feat(sparkle-release): support dedicated updates repository

[diazdesandi]

Summary

• Add optional updates-repository + updates-token to actions/sparkle-release
• When set: load/publish appcast on that repo’s gh-pages, point enclosure URLs at its releases, and prefer its prior ZIPs for deltas (fallback to caller repo for pre-cutover history)
• When empty: legacy behavior unchanged (feed + downloads on the caller repo)
• Document the DMG-vs-updates split in the README

Test plan

• Review action inputs/defaults for backward compatibility
• After merge, pin new SHA from Thaw release.yml with updates-repository: thaw-app/updates
• Dry-run a draft release: DMG on Thaw, ZIP/deltas + appcast on updates

Summary by CodeRabbit

• New Features

  • Added support for hosting Sparkle update feeds and downloadable artifacts in a dedicated repository.
  • Added configuration options for the updates repository and its access token.
  • Added a download repository output for workflow integration.
  • Supports generating deltas from releases stored outside the caller repository.
  • Allows release links to be customized with release-html-url.

• Documentation

  • Added setup examples, repository layout guidance, and clarified required permissions and legacy behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d367f126-430a-4215-9e9c-b92f5c63b15e

📥 Commits

Reviewing files that changed from the base of the PR and between 914db7d and 9944dd9.

📒 Files selected for processing (2)

• README.md
• actions/sparkle-release/action.yml

---

📝 Walkthrough

Walkthrough

sparkle-release now supports storing Sparkle update payloads and appcast content in a dedicated repository, with separate authentication, artifact retrieval, URL generation, and gh-pages publishing behavior. Documentation describes configuration, repository layout, and required permissions.

Changes

Sparkle updates repository support

Layer / File(s)	Summary
Repository inputs and resolution actions/sparkle-release/action.yml	Adds updates-repository, updates-token, and download-repository; resolves feed and download repositories and validates required authentication.
Appcast and prior artifact retrieval actions/sparkle-release/action.yml	Loads appcasts through the GitHub API when needed and retrieves prior ZIPs and tags from the configured download repository or caller repository.
Appcast URLs and gh-pages publishing actions/sparkle-release/action.yml, README.md	Generates download URLs for the download repository, preserves caller-repository tag links by default, publishes appcasts to the feed repository, and documents setup and permissions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CallerWorkflow
  participant SparkleRelease
  participant GitHubAPI
  participant FeedRepository
  participant DownloadRepository
  CallerWorkflow->>SparkleRelease: Configure updates repository and token
  SparkleRelease->>GitHubAPI: Load appcast and prior tag metadata
  SparkleRelease->>DownloadRepository: Retrieve prior release ZIPs
  SparkleRelease->>SparkleRelease: Generate and sign appcast.xml
  SparkleRelease->>FeedRepository: Push appcast.xml to gh-pages

Loading

Possibly related PRs

• thaw-app/org-ci#1: Introduced the composite Sparkle release action extended by this repository-splitting support.

Suggested reviewers: nightah, copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding support for a dedicated updates repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/sparkle-updates-repo

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Adds support to actions/sparkle-release for hosting Sparkle appcast + ZIP/deltas in a dedicated “updates” repository (instead of the caller repo), while documenting the recommended DMG-vs-updates split.

Changes:

• Document using a dedicated Sparkle updates repository and its required permissions/token.
• Add updates-repository / updates-token inputs and route appcast loading/publishing and download URL generation to the selected repo.
• Prefer prior ZIPs from the updates repo for delta generation, with fallback to the caller repo for pre-cutover history.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
README.md	Documents the dedicated updates-repository setup, example usage, and permissions.
actions/sparkle-release/action.yml	Adds inputs + logic to resolve feed/download repos, read/write appcast from the chosen repo, and generate enclosure URLs against the chosen download repo.

Comments suppressed due to low confidence (1)

actions/sparkle-release/action.yml:98

• When updates-repository is set, this step only requires updates-token if publish-appcast is true. But later steps also use the token to read appcast.xml from FEED_REPO and to list/download prior ZIPs from DOWNLOAD_REPO. Since github.token is repo-scoped, those cross-repo reads will fail without updates-token, preventing delta history from being loaded.

Consider requiring updates-token whenever updates-repository is set (or alternatively implement an unauthenticated/public-read path).

          if [[ "$PUBLISH_APPCAST" == "true" && -z "$UPDATES_TOKEN" ]]; then
            echo "updates-token is required when updates-repository is set and publish-appcast is true"
            exit 1
          fi

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.