name: macOS release

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Existing GitHub release tag to receive the macOS files
        required: true
        default: v2.0.0-alpha.30
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build-macos:
    runs-on: macos-14
    timeout-minutes: 45
    env:
      HAS_APPLE_SIGNING: ${{ secrets.MAC_CERTIFICATE_P12 != '' }}
      HAS_APPLE_NOTARIZATION: ${{ secrets.APPLE_API_KEY_P8 != '' }}
      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}

    steps:
      - name: Check out source
        uses: actions/checkout@v5

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Generate macOS icon
        run: bash scripts/create-mac-icon.sh

      - name: Verify source
        run: |
          npm run typecheck
          npm run test:run
          npm run build

      - name: Prepare Apple API key
        if: env.HAS_APPLE_NOTARIZATION == 'true'
        env:
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
        run: |
          printf '%s' "$APPLE_API_KEY_P8" > "$RUNNER_TEMP/AuthKey.p8"
          chmod 600 "$RUNNER_TEMP/AuthKey.p8"

      - name: Build unsigned universal DMG and ZIP
        if: env.HAS_APPLE_SIGNING != 'true'
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: npx electron-builder --mac dmg zip --universal --publish never

      - name: Build signed and notarized universal DMG and ZIP
        if: env.HAS_APPLE_SIGNING == 'true' && env.HAS_APPLE_NOTARIZATION == 'true'
        env:
          CSC_LINK: ${{ secrets.MAC_CERTIFICATE_P12 }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
          APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
        run: npx electron-builder --mac dmg zip --universal --publish never -c.mac.notarize=true

      - name: Reject incomplete signing configuration
        if: env.HAS_APPLE_SIGNING == 'true' && env.HAS_APPLE_NOTARIZATION != 'true'
        run: |
          echo 'A signing certificate was supplied without Apple notarization credentials.' >&2
          exit 1

      - name: Verify embedded PAC catalog
        run: |
          test -f dist/module-catalog/wordpress-1.2.0.pac
          test -f "dist/mac-universal/Aurora Dockside.app/Contents/Resources/module-catalog/wordpress-1.2.0.pac"
          cmp dist/module-catalog/wordpress-1.2.0.pac "dist/mac-universal/Aurora Dockside.app/Contents/Resources/module-catalog/wordpress-1.2.0.pac"
          unzip -t "dist/mac-universal/Aurora Dockside.app/Contents/Resources/module-catalog/wordpress-1.2.0.pac"

      - name: Create checksums
        run: |
          find dist -maxdepth 1 -type f \( -name '*.dmg' -o -name '*-mac.zip' -o -name '*.yml' \) -print0 | sort -z | xargs -0 shasum -a 256 > dist/SHA256SUMS-macos.txt
          shasum -a 256 dist/module-catalog/*.pac >> dist/SHA256SUMS-macos.txt
          cat dist/SHA256SUMS-macos.txt

      - name: Upload macOS release bundle
        uses: actions/upload-artifact@v5
        with:
          name: aurora-dockside-macos-universal
          if-no-files-found: error
          retention-days: 14
          path: |
            dist/*.dmg
            dist/*-mac.zip
            dist/*.yml
            dist/SHA256SUMS-macos.txt
            dist/module-catalog/*.pac

      - name: Publish macOS assets
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name }}
        run: |
          gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \
            gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --prerelease --title "Aurora Dockside ${RELEASE_TAG}" --notes "Cross-platform Aurora Dockside testing release."
          gh release upload "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --clobber \
            dist/*.dmg dist/*-mac.zip dist/SHA256SUMS-macos.txt