name: iOS Prod Release

on:
  workflow_dispatch:
    inputs:
      tramline-input:
        description: "Tramline input"
        required: false

jobs:
  build:
    runs-on: macos-26
    env:
      TERM: dumb
      BUGSNAG_API_KEY: ${{ secrets.BUGSNAG_API_KEY }}
      CERTS_PWD: ${{ secrets.IOS_CERT_PASSWORD }}
      PROVISION_ENCRYPTION_PWD: ${{ secrets.IOS_PROVISIONING_DECRYPT_PWD }}
      KEYCHAIN: ${{ 'twine.keychain' }}
    steps:
      - name: Configure Tramline
        id: tramline
        uses: tramlinehq/deploy-action@v0.1.7
        with:
          input: ${{ github.event.inputs.tramline-input }}

      - name: Setup JDK 21
        uses: actions/setup-java@v5
        with:
          java-version: 21
          distribution: zulu
          cache: 'gradle'

      - name: Install private API key P8
        env:
          PRIVATE_API_KEY_BASE64: ${{ secrets.APP_STORE_API_PRIVATE_KEY }}
          API_KEY: ${{ secrets.APP_STORE_KEY_ID }}
        run: |
          mkdir -p ~/private_keys
          echo -n "$PRIVATE_API_KEY_BASE64" | base64 --decode --output ~/private_keys/AuthKey_$API_KEY.p8

      - name: Configure Keychain
        run: |
          security create-keychain -p "" "$KEYCHAIN"
          security list-keychains -s "$KEYCHAIN"
          security default-keychain -s "$KEYCHAIN"
          security unlock-keychain -p "" "$KEYCHAIN"
          security set-keychain-settings


      - name: Configure code sign
        run: |
          gpg --batch --yes --quiet --decrypt --passphrase="$CERTS_PWD" --output release/certs.p12 release/Certificates.p12.gpg
          gpg --batch --yes --quiet --decrypt --passphrase="$PROVISION_ENCRYPTION_PWD" --output release/provisions.tar.gz release/provisioning.tar.gz.gpg          
          security import 'release/certs.p12' -k "$KEYCHAIN" -P "$CERTS_PWD" -A
          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$KEYCHAIN"
          
          tar xzf 'release/provisions.tar.gz'
          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
          for PROVISION in `ls ./*.mobileprovision`
          do
            UUID=`/usr/libexec/PlistBuddy -c 'Print :UUID' /dev/stdin <<< $(security cms -D -i ./$PROVISION)`
            cp "./$PROVISION" "$HOME/Library/MobileDevice/Provisioning Profiles/$UUID.mobileprovision"
          done


      - name: Update Archive Version
        run: |
          /usr/libexec/Plistbuddy -c "Set CFBundleVersion ${{ steps.tramline.outputs.version_code }}" "iosApp/iosApp/Info.plist"
          /usr/libexec/Plistbuddy -c "Set CFBundleShortVersionString ${{ steps.tramline.outputs.version_name }}" "iosApp/iosApp/Info.plist"


      - name: Build Archive
        run: |          
          xcodebuild -project ./iosApp/iosApp.xcodeproj \
          -scheme iosApp \
          -archivePath $RUNNER_TEMP/twine.xcarchive \
          -sdk iphoneos \
          -configuration Release \
          -destination generic/platform=iOS \
          BUGSNAG_API_KEY=${BUGSNAG_API_KEY} \
          clean archive;

      - name: Export ipa
        env:
          EXPORT_OPTIONS_PLIST: ${{ secrets.EXPORT_OPTIONS_PLIST }}
        run: |
          EXPORT_OPTS_PATH=$RUNNER_TEMP/ExportOptions.plist
          echo -n "$EXPORT_OPTIONS_PLIST" | base64 --decode -o $EXPORT_OPTS_PATH
          xcodebuild -exportArchive -archivePath $RUNNER_TEMP/twine.xcarchive -exportOptionsPlist $EXPORT_OPTS_PATH -exportPath $RUNNER_TEMP/build          

      - name: Clean up secrets
        if: ${{ always() }}
        run: |
          security delete-keychain "$KEYCHAIN"
          rm -rf ~/Library/MobileDevice/Provisioning\ Profiles/
          rm -rf release/

      - name: Upload app to TestFlight
        env:
          API_KEY: ${{ secrets.APP_STORE_KEY_ID }}
          API_ISSUER: ${{ secrets.APP_STORE_ISSUER_ID }}
          APP_PATH: ${{ runner.temp }}/build/twine.ipa
        run: |
          xcrun altool --upload-app --type ios -f $APP_PATH --apiKey $API_KEY --apiIssuer $API_ISSUER

      - name: Upload application
        uses: actions/upload-artifact@v7
        with:
          name: app
          path: ${{ runner.temp }}/build/twine.ipa
