[codex] Align release security

[ygsgdbd]

Issue

ListenBar's release workflow regenerated the entire Homebrew cask on every release. The Homebrew tap now owns a custom postflight step that removes the quarantine attribute after installation, together with explicit unsigned and notarization caveats. A subsequent ListenBar release would have replaced those tap-managed sections with the older cask template.

The release zip also had SHA-256 and Sparkle EdDSA protection but no GitHub Artifact Attestation, and the project READMEs did not explain the different trust boundaries for Homebrew and manual downloads.

User impact

Without this change, a new release could silently remove the Homebrew quarantine handling and restore outdated installation guidance. Users would also lack a repository-backed provenance check for newly published release zips.

Root cause

The workflow treated the full Homebrew cask as generated output even though installation policy is maintained in ygsgdbd/homebrew-tap. This duplicated the cask definition across repositories and allowed the release automation to overwrite unrelated tap changes.

Changes

• Grant the permissions required by actions/attest@v4 and attest only ListenBar-macOS-universal.zip before publishing the GitHub Release.
• Update only the existing cask's version, sha256, and url fields.
• Fail the release if the cask is missing or any release-controlled field does not appear exactly once.
• Preserve tap-managed postflight, caveats, uninstall, and zap content.
• Document in both READMEs that brew trust authorizes the third-party cask, while the cask's custom postflight removes quarantine without signing or notarizing ListenBar.
• Document SHA-256, Sparkle EdDSA, and GitHub Artifact Attestation verification, with an explicit boundary that v0.4.0 and earlier releases do not have attestations.

Validation

• rtk just check
• Workflow YAML parse
• actionlint for the changed workflow configuration, excluding the existing SC2129 and softprops/action-gh-release@v1 baseline findings
• rtk git diff --check
• Temporary cask update test confirming only version, sha256, and url change, tap-managed content remains intact, and a missing release field aborts the update

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.