name: Build

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  macos:
    runs-on: macos-arm64
    steps:
      - uses: actions/checkout@v4
      - name: Build Meetingnotes
        run: >-
          xcodebuild
          -project Meetingnotes.xcodeproj
          -scheme meetingnotes
          -configuration Release
          -destination 'generic/platform=macOS'
          -derivedDataPath "$RUNNER_TEMP/DerivedData"
          ARCHS="arm64 x86_64"
          ONLY_ACTIVE_ARCH=NO
          PRODUCT_BUNDLE_IDENTIFIER=net.jamesbone.meetingnotes.ci
          CODE_SIGNING_ALLOWED=NO
          build
      - name: Sign test build
        run: |
          app_path="$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app"
          codesign --force --deep --sign - \
            --entitlements meetingnotes/meetingnotes.entitlements \
            "$app_path"
          codesign --verify --deep --strict "$app_path"
          codesign -d --entitlements :- "$app_path" 2>&1 \
            | grep -q 'com.apple.security.network.server'
      - name: Smoke test local API
        run: python3 scripts/smoke_test_api.py "$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app"
      - name: Package test build
        if: always()
        run: |
          app_path="$RUNNER_TEMP/DerivedData/Build/Products/Release/Meetingnotes.app"
          ditto -c -k --sequesterRsrc --keepParent \
            "$app_path" "$RUNNER_TEMP/Meetingnotes-macOS.zip"
      - name: Upload test build
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: Meetingnotes-macOS-${{ github.sha }}
          path: ${{ runner.temp }}/Meetingnotes-macOS.zip
          retention-days: 30