Keep internal TestFlight off external beta review

Scripts/ci/distribute-testflight.sh

@@ -6,16 +6,31 @@ Scripts/ci/check-release-config.sh app-store
 build_number="${BUILD_NUMBER:?BUILD_NUMBER is required}"
 distribute_external="${TESTFLIGHT_DISTRIBUTE_EXTERNAL:-false}"
 testflight_groups="${TESTFLIGHT_GROUPS:-}"
-testflight_internal_group="${TESTFLIGHT_INTERNAL_GROUP:-Internal}"
 uses_non_exempt="${IOS_USES_NON_EXEMPT_ENCRYPTION:-false}"
 wait_processing_timeout="${TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS:-7200}"
 
 if [[ -z "$distribute_external" ]]; then
   distribute_external="false"
 fi
+case "$distribute_external" in
+  true|false)
+    ;;
+  *)
+    echo "::error ::TESTFLIGHT_DISTRIBUTE_EXTERNAL must be true or false." >&2
+    exit 1
+    ;;
+esac
 if [[ -z "$uses_non_exempt" ]]; then
   uses_non_exempt="false"
 fi
+case "$uses_non_exempt" in
+  true|false)
+    ;;
+  *)
+    echo "::error ::IOS_USES_NON_EXEMPT_ENCRYPTION must be true or false." >&2
+    exit 1
+    ;;
+esac
 case "$wait_processing_timeout" in
   ""|*[!0-9]*)
     echo "::error ::TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS must be an integer number of seconds." >&2
@@ -51,10 +66,20 @@ args=(
   "uses_non_exempt_encryption:${uses_non_exempt}"
 )
 
-if [[ -n "$testflight_groups" ]]; then
+if [[ "$distribute_external" == "true" ]]; then
+  if [[ -z "$testflight_groups" ]]; then
+    echo "::error ::TESTFLIGHT_GROUPS is required for external TestFlight distribution." >&2
+    exit 1
+  fi
   args+=("groups:${testflight_groups}")
-elif [[ "$distribute_external" != "true" && -n "$testflight_internal_group" ]]; then
-  args+=("groups:${testflight_internal_group}")
+else
+  args+=(
+    "skip_submission:true"
+    "notify_external_testers:false"
+  )
+  if [[ -n "$testflight_groups" ]]; then
+    echo "::warning ::Ignoring TESTFLIGHT_GROUPS for internal-only TestFlight distribution; App Store Connect manages internal tester group availability." >&2
+  fi
 fi
 
 nix run nixpkgs#fastlane -- "${args[@]}"