From 2410de5e51a9c7dfd8aa6e883febf0c1de3b3486 Mon Sep 17 00:00:00 2001 From: Conrad Kramer Date: Sun, 7 Jun 2026 18:58:31 -0700 Subject: [PATCH] Extend TestFlight processing wait --- .forgejo/workflows/apple-distribute-testers.yml | 10 +++++++++- .forgejo/workflows/publish-store-uploads.yml | 10 +++++++++- ...release-infrastructure-and-store-upload-pipeline.md | 6 ++++++ 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/apple-distribute-testers.yml b/.forgejo/workflows/apple-distribute-testers.yml index 9ef4520..c94c43f 100644 --- a/.forgejo/workflows/apple-distribute-testers.yml +++ b/.forgejo/workflows/apple-distribute-testers.yml @@ -79,6 +79,7 @@ env: BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }} BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }} BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }} + TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }} BURROW_VERSION_REQUIRE_REMOTE: "1" jobs: @@ -482,6 +483,13 @@ jobs: printf '%s' "$ASC_API_KEY_BASE64" | base64 --decode > "$key_file" fi KEY_FILE="$key_file" python3 -c 'import json, os, pathlib; print(json.dumps({"key_id": os.environ["ASC_API_KEY_ID"], "issuer_id": os.environ["ASC_API_ISSUER_ID"], "key": pathlib.Path(os.environ["KEY_FILE"]).read_text(), "duration": 1200, "in_house": False}))' > "$api_key_json" + wait_processing_timeout="${TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS:-7200}" + case "$wait_processing_timeout" in + ""|*[!0-9]*) + echo "::error ::TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS must be an integer number of seconds." >&2 + exit 1 + ;; + esac args=( run pilot @@ -491,7 +499,7 @@ jobs: "distribute_only:true" "build_number:${BUILD_NUMBER}" "wait_processing_interval:30" - "wait_processing_timeout_duration:1800" + "wait_processing_timeout_duration:${wait_processing_timeout}" "distribute_external:${TESTFLIGHT_DISTRIBUTE_EXTERNAL:-false}" "uses_non_exempt_encryption:${IOS_USES_NON_EXEMPT_ENCRYPTION:-false}" ) diff --git a/.forgejo/workflows/publish-store-uploads.yml b/.forgejo/workflows/publish-store-uploads.yml index 0c46228..1f56294 100644 --- a/.forgejo/workflows/publish-store-uploads.yml +++ b/.forgejo/workflows/publish-store-uploads.yml @@ -72,6 +72,7 @@ env: BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }} BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }} BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }} + TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }} jobs: sign-apple-kms: @@ -271,6 +272,13 @@ jobs: if [[ -z "$uses_non_exempt" ]]; then uses_non_exempt="false" fi + wait_processing_timeout="${TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS:-7200}" + case "$wait_processing_timeout" in + ""|*[!0-9]*) + echo "::error ::TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS must be an integer number of seconds." >&2 + exit 1 + ;; + esac args=( run pilot @@ -280,7 +288,7 @@ jobs: "distribute_only:true" "build_number:${BUILD_NUMBER}" "wait_processing_interval:30" - "wait_processing_timeout_duration:1800" + "wait_processing_timeout_duration:${wait_processing_timeout}" "distribute_external:${distribute_external}" "uses_non_exempt_encryption:${uses_non_exempt}" ) diff --git a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md index 6fac13d..96dc5e6 100644 --- a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md +++ b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md @@ -190,6 +190,12 @@ The same change also makes the forge itself the release authority: release tags - Generate staged appcast content from the signed macOS artifact when present. - Publish `sparkle//`, `sparkle/appcast.xml`, and `sparkle/default/` pointers from `publish-store-uploads`. - The macOS app embeds Sparkle and consumes the `https://releases.burrow.net/sparkle/appcast.xml` feed. +- Treat TestFlight distribution as a retryable post-upload step. Apple build + processing can exceed 30 minutes after a successful IPA upload, so + `apple-distribute-testers` and `publish-store-uploads` wait up to 7200 + seconds by default and allow Forgejo variable + `TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS` to tune that ceiling without a + repo change. - Add `infra/releases` as the OpenTofu boundary for the GCS release and package repository backup buckets. Garage is the required S3-compatible primary distribution target after host bootstrap. `infra/identity` remains the boundary for Google KMS signing keys, the Authentik WIF pool/provider, and the runner service account. - Serve `releases.burrow.net` and `packages.burrow.net` from the forge Caddy edge as stable Burrow domains backed by the GCS release and package buckets.