Extend TestFlight processing wait

.forgejo/workflows/apple-distribute-testers.yml

@@ -79,6 +79,7 @@ env:
   BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }}
   BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }}
   BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }}
+  TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }}
   BURROW_VERSION_REQUIRE_REMOTE: "1"
 
 jobs:
@@ -482,6 +483,13 @@ jobs:
             printf '%s' "$ASC_API_KEY_BASE64" | base64 --decode > "$key_file"
           fi
           KEY_FILE="$key_file" python3 -c 'import json, os, pathlib; print(json.dumps({"key_id": os.environ["ASC_API_KEY_ID"], "issuer_id": os.environ["ASC_API_ISSUER_ID"], "key": pathlib.Path(os.environ["KEY_FILE"]).read_text(), "duration": 1200, "in_house": False}))' > "$api_key_json"
+          wait_processing_timeout="${TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS:-7200}"
+          case "$wait_processing_timeout" in
+            ""|*[!0-9]*)
+              echo "::error ::TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS must be an integer number of seconds." >&2
+              exit 1
+              ;;
+          esac
 
           args=(
             run pilot
@@ -491,7 +499,7 @@ jobs:
             "distribute_only:true"
             "build_number:${BUILD_NUMBER}"
             "wait_processing_interval:30"
-            "wait_processing_timeout_duration:1800"
+            "wait_processing_timeout_duration:${wait_processing_timeout}"
             "distribute_external:${TESTFLIGHT_DISTRIBUTE_EXTERNAL:-false}"
             "uses_non_exempt_encryption:${IOS_USES_NON_EXEMPT_ENCRYPTION:-false}"
           )

.forgejo/workflows/publish-store-uploads.yml

@@ -72,6 +72,7 @@ env:
   BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }}
   BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }}
   BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }}
+  TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }}
 
 jobs:
   sign-apple-kms:
@@ -271,6 +272,13 @@ jobs:
           if [[ -z "$uses_non_exempt" ]]; then
             uses_non_exempt="false"
           fi
+          wait_processing_timeout="${TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS:-7200}"
+          case "$wait_processing_timeout" in
+            ""|*[!0-9]*)
+              echo "::error ::TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS must be an integer number of seconds." >&2
+              exit 1
+              ;;
+          esac
 
           args=(
             run pilot
@@ -280,7 +288,7 @@ jobs:
             "distribute_only:true"
             "build_number:${BUILD_NUMBER}"
             "wait_processing_interval:30"
-            "wait_processing_timeout_duration:1800"
+            "wait_processing_timeout_duration:${wait_processing_timeout}"
             "distribute_external:${distribute_external}"
             "uses_non_exempt_encryption:${uses_non_exempt}"
           )

evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md

@@ -190,6 +190,12 @@ The same change also makes the forge itself the release authority: release tags
   - Generate staged appcast content from the signed macOS artifact when present.
   - Publish `sparkle/<channel>/`, `sparkle/appcast.xml`, and `sparkle/default/` pointers from `publish-store-uploads`.
   - The macOS app embeds Sparkle and consumes the `https://releases.burrow.net/sparkle/appcast.xml` feed.
+- Treat TestFlight distribution as a retryable post-upload step. Apple build
+  processing can exceed 30 minutes after a successful IPA upload, so
+  `apple-distribute-testers` and `publish-store-uploads` wait up to 7200
+  seconds by default and allow Forgejo variable
+  `TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS` to tune that ceiling without a
+  repo change.
 - Add `infra/releases` as the OpenTofu boundary for the GCS release and package repository backup buckets. Garage is the required S3-compatible primary distribution target after host bootstrap. `infra/identity` remains the boundary for Google KMS signing keys, the Authentik WIF pool/provider, and the runner service account.
 - Serve `releases.burrow.net` and `packages.burrow.net` from the forge Caddy
   edge as stable Burrow domains backed by the GCS release and package buckets.