fix(release): sign Sparkle's Autoupdate helper so notarization passes

The inside-out signing sweep in build_release.yml and nightly.yml globbed
only *.framework/*.xpc/*.app/*.dylib, so Sparkle's bare, extension-less
Autoupdate helper (Sparkle.framework/Versions/B/Autoupdate) was never
re-signed. It kept xcodebuild's ad-hoc signature (no Developer ID, no secure
timestamp), which was the sole binary failing notarization with statusCode
4000, blocking the v2.0.0 release and every daily nightly build.

Add `-o -name "Autoupdate" -type f` to the sign sweep in both workflows so
the helper gets the Developer ID identity and a secure timestamp like every
other nested binary (-type f skips the framework's Autoupdate symlink).

Verified locally with the real Developer ID cert: Autoupdate now reports the
Developer ID authority plus secure timestamp and codesign --verify --deep
--strict passes.

Refresh the 2.0.0 changelog date to 2026-07-01 and record the fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: nathanialhenniges

.github/workflows/build_release.yml

@@ -210,8 +210,14 @@ jobs:
           #    deepest path first. --preserve-metadata=entitlements keeps each
           #    bundle's own entitlements from the xcodebuild signature instead
           #    of dropping them.
+          #    "Autoupdate" is Sparkle's bare, extension-less helper tool
+          #    (Sparkle.framework/Versions/B/Autoupdate). The name globs below
+          #    miss it, so it kept xcodebuild's ad-hoc signature (no Developer
+          #    ID, no secure timestamp) and was the sole binary failing
+          #    notarization (statusCode 4000). Match it by name (-type f skips
+          #    the framework's Autoupdate symlink so the real Mach-O signs once).
           find "$APP_PATH/Contents" \
-            \( -name "*.framework" -o -name "*.xpc" -o -name "*.app" -o -name "*.dylib" \) \
+            \( -name "*.framework" -o -name "*.xpc" -o -name "*.app" -o -name "*.dylib" -o -name "Autoupdate" -type f \) \
             -print0 \
             | while IFS= read -r -d '' nested; do
                 printf '%s\t%s\0' "$(printf '%s' "$nested" | tr -cd '/' | wc -c)" "$nested"

.github/workflows/nightly.yml

@@ -227,8 +227,11 @@ jobs:
           ENTITLEMENTS="apps/native/WolfWave/WolfWave.entitlements"
 
           # Sign inside-out, never --deep (same rationale as build_release.yml).
+          # "Autoupdate" is Sparkle's bare, extension-less helper; the name globs
+          # miss it, so it kept an ad-hoc signature and was the only binary
+          # failing notarization. Match it by name (-type f skips the symlink).
           find "$APP_PATH/Contents" \
-            \( -name "*.framework" -o -name "*.xpc" -o -name "*.app" -o -name "*.dylib" \) \
+            \( -name "*.framework" -o -name "*.xpc" -o -name "*.app" -o -name "*.dylib" -o -name "Autoupdate" -type f \) \
             -print0 \
             | while IFS= read -r -d '' nested; do
                 printf '%s\t%s\0' "$(printf '%s' "$nested" | tr -cd '/' | wc -c)" "$nested"

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to this project will be documented in this file.
 
-## [2.0.0] - 2026-06-08
+## [2.0.0] - 2026-07-01
 
 ### Security
 
@@ -89,7 +89,7 @@ All notable changes to this project will be documented in this file.
 - **WebSocket security-model docs.** Added a `## Security model` block to `WebSocketServerService.swift` describing the loopback-only contract.
 - **New unit tests.** `SongBlocklistTests`, `HistoryFormattingTests`, and `LaunchAtLoginServiceTests` cover three previously-untested services.
 - **OBS widget build pipeline.** The overlay source moved out of the hand-edited `apps/native/WolfWave/Resources/widget.html` into a new `apps/widget/` Tailwind + TypeScript workspace. The bundled HTML is now a generated, fully inlined artifact (compiled CSS, design tokens, and JS runtime in one file, no external `<link>` or `<script src>`). Xcode ships the committed `widget.html` as-is; CI rebuilds the widget before every `xcodebuild` run in `test.yml` and `build_release.yml` and fails the PR on any drift. Manual rebuild is `bun run --filter widget build`. The WebSocket payload, widget URL, and theme/layout params are unchanged. Source files are heavily commented so the runtime can be read end to end.
-- **Inside-out release signing.** `build_release.yml` now signs nested bundles deepest-first before the app shell, dropping `--deep --force`, which stripped per-bundle entitlements. The pipeline is XPC-ready for a future sandbox helper (#199).
+- **Inside-out release signing.** `build_release.yml` now signs nested bundles deepest-first before the app shell, dropping `--deep --force`, which stripped per-bundle entitlements. The pipeline is XPC-ready for a future sandbox helper (#199). The signing sweep also matches Sparkle's extension-less `Autoupdate` helper, which the bundle-only globs skipped, leaving it ad-hoc signed with no secure timestamp and failing notarization (statusCode 4000); it now gets the Developer ID identity and secure timestamp like every other nested binary. The same fix is mirrored in `nightly.yml`.
 - **Typed NotificationCenter payload helpers.** `Core/NotificationPayloads.swift` centralizes every notification payload post/observe pair so both sides share the same keys and types, removing about 38 hand-decoded `userInfo` sites (#198).
 - **HelixClient.** A shared HTTP wrapper for all Helix API calls, replacing per-service `send()` helpers. Maps 401, 429, and structured Helix errors uniformly; covered by `HelixClientTests` (#197).
 - **Preferences typed accessor.** `Core/Preferences.swift` centralizes UserDefaults reads and writes for non-bool keys across AppDelegate and WolfWaveApp (#197).

apps/docs/content/docs/changelog.mdx

@@ -15,7 +15,7 @@ ogDescription: Every release. Features, fixes, breaking changes. Auto-updating v
 All notable changes to WolfWave are documented here. When an update is ready, the same notes show up right inside the app's update window.
 
 
-## v2.0.0. June 8, 2026
+## v2.0.0. July 1, 2026
 
 ### Security
 - **Stream Widgets now need an access token.** Your overlay link carries a private token, so nobody else on your network can pull up your now-playing feed. It's made on first launch and kept in the Keychain. Your OBS sources keep working. Reveal, regenerate, or replace it in Settings → Stream Widgets.