Trayage
Windows tray · .NET 10 · WPF

Your dev inbox,
quietly in the tray.

Trayage gathers your GitHub and Bitbucket Cloud activity into one place, opens the right page on a click, and raises native Windows toasts only for what you actually care about.

Download latest Verify View on GitHub
What it does

One quiet place for everything you'd otherwise miss.

Trayage lives in the notification area and only speaks up when it should.

Unified inbox

GitHub, Bitbucket, and GitLab activity merged, de-duplicated, and shown grouped by repository or as a flat newest-first list — one click to the page.

Native toasts

Real Windows notifications, per class of activity. Click one and the right page opens — no inbox archaeology. They use the Windows App Runtime; without it Trayage still tracks your inbox in the tray, and Settings links you straight to the install.

Watched repos

Pick repositories you care about and get all their activity — even when you're not directly involved.

Secure by default

OAuth tokens are encrypted at rest with Windows DPAPI — per-user, per-machine, never in plaintext.

Fluent UI

A clean Windows 11 look with light, dark, and system themes — built on WPF and WPF-UI.

Tunable & quiet

Set the poll interval, group or hide read items, toggle each notification class, and start with Windows. The first poll never floods you.

Connects to

Three services, one inbox.

Each provider authenticates the way it's meant to — you just click Connect.

OAuth device flow

GitHub

Reads your notifications inbox directly via the GitHub API.

  • Review requests, mentions & assignments
  • CI / check status changes
  • Activity on watched repositories
Authorization-code loopback

Bitbucket Cloud

Assembles an inbox from pull-request queries (Bitbucket has no notifications API).

  • Pull requests you authored
  • Review requests in watched repos
  • All activity in watched repos
OAuth device flow

GitLab

Reads your to-do inbox directly via the GitLab API — a centralized inbox, like GitHub.

  • Assignments, mentions & review requests
  • Failed pipelines (CI)
  • One to-do inbox — no per-repo setup

Honest about limits: because Bitbucket Cloud exposes no notification or mention feed, its mentions and CI status aren't surfaced in this version, and review-request detection is scoped to your watched repositories. See the README for details.

Under the hood

Poll, merge, diff, notify.

A small background loop does the work; the rules decide what's worth a toast.

Poll

Each connected provider is queried on your chosen interval, honouring server rate-limit hints.

Merge

Results become provider-agnostic items, de-duplicated into a single ordered inbox.

Diff

The new snapshot is compared with the last, so only genuinely new activity is surfaced.

Notify

The rule engine decides which new items toast — by class, or by watched repository.

Trust, but verify

Every release is signed, attested, and inventoried.

Each tagged build carries a GitHub build-provenance attestation, a cosign keyless signature, and a CycloneDX SBOM — check all three in one command.

Provenance

Proves which workflow, commit, and runner built each archive.

gh attestation verify

Signature

Sigstore keyless signature via GitHub OIDC — no long-lived keys.

cosign verify-blob

Inventory

A CycloneDX SBOM of the full dependency graph ships with every release.

trayage-<tag>-sbom.cdx.json

Or run the checks by hand

# 1 — GitHub build provenance
gh attestation verify trayage-v1.0.0-win-x64.zip --repo michaelsanford/Trayage

# 2 — cosign keyless signature (identity = the release workflow at that tag)
cosign verify-blob `
  --bundle trayage-v1.0.0-win-x64.zip.bundle `
  --certificate-identity "https://github.com/michaelsanford/Trayage/.github/workflows/release.yml@refs/tags/v1.0.0" `
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" `
  trayage-v1.0.0-win-x64.zip
How it's built

Small, layered, testable.

Trayage.AppWPF + WPF-UI shell — tray icon, inbox flyout, Settings window, toast notifier, and the generic-host DI root.
Trayage.CoreProvider abstraction, inbox aggregation & diffing, polling service, notification rules, settings, and the DPAPI secret store.
Trayage.Core.TestsxUnit coverage over aggregation, diffing, notification rules, settings, the secret store, and provider mappings.
.NET 10 WPF + WPF-UI Octokit CommunityToolkit MVVM Windows App SDK notifications DPAPI token storage