Add dedicated TestFlight distribution workflow

.forgejo/workflows/distribute-testflight.yml

@@ -0,0 +1,72 @@
+name: "Apple: Distribute TestFlight"
+run-name: "Apple: Distribute TestFlight (Build ${{ inputs.build_number }})"
+
+on:
+  workflow_dispatch:
+    inputs:
+      build_number:
+        description: Already-uploaded App Store Connect build number
+        required: true
+      testflight_distribute_external:
+        description: Distribute to external TestFlight groups
+        required: false
+        default: "false"
+      testflight_groups:
+        description: Optional comma-separated TestFlight groups
+        required: false
+        default: ""
+      ios_uses_non_exempt_encryption:
+        description: Set true only when the iOS build uses non-exempt encryption
+        required: false
+        default: "false"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: burrow-distribute-testflight-${{ inputs.build_number }}
+  cancel-in-progress: true
+
+env:
+  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
+  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
+  BURROW_APPLE_BUNDLE_ID: ${{ vars.BURROW_APPLE_BUNDLE_ID || 'net.burrow.app' }}
+  TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }}
+
+jobs:
+  distribute-ios-testflight:
+    name: Distribute (TestFlight iOS Testers)
+    runs-on: namespace-profile-linux-medium
+    steps:
+      - name: Checkout
+        uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          token: ${{ github.token }}
+          fetch-depth: 0
+
+      - name: Ensure Nix
+        shell: bash
+        run: bash Scripts/ci/ensure-nix.sh
+
+      - name: Configure Age
+        shell: bash
+        env:
+          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
+        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"
+
+      - name: Decrypt Release Secrets
+        uses: ./.forgejo/actions/decrypt-release-secrets
+
+      - name: Validate App Store Credentials
+        shell: bash
+        run: Scripts/ci/check-release-config.sh app-store
+
+      - name: Distribute iOS Build To TestFlight
+        shell: bash
+        env:
+          BUILD_NUMBER: ${{ inputs.build_number }}
+          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ inputs.testflight_distribute_external || 'false' }}
+          TESTFLIGHT_GROUPS: ${{ inputs.testflight_groups || '' }}
+          TESTFLIGHT_INTERNAL_GROUP: Internal
+          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ inputs.ios_uses_non_exempt_encryption || 'false' }}
+        run: Scripts/ci/distribute-testflight.sh

evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md

@@ -198,7 +198,9 @@ The same change also makes the forge itself the release authority: release tags
   repo change. `publish-store-uploads` has a separate no-`needs`
   `distribute-ios-testflight` retry job for `distribute_testflight=true` and
   `upload_app_store=false`, so skipped upload/signing jobs cannot suppress
-  distribution of an already-uploaded build.
+  distribution of an already-uploaded build. `distribute-testflight` is the
+  narrower one-job retry workflow when only App Store Connect processing and
+  tester assignment need to be retried.
 - Add `infra/releases` as the OpenTofu boundary for the GCS release and package repository backup buckets. Garage is the required S3-compatible primary distribution target after host bootstrap. `infra/identity` remains the boundary for Google KMS signing keys, the Authentik WIF pool/provider, and the runner service account.
 - Serve `releases.burrow.net` and `packages.burrow.net` from the forge Caddy
   edge as stable Burrow domains backed by the GCS release and package buckets.