Add Sparkle update workflow

.env.example

@@ -10,3 +10,25 @@ POWERLENS_SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID)"
 # Keychain profile created with:
 # xcrun notarytool store-credentials powerlens-notary --apple-id ... --team-id ... --password ...
 POWERLENS_NOTARY_PROFILE="powerlens-notary"
+# Optional when the notarytool profile is stored in a non-default keychain.
+# POWERLENS_NOTARY_KEYCHAIN="/path/to/powerlens-signing.keychain-db"
+
+# Sparkle in-app updates.
+# Generate the key with:
+# .build/artifacts/sparkle/Sparkle/bin/generate_keys --account powerlens
+# Store only the printed public key here. Keep the private key in Keychain or
+# pass it to generate_appcast locally; never commit private Sparkle keys.
+POWERLENS_SPARKLE_FEED_URL="https://progresshans.github.io/powerlens/appcast.xml"
+POWERLENS_SPARKLE_ALPHA_FEED_URL="https://progresshans.github.io/powerlens/appcast-alpha.xml"
+POWERLENS_SPARKLE_PUBLIC_ED_KEY=""
+POWERLENS_SPARKLE_KEY_ACCOUNT="powerlens"
+# CI can pass the exported private EdDSA key through this environment variable
+# when generating appcasts. Do not commit a real private key.
+# POWERLENS_SPARKLE_PRIVATE_ED_KEY=""
+
+# Optional appcast generation for maintainers.
+# POWERLENS_SPARKLE_GENERATE_APPCAST=1
+# POWERLENS_SPARKLE_APPCAST_DIR="$PWD/release/appcast-work"
+# POWERLENS_SPARKLE_APPCAST_OUTPUT_PATH="$PWD/docs/appcast.xml"
+# POWERLENS_SPARKLE_DOWNLOAD_URL_PREFIX="https://github.com/progresshans/powerlens/releases/download/v0.9.1/"
+# POWERLENS_SPARKLE_RELEASE_NOTES_URL_PREFIX="https://github.com/progresshans/powerlens/releases/download/v0.9.1/"

.github/workflows/ci.yml

@@ -0,0 +1,69 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - develop
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Build, Test, and Package Smoke Check
+    runs-on: macos-26
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Show toolchain
+        run: |
+          swift --version
+          xcodebuild -version
+
+      - name: Run unit tests
+        run: swift test
+
+      - name: Validate scripts
+        run: |
+          bash -n \
+            script/lib/powerlens_packaging.sh \
+            script/build_and_run.sh \
+            script/package_release.sh \
+            script/test_sparkle_update.sh \
+            script/verify_distribution.sh
+
+      - name: Validate metadata
+        run: |
+          plutil -lint \
+            Packaging/Info.plist \
+            Sources/PowerLens/Resources/en.lproj/Localizable.strings \
+            Sources/PowerLens/Resources/ko.lproj/Localizable.strings
+          python3 - <<'PY'
+          import xml.etree.ElementTree as ET
+          for path in ("docs/appcast.xml", "docs/appcast-alpha.xml"):
+              ET.parse(path)
+              print(f"{path}: OK")
+          PY
+
+      - name: Package ad-hoc release smoke build
+        env:
+          POWERLENS_VERSION: 0.0.0-ci
+          POWERLENS_BUILD: ${{ github.run_number }}
+          POWERLENS_SKIP_NOTARIZATION: "1"
+          POWERLENS_CLEAN_BUILD: "0"
+        run: ./script/package_release.sh
+
+      - name: Verify packaged bundle metadata
+        run: |
+          ./script/verify_distribution.sh release/stage/PowerLens.app
+          test -f release/PowerLens-0.0.0-ci.app.zip
+          test -f release/PowerLens-0.0.0-ci.dmg
+          test -f release/PowerLens-0.0.0-ci-checksums.txt