hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Default release uploads to App Store Connect
Some checks failed
Release: If Needed / Check (Release Needed) (push) Failing after 10s
Details
Build Rust / Cargo Test (push) Successful in 4m2s
Details
Build Site / Next.js Build (push) Failing after 4s
Details
Lint Governance / BEP Metadata (push) Successful in 1s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-08 00:38:33 -07:00
parent 60cc48a4b7
commit 4f0095ef35
4 changed files with 23 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

18
evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
View file

@ -33,9 +33,15 @@ The same change also makes the forge itself the release authority: release tags
- `clean` means HEAD is exactly the latest authoritative build tag.
- `dirty` means the release workflow should create a new build number.
- Split workflows:
- `.forgejo/workflows/release-if-needed.yml` checks release status and dispatches `build-release.yml`.
- `.forgejo/workflows/build-release.yml` builds and stages artifacts.
- `.forgejo/workflows/publish-store-uploads.yml` uploads staged artifacts to external stores and public channels.
- `.forgejo/workflows/release-if-needed.yml` checks release status on a
schedule and on pushes to `main`, then dispatches `build-release.yml` when
HEAD is unreleased.
- `.forgejo/workflows/build-release.yml` builds and stages artifacts, and
defaults App Store Connect upload handoff on unless the dispatch explicitly
disables it.
- `.forgejo/workflows/publish-store-uploads.yml` uploads staged artifacts to
external stores and public channels, with App Store Connect upload enabled
by default for manual dispatches and release handoffs.
- Stage artifacts under `dist/builds/<build-number>/<platform>/`.
- Publish generic release assets to a Forgejo release named `Build <number>`.
- Upload release artifacts through `Scripts/ci/upload-release-storage.sh`. The wrapper requires Garage as the primary S3-compatible target by default, then mirrors to the `burrow-net-releases` GCS backup bucket unless `BURROW_RELEASE_GCS_BACKUP=false`.
@ -259,7 +265,11 @@ The same change also makes the forge itself the release authority: release tags
- Grafana starts with a sealed admin password and a pending OIDC client secret. Local admin login remains available until the real OIDC secret is rotated and the Authentik reconciliation service creates the Grafana provider.
- OpenTofu apply/import modes require an explicit confirmation and remote state. Validation may run without remote state.
- Build tags are pushed only after artifacts have been assembled for the build number.
- External TestFlight distribution and public app-store rollout must stay explicit; internal or private lanes can be defaulted only after credentials and metadata are verified.
- App Store Connect upload and internal/private tester lanes may default on only
after dedicated credentials and export metadata are verified. This default
applies to `release-if-needed`, `build-release`, `publish-store-uploads`, and
`apple-distribute-testers`. External TestFlight distribution and public
app-store rollout must stay explicit.
## Contributor Playbook