feat(release): prepare v1.0.0 release with Sparkle updates and security hardening

Author: ganeshmshetty

.agents/hooks.json

@@ -1,4 +1,4 @@
-name: CI
+name: Build & Tests
 
 on:
   push:
@@ -8,24 +8,28 @@ on:
   workflow_dispatch:
 
 jobs:
-  test-and-build:
-    name: Build & Unit Test
-    runs-on: macos-26
+  build-and-test:
+    name: Build & Tests
+    runs-on: macos-14
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-        with:
-          submodules: recursive
 
-      - name: Install XcodeGen
-        run: brew install xcodegen
+      - name: Select Xcode 16
+        run: sudo xcode-select -s /Applications/Xcode_16.app || sudo xcode-select -s /Applications/Xcode_16.2.app || sudo xcode-select -s /Applications/Xcode_16.1.app
+
+      - name: Install Tools (XcodeGen & xcbeautify)
+        run: brew install xcodegen xcbeautify
 
       - name: Generate Xcode Project
         run: xcodegen generate
 
-      - name: Run Unit Tests
-        run: ./scripts/test.sh --unit
+      - name: Resolve Package Dependencies
+        run: xcodebuild -resolvePackageDependencies -project OpenClip.xcodeproj
+
+      - name: Run Full Test Suite (0 skips)
+        run: ./scripts/test.sh
 
       - name: Build App (Release)
-        run: xcodebuild -project OpenClip.xcodeproj -scheme OpenClip -configuration Release -destination 'generic/platform=macOS' ARCHS='arm64 x86_64' ONLY_ACTIVE_ARCH=NO build
+        run: ./scripts/package_app.sh

.agents/hooks/post_file_change.sh

@@ -12,26 +12,62 @@ permissions:
 jobs:
   package-and-release:
     name: Package App & Create Release
-    runs-on: macos-26
+    runs-on: macos-14
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-        with:
-          submodules: recursive
+
+      - name: Select Xcode 16
+        run: sudo xcode-select -s /Applications/Xcode_16.app || sudo xcode-select -s /Applications/Xcode_16.2.app || sudo xcode-select -s /Applications/Xcode_16.1.app
 
       - name: Install XcodeGen
         run: brew install xcodegen
 
-      - name: Package App (.zip and .dmg)
-        run: ./scripts/package_app.sh
+      - name: Generate Xcode Project
+        run: xcodegen generate
+
+      - name: Resolve Package Dependencies
+        run: xcodebuild -resolvePackageDependencies -project OpenClip.xcodeproj
+
+      - name: Download Sparkle CLI Tools
+        run: |
+          mkdir -p /tmp/sparkle scripts/bin
+          SPARKLE_SHA256="50612a06038abc931f16011d7903b8326a362c1074dabccb718404ce8e585f0b"
+          curl -fsSL "https://github.com/sparkle-project/Sparkle/releases/download/2.6.4/Sparkle-2.6.4.tar.xz" -o /tmp/Sparkle-2.6.4.tar.xz
+          echo "$SPARKLE_SHA256  /tmp/Sparkle-2.6.4.tar.xz" | shasum -a 256 -c -
+          tar xJ -f /tmp/Sparkle-2.6.4.tar.xz -C /tmp/sparkle
+          cp -R /tmp/sparkle/bin/. scripts/bin/
+
+      - name: Build & Package Release (.zip, .dmg, & appcast.xml)
+        id: build_package
+        env:
+          SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          ./scripts/release_update.sh "$VERSION"
 
       - name: Create GitHub Release
+        id: create_release
         uses: softprops/action-gh-release@v2
         with:
           files: |
-            build/OpenClip.zip
-            build/OpenClip.dmg
+            build/release/*.zip
+            build/release/*.dmg
+            build/release/appcast.xml
           draft: false
-          prerelease: false
+          prerelease: ${{ contains(github.ref, '-') }}
           generate_release_notes: true
+
+      - name: Update Homebrew Tap
+        uses: mislav/bump-homebrew-formula-action@v3
+        if: "!contains(github.ref, '-')"
+        with:
+          formula-name: openclip
+          formula-path: Casks/openclip.rb
+          homebrew-tap: ganeshmshetty/homebrew-tap
+          download-url: https://github.com/ganeshmshetty/openclip/releases/download/${{ github.ref_name }}/OpenClip-v${{ steps.build_package.outputs.version }}.zip
+          commit-message: "openclip ${{ steps.build_package.outputs.version }}"
+        env:
+          COMMITTER_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN || secrets.HOMEBREW_TAP_TOKEN }}

.agents/hooks/safety_guard.sh

@@ -16,4 +16,5 @@ DerivedData/
 .commandcode/
 codebase_bundle.xml
 graphify-out/
-web/
+web/
+scripts/bin/

