hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Wire Forge-native release infrastructure
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Details
Build Rust / Cargo Test (push) Successful in 4m14s
Details
Build Site / Next.js Build (push) Failing after 6s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Details
Lint Governance / BEP Metadata (push) Successful in 0s
Details
Build: Android / Android Rust Core Stub (push) Failing after 23s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 05:51:12 -07:00
parent 97c569fb35
commit 002bd382e9
199 changed files with 14268 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

18
store-metadata/app-store-connect/README.md Normal file
View file

@ -0,0 +1,18 @@
# App Store Connect Metadata
This directory is the repo-owned home for Burrow App Store Connect metadata.
The release upload lane expects dedicated App Store Connect API credentials
sealed with agenix:
- `secrets/apple/appstore-connect.env.age`
That single secret contains the key ID, issuer ID, and base64-encoded `.p8`.
CI decrypts it into a temporary App Store Connect key file, syncs provisioning
profiles from App Store Connect, and then uploads `.ipa`/`.pkg` artifacts.
Forgejo secrets should only provide the runner age identity fallback, not the
App Store key itself.
The initial release pipeline can upload `.ipa` and `.pkg` artifacts once the
Apple build lane produces signed outputs. TestFlight external distribution must
remain explicit until review metadata, groups, and tester policy are complete.