From 78ee0c84508c6348d2676fc8853fca5a21c63f37 Mon Sep 17 00:00:00 2001
From: Eric Bailey <git@esb.lol>
Date: Wed, 17 Jun 2026 16:42:53 -0500
Subject: [PATCH] Add nightly iOS/Android build workflow

Add a scheduled workflow (2:10 AM UTC, after the nightly i18n job) that
builds both platforms via reusable workflow_call triggers:
- Android: testflight-android profile, producing an Internal release
- iOS: testflight profile, then assigns the build to the "QA Team"
  TestFlight group via fastlane (distribute_only)

Adds workflow_call triggers + an assignTestFlightGroup input to the iOS
workflow. Assigning to a TestFlight group requires App Store Connect API
key secrets (ASC_KEY_ID, ASC_ISSUER_ID, ASC_KEY_P8_BASE64), which still
need to be added to the repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build-submit-android.yml |  6 ++++
 .github/workflows/build-submit-ios.yml     | 38 ++++++++++++++++++++++
 .github/workflows/nightly-build.yml        | 29 +++++++++++++++++
 3 files changed, 73 insertions(+)
 create mode 100644 .github/workflows/nightly-build.yml

diff --git a/.github/workflows/build-submit-android.yml b/.github/workflows/build-submit-android.yml
index 1a86dce731..88c48dff9f 100644
--- a/.github/workflows/build-submit-android.yml
+++ b/.github/workflows/build-submit-android.yml
@@ -10,6 +10,12 @@ on:
         options:
           - testflight-android
           - production
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
 
 # Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
 permissions:
diff --git a/.github/workflows/build-submit-ios.yml b/.github/workflows/build-submit-ios.yml
index 2c56d98dcc..cdbaaf3eb6 100644
--- a/.github/workflows/build-submit-ios.yml
+++ b/.github/workflows/build-submit-ios.yml
@@ -10,6 +10,20 @@ on:
         options:
           - testflight
           - production
+      assignTestFlightGroup:
+        type: boolean
+        description: Assign the build to the "QA Team" TestFlight group after submitting
+        default: false
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+      assignTestFlightGroup:
+        type: boolean
+        description: Assign the build to the "QA Team" TestFlight group after submitting
+        default: false
 
 # Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
 permissions:
@@ -164,6 +178,30 @@ jobs:
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
+      # eas submit only uploads to App Store Connect; it can't assign a build to a
+      # TestFlight group. fastlane's distribute_only mode skips the upload and assigns the
+      # already-submitted build to the group, polling until Apple finishes processing it.
+      - name: 🧪 Assign build to TestFlight group
+        if: ${{ inputs.assignTestFlightGroup }}
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+          APP_VERSION: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+          BUILD_NUMBER: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}
+        run: |
+          echo "$ASC_KEY_P8_BASE64" | base64 --decode > asc_api_key.p8
+          printf '{"key_id":"%s","issuer_id":"%s","key_filepath":"%s","in_house":false}' \
+            "$ASC_KEY_ID" "$ASC_ISSUER_ID" "$PWD/asc_api_key.p8" > asc_api_key.json
+          fastlane run upload_to_testflight \
+            api_key_path:"$PWD/asc_api_key.json" \
+            distribute_only:true \
+            app_identifier:"xyz.blueskyweb.app" \
+            app_version:"$APP_VERSION" \
+            build_number:"$BUILD_NUMBER" \
+            groups:"QA Team"
+          rm -f asc_api_key.p8 asc_api_key.json
+
       - name: 🔔 Notify Slack of Production Build
         if: ${{ inputs.profile == 'production' }}
         uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
new file mode 100644
index 0000000000..37009bf526
--- /dev/null
+++ b/.github/workflows/nightly-build.yml
@@ -0,0 +1,29 @@
+---
+name: Nightly Build
+
+on:
+  schedule:
+    - cron: "10 2 * * *" # run at 2:10 AM UTC, after the nightly i18n job
+  workflow_dispatch:
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
+jobs:
+  ios:
+    name: Nightly iOS Build
+    if: github.repository == 'bluesky-social/social-app'
+    uses: ./.github/workflows/build-submit-ios.yml
+    with:
+      profile: testflight
+      assignTestFlightGroup: true
+    secrets: inherit
+
+  android:
+    name: Nightly Android Build
+    if: github.repository == 'bluesky-social/social-app'
+    uses: ./.github/workflows/build-submit-android.yml
+    with:
+      profile: testflight-android
+    secrets: inherit