Add TestFlight "What to Test" notes for nightly iOS builds

Generate the changelog from commits since the last nightly and pass it to
fastlane's upload_to_testflight changelog. The previous nightly's commit
SHA is stored as a dedicated nightly-build-commit artifact (independent of
the most-recent-testflight-commit cache), so the range is nightly-to-nightly.
Falls back to the last 30 commits when no prior marker is found.

Requires actions: read on the job to query past artifacts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build-submit-ios.yml

@@ -34,6 +34,10 @@ jobs:
     if: github.repository == 'bluesky-social/social-app'
     name: Build and Submit iOS
     runs-on: macos-26-xlarge
+    # actions: read lets the release-notes step query past nightly-build-commit artifacts
+    permissions:
+      contents: read
+      actions: read
     concurrency:
       group: ios-build
       cancel-in-progress: false
@@ -178,6 +182,53 @@ jobs:
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
+      # Build the "What to Test" changelog from the commits since the last nightly build.
+      # The previous nightly's commit SHA is stored as a "nightly-build-commit" artifact
+      # (written at the end of this job), so the range only covers nightly-to-nightly changes
+      # rather than every TestFlight build. Falls back to the most recent commits if no prior
+      # nightly marker is found (e.g. the first run, or after the 90-day artifact retention).
+      - name: 📝 Generate release notes
+        id: notes
+        if: ${{ inputs.assignTestFlightGroup }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Deepen the shallow checkout so the range back to the previous nightly is reachable
+          git fetch --deepen=200 origin || true
+
+          # Find the most recent non-expired nightly-build-commit artifact and read its SHA
+          prev=""
+          url=$(gh api --paginate \
+            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=nightly-build-commit&per_page=100" \
+            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last | .archive_download_url' \
+            2>/dev/null || true)
+          if [ -n "$url" ] && [ "$url" != "null" ]; then
+            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o marker.zip "$url" \
+              && unzip -o -q marker.zip; then
+              prev=$(cat nightly-build-commit.txt 2>/dev/null | tr -d '[:space:]')
+            fi
+            rm -f marker.zip nightly-build-commit.txt
+          fi
+
+          if [ -n "$prev" ] && git cat-file -e "${prev}^{commit}" 2>/dev/null; then
+            echo "Generating notes since previous nightly: $prev"
+            range="${prev}..HEAD"
+          else
+            echo "No reachable previous nightly commit; falling back to last 30 commits."
+            range="HEAD~30..HEAD"
+          fi
+          notes=$(git log --no-merges --pretty=format:'- %s' "$range" 2>/dev/null | head -n 50)
+          if [ -z "$notes" ]; then
+            notes="Nightly build — no new commits since the last nightly."
+          fi
+          # TestFlight "What to Test" is capped at 4000 characters
+          notes=$(printf '%s' "$notes" | cut -c1-3900)
+          {
+            echo "notes<<NOTES_EOF"
+            echo "$notes"
+            echo "NOTES_EOF"
+          } >> "$GITHUB_OUTPUT"
+
       # eas submit only uploads to App Store Connect; it can't assign a build to a
       # TestFlight group. fastlane's distribute_only mode skips the upload and assigns the
       # already-submitted build to the group, polling until Apple finishes processing it.
@@ -189,6 +240,7 @@ jobs:
           ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
           APP_VERSION: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
           BUILD_NUMBER: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}
+          RELEASE_NOTES: ${{ steps.notes.outputs.notes }}
         run: |
           echo "$ASC_KEY_P8_BASE64" | base64 --decode > asc_api_key.p8
           printf '{"key_id":"%s","issuer_id":"%s","key_filepath":"%s","in_house":false}' \
@@ -199,9 +251,25 @@ jobs:
             app_identifier:"xyz.blueskyweb.app" \
             app_version:"$APP_VERSION" \
             build_number:"$BUILD_NUMBER" \
+            changelog:"$RELEASE_NOTES" \
             groups:"QA Team"
           rm -f asc_api_key.p8 asc_api_key.json
 
+      # Record this nightly's commit so the next nightly can diff against it.
+      - name: ✏️ Write nightly commit marker
+        if: ${{ inputs.assignTestFlightGroup }}
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: echo "$GITHUB_SHA" > nightly-build-commit.txt
+
+      - name: 🚀 Upload nightly commit marker
+        if: ${{ inputs.assignTestFlightGroup }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nightly-build-commit
+          path: nightly-build-commit.txt
+          retention-days: 90
+
       - name: 🔔 Notify Slack of Production Build
         if: ${{ inputs.profile == 'production' }}
         uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3