From f59d9cfa2235966438ba8d534c1ff8cfabc240f7 Mon Sep 17 00:00:00 2001
From: rene <diaz.de.sandi.7@gmail.com>
Date: Tue, 28 Jul 2026 05:13:33 -0700
Subject: [PATCH] feat(repos): add updates repo for Sparkle appcast

Carve the public update feed out of website into a dedicated, locked-down
Pages host so release automation owns the feed and marketing can evolve
independently.
---
 config/repos.yaml | 25 +++++++++++++++++++++++--
 config/teams.yaml |  5 +++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/config/repos.yaml b/config/repos.yaml
index 9554753..17ff17b 100644
--- a/config/repos.yaml
+++ b/config/repos.yaml
@@ -8,7 +8,7 @@
 # for repo-specific overrides (e.g. pin a CI check name).
 repos:
   - name: website
-    description: Thaw project website and Sparkle appcast (GitHub Pages).
+    description: Thaw project website (GitHub Pages).
     visibility: public
     homepage: https://thaw-app.github.io/website/
     topics:
@@ -23,6 +23,28 @@ repos:
     deleteBranchOnMerge: true
     autoInit: true
 
+  - name: updates
+    description: >-
+      Sparkle appcast and signed update metadata for Thaw (GitHub Pages).
+      Stable public feed for in-app updates; written by release automation only.
+    visibility: public
+    homepage: https://thaw-app.github.io/updates/
+    topics:
+      - thaw
+      - macos
+      - sparkle
+      - appcast
+      - github-pages
+      - updates
+    mergeStrategies:
+      - squash
+    deleteBranchOnMerge: true
+    autoInit: true
+    hasIssues: false
+    hasWiki: false
+    hasProjects: false
+    hasDiscussions: false
+
   - name: homebrew-tap
     description: Homebrew tap formulas for Thaw releases.
     visibility: public
@@ -36,7 +58,6 @@ repos:
     deleteBranchOnMerge: true
     autoInit: true
 
-
   - name: brand-assets
     description: Shared Thaw brand assets — headers, icons, packaging art, marketing.
     visibility: public
diff --git a/config/teams.yaml b/config/teams.yaml
index 4c92d48..17b0ff5 100644
--- a/config/teams.yaml
+++ b/config/teams.yaml
@@ -17,6 +17,11 @@ repoAccess:
     - team: contributors
       permission: push
 
+  # Maintainers only — feed must stay CI/admin-writable, not day-to-day push.
+  updates:
+    - team: maintainers
+      permission: admin
+
   homebrew-tap:
     - team: maintainers
       permission: admin