Move releases to NextByte infrastructure

[mstallone]

TL;DR

Moves OpenUsage onto a clean NextByte-owned release path, modeled after MX Master Input: NextByte signing, App Store Connect API-key notarization, a fresh Sparkle key/feed, fork-owned URLs and identifiers, and SHA-pinned Actions. It also removes inherited Labeler/Stale automation and all upstream release/telemetry carry-forward.

What was happening

• The fork inherited upstream bundle/iCloud identifiers, release URLs, signing/notarization secret names, Sparkle history handling, and PostHog release automation.
• Labeler and Stale workflows were still active even though this fork has no inherited release or Actions history to preserve.
• The fork had no releases or release secrets, while its inherited gh-pages branch contained upstream appcast/pricing content.
• The public openusage Homebrew cask installs the upstream robinebers/openusage build, not this NextByte fork.
• A first release that published its GitHub assets but failed before writing appcast.xml could not be rerun once a pricing-only gh-pages branch existed.
• The first fork release range contains inherited upstream PR references, but release notes assumed every PR number belonged to this fork.
• Security reports were still routed to the upstream repository and maintainer, while private vulnerability reporting on this fork was disabled.

What this changes

• Uses NextByte team 8KZBNZJBAX, com.mattstallone.openusage, and matching production/development iCloud containers.
• Aligns release secrets and App Store Connect API-key notarization with MX Master Input.
• Starts a fresh GitHub Release/Sparkle history and publishes DMG SHA-256 checksums.
• Pins every third-party GitHub Action to a full commit SHA and validates the tag and all required secrets before building.
• Removes inherited Labeler/Stale workflows, Tauri latest.json carry-forward, PostHog dSYM upload, and the upstream baked telemetry token.
• Points GitHub, Pages, pricing, update, About, CODEOWNERS, CLI defaults, and private security reports at mstallone/openusage.
• Removes the upstream-owned Homebrew installation instruction until a fork-owned cask exists.
• Allows a first-release rerun only when the current tag is the sole GitHub Release; any older history with a missing appcast still fails closed.
• Resolves changelog PR URLs from commit provenance, preserving upstream links for inherited commits and fork links for new commits.
• Enforces the real certificate team OU for local NextByte development signing.

Heads-up

• All eight required release secrets are configured on mstallone/openusage. The production Developer ID iCloud profile was validated against NextByte team 8KZBNZJBAX, bundle ID com.mattstallone.openusage, container iCloud.com.mattstallone.openusage, and the certificate embedded in the release .p12.
• GitHub private vulnerability reporting is enabled on the fork, so the documented advisory form is usable and reports notify this repository's administrators.
• This is intentionally a separate app identity. Existing upstream installs will not receive this fork through their old Sparkle feed and need one manual install.
• No version was changed and no release/tag was created.

Tests

• swift test — 1,367 passed, 4 skipped, 0 failed.
• Added regression coverage for empty history, first-release retry, prior history, and current-plus-prior history.
• Statically verified commit-to-PR resolution for fork PR #2 and inherited upstream PRs #1030 and #1031.
• ./script/build_and_run.sh verify — built, signed with NextByte team 8KZBNZJBAX, and launched.
• codesign --verify --deep --strict --verbose=2 dist/OpenUsage.app.
• Parsed all workflow YAML; ran bash -n on changed release/build/profile scripts; linted both entitlement plists; ran git diff --check.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.