feat: add Sparkle automatic update support

[lonewolfyx]

• Add Sparkle dependency and run background update checks on app launch
• Embed Sparkle.framework during DMG packaging and write Sparkle plist keys
• Configure GitHub raw appcast feed and default Sparkle EdDSA public key
• Add initial appcast.xml and an appcast generation helper script
• Document the Sparkle release flow and non-Developer-ID distribution notes

Summary by CodeRabbit

• New Features

  • Added automatic update support, allowing the app to check for and receive updates in the background.
  • Added release feed support so updates can be distributed through a dedicated update channel.

• Bug Fixes

  • Improved app packaging and signing so the update framework is included correctly and the app launches with update support enabled.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 59a7d736-7bc3-4d80-873b-5ce01fbff2a3

📥 Commits

Reviewing files that changed from the base of the PR and between 9e11d83 and 8d57ea0.

📒 Files selected for processing (5)

• Package.swift
• Sources/AgentBar/App/AppDelegate.swift
• appcast.xml
• scripts/build-dmg.sh
• scripts/update-appcast.sh

---

📝 Walkthrough

Walkthrough

This PR integrates the Sparkle framework for auto-updates: it adds Sparkle as a Swift package dependency, wires updater initialization into AppDelegate based on Info.plist configuration, embeds Sparkle.framework and signing changes in the DMG build script, adds a base appcast.xml, and introduces a new appcast-generation script.

Changes

Sparkle auto-update integration

Layer / File(s)	Summary
Package dependency and linker configuration Package.swift	Adds Sparkle package dependency (from 2.9.4), links AgentBar target against the Sparkle product, and adds rpath linker settings for @executable_path/../Frameworks.
In-app updater wiring Sources/AgentBar/App/AppDelegate.swift	Imports Sparkle, calls configureUpdater() during launch, initializes SPUStandardUpdaterController conditionally via hasSparkleConfiguration, and starts background update checks.
DMG build script: framework embedding, signing, Info.plist scripts/build-dmg.sh	Adds Sparkle environment defaults, embeds Sparkle.framework via new copy_sparkle_framework(), deep-signs the app bundle, and injects Sparkle keys into generated Info.plist with a missing-key warning.
Appcast feed file and generation script appcast.xml, scripts/update-appcast.sh	Adds a base RSS appcast feed and a new script that runs Sparkle's generate_appcast tool against a DMG to produce and copy an updated appcast.xml.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• lonewolfyx/codex-agent-bar#2: Both PRs touch scripts/build-dmg.sh, with this PR extending that script to embed Sparkle, adjust signing, and inject Sparkle Info.plist keys.

Suggested labels: enhancement, build, feature

Suggested reviewers: lonewolfyx

Poem

A rabbit hunts for updates near,
Sparkle's magic, feed sincere,
Frameworks tucked in bundles tight,
Appcast whispers version's light,
Hop, sign, embed — the build takes flight! 🐇✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/auto-updates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}