependabot alerts, code scanning alerts, and secret scanning - alerts for the repo you want to watch +- A GitHub account with access to whatever repos you want to watch ## Usage -octosentry currently watches a single, hardcoded repo and reads its -GitHub token from the `GITHUB_TOKEN` environment variable — this is a -development-only shortcut ahead of a proper device authorization flow. - 1. Build and run the app (see Building, below). -2. Set `GITHUB_TOKEN` in your **personal, non-shared** Xcode scheme - (Product → Scheme → Edit Scheme… → Run → Arguments → - Environment Variables). Don't add it to a shared scheme — that would - commit the token to git. -3. Click the shield icon in the menu bar to open the popover. It fetches - automatically on open, or use the refresh button. +2. Click the shield icon in the menu bar, then **Sign in with GitHub**. + You'll get a short code — click **Open GitHub**, enter the code there, + and authorize. The popover updates automatically once that completes. +3. Click the gear icon to add or remove watched repos (`owner/repo`). 4. Click any alert to open it on github.com. If a source shows as unavailable, it usually means that alert type is -disabled for the repo, or the token is missing that one permission — not -that something is broken. +disabled for the repo, or your account lacks permission for it — not +that something is broken. Classic OAuth's `security_events` scope +(what device flow grants) may not be sufficient for Dependabot alerts on +private repos — if you hit that, it needs verifying against a real +private repo case by case. ## Building -- cgit v1.2.3