2026 Cross-Border TestFlight Automation: Colocate the Physical Mac Uploader With the Build Runner or Near the App Store Connect Path?

2. Placement matrix: runner-colocated uploader vs “ASC-friendly” second region

“Closer to App Store Connect” is shorthand for an egress with stable TLS, low packet loss, and predictable DNS—not a magic country pin. Use this matrix to choose the primary physical Mac pool.

Default for 2026: keep the unattended Mac that runs fastlane pilot next to the machine that produced the IPA unless measurements prove the Apple-facing leg is the outlier.

3. Symptom matrix: timeout-like failures vs HTTP 429

4. Seven-step rollout runbook

1. Timestamp three checkpoints—build complete, artifact on uploader disk, first successful HTTP response from Apple during upload.
2. Plot one week of builds; if artifact segments exceed 35–45% of wall time, stop evaluating “US-only” uploaders.
3. Baseline the network with curl -o /dev/null -w '%{time_connect} %{time_starttransfer}\n' against App Store Connect API endpoints from the candidate Mac.
4. Apply env tuning (section 5) on a branch build; keep a control job unchanged for comparison.
5. If timeouts persist with short artifact phases, provision a second physical Mac on a different ISP or cloud on-ramp and replay the same IPA.
6. If 429 appears, halve concurrent pilot lanes and insert randomized 30–120 s jitter between retries.
7. Document pins—macOS patch level, Xcode build number, fastlane Gemfile.lock, and proxy PAC URL—in your internal wiki.

5. Copy-paste environment variables and flags

Paste into your CI secret store or launchd plist after reviewing fastlane release notes for your exact version. Values are examples—raise or lower based on IPA size.

# Spaceship / App Store Connect client
export SPACESHIP_TIMEOUT=1200
export FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT=120

# Verbose CI logs (redact in public artifacts)
export FASTLANE_DEBUG=1

# Example pilot lane—adjust to your Fastfile
# pilot(
#   skip_waiting_for_build_processing: true,
#   distribute_external: false,
#   api_key_path: "asc_api_key.json"
# )

Pair API keys with least-privilege roles and separate keys per product line when 429 correlates with org-wide automation spikes. Notarization-heavy trains that precede TestFlight benefit from the same regional egress discipline—treat both uploads as one reliability program.

6. Triage checklist before you file a radar or buy new hardware

• Confirm the uploader sees the same SHA256 for the IPA as the builder logged.
• Disable HTTP proxies temporarily on a canary Mac; if uploads succeed, fix PAC/WPAD instead of relocating regions.
• Ensure system time sync (sntp) on unattended Macs; skew breaks token refresh patterns.
• Check disk: APFS snapshots or near-full volumes slow temporary transporter directories.
• Correlate 429 spikes with marketing re-uploads or third-party ASO tools using the same API identity.
• Capture fastlane env output once per quarter after upgrades.

7. Numbers to cite in architecture reviews

• 40% artifact share—practical threshold to prioritize runner colocation over uplink tuning.
• 1200 s Spaceship window—starting point for 3+ GB IPAs on 50–100 Mbps sustained links.
• 30–120 s jitter—empirically reduces 429 bursts when multiple pipelines restart simultaneously after an outage.

8. FAQ

Is “upload from California” still the default answer?

Only if your measurements show the Apple-facing leg is the bottleneck after artifact timing is honest. Many Asian and European teams succeed with local Mac pools once proxies and MTU are sane.

Does Transporter.app behave differently than pilot?

Underlying transport constraints overlap; if GUI Transporter works while pilot fails, diff Ruby OpenSSL, proxy env vars, and fastlane plugins before blaming Apple.

Should we use one Apple ID for every CI job?

Avoid it—429 risk scales with shared identities. Prefer App Store Connect API keys scoped per service with centralized rotation.