ShipCast
A release pipeline for Mac apps: a Swift CLI that builds, signs, notarizes, and publishes to GitHub Releases + Homebrew + Sparkle, with an optional hosted service for update feeds. Your certs never leave your machine.
A Mac app release toolchain built around one trust boundary: all signing and notarization runs on your own machine, and the optional cloud only ever stores public release metadata (URLs, hashes, ed25519 signatures, notes). A cloud breach can't sign or push a malicious update.
The CLI is a single static Swift binary split into a thin ArgumentParser command layer (init/build/sign/package/release/push/doctor) over a UI-free ShipcastKit engine organized by stage: build (SwiftPM/Xcode, icon and Info.plist generation), sign (an auto-detecting router that picks the Developer ID + notarytool path when certs and Apple credentials are present, otherwise an ad-hoc path), package, and publish (GitHub releases, Homebrew cask generation, Sparkle appcast + ed25519 signing). Every shell-out goes through a ShellRunner protocol with a real and a mock implementation, so cask generation and sign→verify round-trips are testable with golden files and no Apple tooling.
The ad-hoc path ships a generated cask postflight that strips quarantine and runs tccutil reset to solve the orphaned-TCC-grant-after-rebuild problem. The hosted side is a Next.js App Router service on Prisma + Neon that renders Sparkle appcast XML from the database, ingests releases over a bearer-token endpoint, and rolls raw appcast fetch events into daily aggregates via cron to estimate install base with no per-device identifier. The whole thing is architected to run at zero fixed infra cost on free tiers.