Wire Forge-native release infrastructure

.forgejo/workflows/release-if-needed.yml

@@ -0,0 +1,89 @@
+name: "Release: If Needed"
+run-name: "Release: If Needed (${{ github.ref_name }})"
+
+on:
+  schedule:
+    - cron: "*/30 * * * *"
+  workflow_dispatch:
+    inputs:
+      upload_app_store:
+        description: Trigger downstream App Store Connect upload workflow
+        required: false
+        default: "false"
+      upload_sparkle:
+        description: Trigger downstream Sparkle publish workflow
+        required: false
+        default: "true"
+      upload_microsoft_store:
+        description: Trigger downstream Microsoft Store beta upload workflow
+        required: false
+        default: "false"
+      sparkle_point_main:
+        description: Update Sparkle main channel pointers
+        required: false
+        default: "true"
+      testflight_distribute_external:
+        description: Distribute to external TestFlight groups
+        required: false
+        default: "false"
+      testflight_groups:
+        description: Optional comma-separated TestFlight groups for external distribution
+        required: false
+        default: ""
+      ios_uses_non_exempt_encryption:
+        description: Set true only when the iOS build uses non-exempt encryption
+        required: false
+        default: "false"
+
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: burrow-release-if-needed-main
+  cancel-in-progress: true
+
+env:
+  GITHUB_TOKEN: ${{ github.token }}
+  BURROW_VERSION_REQUIRE_REMOTE: "1"
+
+jobs:
+  check:
+    name: Check (Release Needed)
+    runs-on: namespace-profile-linux-medium
+    steps:
+      - name: Checkout
+        uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          token: ${{ github.token }}
+          fetch-depth: 0
+
+      - name: Fetch Build Tags
+        shell: bash
+        run: git fetch --force --prune origin "+refs/tags/builds/*:refs/tags/builds/*"
+
+      - name: Dispatch Release Build
+        shell: bash
+        env:
+          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'false' }}
+          UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }}
+          UPLOAD_MICROSOFT_STORE: ${{ github.event.inputs.upload_microsoft_store || 'false' }}
+          SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }}
+          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ github.event.inputs.testflight_distribute_external || 'false' }}
+          TESTFLIGHT_GROUPS: ${{ github.event.inputs.testflight_groups || '' }}
+          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ github.event.inputs.ios_uses_non_exempt_encryption || 'false' }}
+        run: |
+          set -euo pipefail
+          status="$(Scripts/version.sh status)"
+          if [[ "$status" == "clean" ]]; then
+            echo "No unreleased changes."
+            exit 0
+          fi
+          inputs="$(python3 -c 'import json, os; print(json.dumps({"upload_app_store":os.environ["UPLOAD_APP_STORE"],"upload_sparkle":os.environ["UPLOAD_SPARKLE"],"upload_microsoft_store":os.environ["UPLOAD_MICROSOFT_STORE"],"sparkle_point_main":os.environ["SPARKLE_POINT_MAIN"],"testflight_distribute_external":os.environ["TESTFLIGHT_DISTRIBUTE_EXTERNAL"],"testflight_groups":os.environ["TESTFLIGHT_GROUPS"],"ios_uses_non_exempt_encryption":os.environ["IOS_USES_NON_EXEMPT_ENCRYPTION"]}))')"
+          curl -fsS \
+            -X POST \
+            -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"ref\":\"main\",\"inputs\":${inputs}}" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/actions/workflows/build-release.yml/dispatches"
+          echo "Dispatched build-release.yml (status=${status})."