.github/workflows/ci.yml

@@ -7,10 +7,11 @@ OpenClip is a macOS floating-popup utility (Swift 6, macOS 14+, AppKit + SwiftUI
 The Xcode project is **generated by XcodeGen** from `project.yml`, not edited by hand. After adding/removing `.swift` files, re-run `xcodegen generate` (the scripts re-run it automatically).
 
 ```bash
-git submodule update --init            # populate Extensions/ catalog submodule (required once)
+git submodule update --init            # populate Extensions/ catalog submodule (optional, for extension authoring)
 ./scripts/dev_run.sh                   # build Debug + launch from DerivedData (logs: /tmp/openclip.log)
-./scripts/test.sh                      # full XCTest suite
-./scripts/test.sh ActionRegistryTests  # single test class (flat Tests/OpenClipTests/, one target)
+./scripts/test.sh core                 # fast Core domain test suite (<1s)
+./scripts/test.sh                      # full test suite (0 skips, ~45s)
+./scripts/test.sh ActionRegistryTests  # single test class
 ./scripts/package_app.sh               # Release build -> build/OpenClip.zip
 ./scripts/clean.sh                     # wipe DerivedData/build caches
 ```
@@ -20,7 +21,7 @@ All Swift is Swift 6 with `SWIFT_STRICT_CONCURRENCY: complete`. Targets (see `pr
 ## Architecture hard rules
 
 - **Core is pure** — no AppKit/SwiftUI imports in `Sources/Core/`, and the boundary is enforced by concept, not just import-grepping: UI-only presentation concerns (popup sizing/timing constants, chrome-style presentation metadata) live in `Sources/OpenClip/` — e.g. `PopupMetrics` holds popup/search sizing and `AIResultCardView` renders AI results natively — while `Core/Selection/Constants.swift` keeps only domain/runtime constants (timeouts, key codes, env vars, manifest keys). Platform side-effects live in `Sources/OpenClip/` (runtimes, `ActionResultHandler`, `DefaultActionFactory`).
-- **No direct `UserDefaults.standard`** in new code — route through `SettingsStore` + `SettingKey`. The only remaining raw access is the one-time `aiCloudAPIKey` migration in `AIServiceManager` (read-then-delete); don't add more. Secrets (AI API key, secret options) go to the **Keychain**, never UserDefaults.
+- **No direct `UserDefaults.standard`** in new code — route through `SettingsStore` + `SettingKey`. The only remaining raw access is the one-time `aiCloudAPIKey` migration in `AIServiceManager` (read-then-delete); don't add more. Secrets (AI API key, secret options) go to `SecretStore` (`~/.openclip/secrets.json` with 0600 POSIX permissions), never UserDefaults.
 - **`ActionCoordinator` is the composition root.** Managers report registry changes via `onRegister`/`onUnregister` callbacks only; nothing else touches `ActionRegistry.shared`.
 - **No `switch action.id` string-matching** in UI/presentation — use `ActionChrome` / `ConfigurableAction.preferenceIconName` instead.
 - Any new subprocess-spawning action must kill the child after `Constants.scriptTimeout` (30 s, the shared watchdog); shell/AppleScript/JS runtimes all join the existing `ShellProcessRunner` executor rather than spawning their own.
@@ -54,9 +55,9 @@ The **authoritative manifest / JS-bridge spec is `docs/developer-guide/AGENTS.md
 `Extensions/` is a **git submodule** (the openclip-extensions catalog); `Extensions/raw/` sits inside that submodule's working tree, so scaffolded extensions get committed there.
 
 ## Tests
-
+ 
 - `Tests/OpenClipTests/` is one flat target. Test classes that touch app singletons call `TestIsolation.reset()` in `setUp()`; store-backed tests use `MemorySettingsStore` rather than the real preferences domain.
-- A few deliberate live-integration tests remain and touch real system state (restored afterward): `TextRetrieverTests` (system clipboard), `KeychainActionOptionStoreTests` (real Keychain), `ScriptActionExecutionTests`/`ActionResultHandlerTests` (real subprocesses). Don't remove them without a seam.
+- All unit and integration tests are isolated with in-memory test doubles and temporary directories (including `TextRetrieverTests` and `SecretActionOptionStoreTests`), allowing the full suite to run cleanly in headless CI with zero skips.
 
 ## Docs & housekeeping
 

.github/workflows/release.yml

@@ -48,7 +48,8 @@ Prefer the `scripts/` wrappers over raw `xcodebuild`/`xcodegen`. Full list is in
 | Task | Command |
 | :--- | :--- |
 | Quick compile gate | `timeout -k 5 60 xcodebuild -project OpenClip.xcodeproj -scheme OpenClip -destination 'platform=macOS' build` |
-| Full test suite | `timeout -k 10 60 ./scripts/test.sh` |
+| Core domain tests (<1s) | `./scripts/test.sh core` |
+| Full test suite (0 skips) | `timeout -k 10 60 ./scripts/test.sh` |
 | Single test class | `./scripts/test.sh SettingsStoreTests` |
 | Run the app | `./scripts/dev_run.sh` |
 | Package a Release | `./scripts/package_app.sh` |