Default release uploads to App Store Connect

.forgejo/workflows/build-release.yml

@@ -11,7 +11,7 @@ on:
       upload_app_store:
         description: Trigger downstream App Store Connect upload workflow
         required: false
-        default: "false"
+        default: "true"
       upload_sparkle:
         description: Trigger downstream Sparkle publish workflow
         required: false
@@ -316,7 +316,7 @@ jobs:
         env:
           BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
           PLATFORM: ${{ matrix.platform }}
-          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'false' }}
+          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }}
           UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }}
           SPARKLE_CHANNEL: build-${{ needs.prepare.outputs.build_number }}
         run: |
@@ -462,7 +462,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
           BUILD_NUMBER: ${{ needs.prepare.outputs.build_number }}
-          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'false' }}
+          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }}
           UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }}
           UPLOAD_MICROSOFT_STORE: ${{ github.event.inputs.upload_microsoft_store || 'false' }}
           SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }}

.forgejo/workflows/publish-store-uploads.yml

@@ -10,7 +10,7 @@ on:
       upload_app_store:
         description: Upload iOS/macOS/visionOS artifacts to App Store Connect
         required: false
-        default: "false"
+        default: "true"
       distribute_testflight:
         description: Distribute an already-uploaded iOS build to TestFlight
         required: false

.forgejo/workflows/release-if-needed.yml

@@ -2,6 +2,9 @@ name: "Release: If Needed"
 run-name: "Release: If Needed (${{ github.ref_name }})"
 
 on:
+  push:
+    branches:
+      - main
   schedule:
     - cron: "*/30 * * * *"
   workflow_dispatch:
@@ -9,7 +12,7 @@ on:
       upload_app_store:
         description: Trigger downstream App Store Connect upload workflow
         required: false
-        default: "false"
+        default: "true"
       upload_sparkle:
         description: Trigger downstream Sparkle publish workflow
         required: false
@@ -65,7 +68,7 @@ jobs:
       - name: Dispatch Release Build
         shell: bash
         env:
-          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'false' }}
+          UPLOAD_APP_STORE: ${{ github.event.inputs.upload_app_store || 'true' }}
           UPLOAD_SPARKLE: ${{ github.event.inputs.upload_sparkle || 'true' }}
           UPLOAD_MICROSOFT_STORE: ${{ github.event.inputs.upload_microsoft_store || 'false' }}
           SPARKLE_POINT_MAIN: ${{ github.event.inputs.sparkle_point_main || 'true' }}

evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md

@@ -33,9 +33,15 @@ The same change also makes the forge itself the release authority: release tags
   - `clean` means HEAD is exactly the latest authoritative build tag.
   - `dirty` means the release workflow should create a new build number.
 - Split workflows:
-  - `.forgejo/workflows/release-if-needed.yml` checks release status and dispatches `build-release.yml`.
-  - `.forgejo/workflows/build-release.yml` builds and stages artifacts.
-  - `.forgejo/workflows/publish-store-uploads.yml` uploads staged artifacts to external stores and public channels.
+  - `.forgejo/workflows/release-if-needed.yml` checks release status on a
+    schedule and on pushes to `main`, then dispatches `build-release.yml` when
+    HEAD is unreleased.
+  - `.forgejo/workflows/build-release.yml` builds and stages artifacts, and
+    defaults App Store Connect upload handoff on unless the dispatch explicitly
+    disables it.
+  - `.forgejo/workflows/publish-store-uploads.yml` uploads staged artifacts to
+    external stores and public channels, with App Store Connect upload enabled
+    by default for manual dispatches and release handoffs.
 - Stage artifacts under `dist/builds/<build-number>/<platform>/`.
 - Publish generic release assets to a Forgejo release named `Build <number>`.
 - Upload release artifacts through `Scripts/ci/upload-release-storage.sh`. The wrapper requires Garage as the primary S3-compatible target by default, then mirrors to the `burrow-net-releases` GCS backup bucket unless `BURROW_RELEASE_GCS_BACKUP=false`.
@@ -259,7 +265,11 @@ The same change also makes the forge itself the release authority: release tags
 - Grafana starts with a sealed admin password and a pending OIDC client secret. Local admin login remains available until the real OIDC secret is rotated and the Authentik reconciliation service creates the Grafana provider.
 - OpenTofu apply/import modes require an explicit confirmation and remote state. Validation may run without remote state.
 - Build tags are pushed only after artifacts have been assembled for the build number.
-- External TestFlight distribution and public app-store rollout must stay explicit; internal or private lanes can be defaulted only after credentials and metadata are verified.
+- App Store Connect upload and internal/private tester lanes may default on only
+  after dedicated credentials and export metadata are verified. This default
+  applies to `release-if-needed`, `build-release`, `publish-store-uploads`, and
+  `apple-distribute-testers`. External TestFlight distribution and public
+  app-store rollout must stay explicit.
 
 ## Contributor Playbook