release-codexbar

# CodexBar Release Use for releasing signed/notarized macOS apps, especially repos with Sparkle appcasts and Homebrew casks. ## Start 1. Work from the app repo unless asked otherwise. 2. Check repo state, current version, latest tag/release, and release docs/scripts. 3. Confirm `CHANGELOG.md` is complete, user-facing, deduped, and dated for the release. 4. Prefer the repo release script; patch small script/test blockers instead of bypassing the release path. 5. Never print key material. Keep 1Password references and local key paths as references only. 6. Load `$release-private` if it exists before resolving Peter-owned credential locators. ## Key Material Use `$one-password` for secret handling. `op` only in tmux/persistent shell; no broad `env`, `set`, `export -p`, or secret scans. Known App Store Connect shape: - fields: `private_key_p8`, `key_id`, `issuer_id` - keep all three fields from the same 1Password item; do not mix with stale values from `~/.profile` - resolve Peter-owned item refs from `$release-private` Known Sparkle key: - resolve the private key file from `$release-private` - pass as `SPARKLE_PRIVATE_KEY_FILE` Safe env file pattern: ```text APP_STORE_CONNECT_API_KEY_P8=<1Password ref from release-private> APP_STORE_CONNECT_KEY_ID=<1Password ref from release-private> APP_STORE_CONNECT_ISSUER_ID=<1Password ref from release-private> SPARKLE_PRIVATE_KEY_FILE=<path from release-private> ``` Run with `op run --account my.1password.com --env-file <file> --...