From 4f0095ef35cae1f8023b0e6a83ebd5ae875f6b57 Mon Sep 17 00:00:00 2001 From: Conrad Kramer Date: Mon, 8 Jun 2026 00:38:33 -0700 Subject: [PATCH] Default release uploads to App Store Connect --- .forgejo/workflows/build-release.yml | 6 +++--- .forgejo/workflows/publish-store-uploads.yml | 2 +- .forgejo/workflows/release-if-needed.yml | 7 +++++-- ...infrastructure-and-store-upload-pipeline.md | 18 ++++++++++++++---- 4 files changed, 23 insertions(+), 10 deletions(-) diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index dbcd08c..85c2e76 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -11,7 +11,7 @@ on: upload_app_store: description: Trigger downstream App Store Connect upload workflow required: false - default: "false" + default: "true" upload_sparkle: description: Trigger downstream Sparkle publish workflow required: false @@ -316,7 +316,7 @@ jobs: env: BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }} PLATFORM: ${{ matrix.platform }} - UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'false' }} + UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }} UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }} SPARKLE_CHANNEL: build-${{ needs.prepare.outputs.build_number }} run: | @@ -462,7 +462,7 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }} - UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'false' }} + UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }} UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }} UPLOAD_MICROSOFT_STORE: ${{ github.event.inputs.upload_microsoft_store || 'false' }} SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }} diff --git a/.forgejo/workflows/publish-store-uploads.yml b/.forgejo/workflows/publish-store-uploads.yml index 825177d..904abce 100644 --- a/.forgejo/workflows/publish-store-uploads.yml +++ b/.forgejo/workflows/publish-store-uploads.yml @@ -10,7 +10,7 @@ on: upload_app_store: description: Upload iOS/macOS/visionOS artifacts to App Store Connect required: false - default: "false" + default: "true" distribute_testflight: description: Distribute an already-uploaded iOS build to TestFlight required: false diff --git a/.forgejo/workflows/release-if-needed.yml b/.forgejo/workflows/release-if-needed.yml index 61a077f..cc39214 100644 --- a/.forgejo/workflows/release-if-needed.yml +++ b/.forgejo/workflows/release-if-needed.yml @@ -2,6 +2,9 @@ name: "Release: If Needed" run-name: "Release: If Needed (${{ github.ref_name }})" on: + push: + branches: + - main schedule: - cron: "*/30 * * * *" workflow_dispatch: @@ -9,7 +12,7 @@ on: upload_app_store: description: Trigger downstream App Store Connect upload workflow required: false - default: "false" + default: "true" upload_sparkle: description: Trigger downstream Sparkle publish workflow required: false @@ -65,7 +68,7 @@ jobs: - name: Dispatch Release Build shell: bash env: - UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'false' }} + UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }} UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }} UPLOAD_MICROSOFT_STORE: ${{ github.event.inputs.upload_microsoft_store || 'false' }} SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }} diff --git a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md index ae22d16..4d8f5c9 100644 --- a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md +++ b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md @@ -33,9 +33,15 @@ The same change also makes the forge itself the release authority: release tags - `clean` means HEAD is exactly the latest authoritative build tag. - `dirty` means the release workflow should create a new build number. - Split workflows: - - `.forgejo/workflows/release-if-needed.yml` checks release status and dispatches `build-release.yml`. - - `.forgejo/workflows/build-release.yml` builds and stages artifacts. - - `.forgejo/workflows/publish-store-uploads.yml` uploads staged artifacts to external stores and public channels. + - `.forgejo/workflows/release-if-needed.yml` checks release status on a + schedule and on pushes to `main`, then dispatches `build-release.yml` when + HEAD is unreleased. + - `.forgejo/workflows/build-release.yml` builds and stages artifacts, and + defaults App Store Connect upload handoff on unless the dispatch explicitly + disables it. + - `.forgejo/workflows/publish-store-uploads.yml` uploads staged artifacts to + external stores and public channels, with App Store Connect upload enabled + by default for manual dispatches and release handoffs. - Stage artifacts under `dist/builds///`. - Publish generic release assets to a Forgejo release named `Build `. - Upload release artifacts through `Scripts/ci/upload-release-storage.sh`. The wrapper requires Garage as the primary S3-compatible target by default, then mirrors to the `burrow-net-releases` GCS backup bucket unless `BURROW_RELEASE_GCS_BACKUP=false`. @@ -259,7 +265,11 @@ The same change also makes the forge itself the release authority: release tags - Grafana starts with a sealed admin password and a pending OIDC client secret. Local admin login remains available until the real OIDC secret is rotated and the Authentik reconciliation service creates the Grafana provider. - OpenTofu apply/import modes require an explicit confirmation and remote state. Validation may run without remote state. - Build tags are pushed only after artifacts have been assembled for the build number. -- External TestFlight distribution and public app-store rollout must stay explicit; internal or private lanes can be defaulted only after credentials and metadata are verified. +- App Store Connect upload and internal/private tester lanes may default on only + after dedicated credentials and export metadata are verified. This default + applies to `release-if-needed`, `build-release`, `publish-store-uploads`, and + `apple-distribute-testers`. External TestFlight distribution and public + app-store rollout must stay explicit. ## Contributor Playbook