name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Version from MARKETING_VERSION, without the v prefix
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: meetingnotes-release
  cancel-in-progress: false

jobs:
  release:
    runs-on: macos-15
    env:
      VERSION: ${{ inputs.version }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
      SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Validate release secrets
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          for variable in APPLE_CERTIFICATE_P12 APPLE_CERTIFICATE_PASSWORD APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD SPARKLE_PRIVATE_KEY; do
            if [[ -z "${!variable:-}" ]]; then
              echo "Missing GitHub Actions secret: $variable" >&2
              exit 1
            fi
          done

      - name: Import Developer ID certificate
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
        run: |
          certificate_path="$RUNNER_TEMP/developer-id.p12"
          keychain_path="$RUNNER_TEMP/release-signing.keychain-db"
          echo -n "$APPLE_CERTIFICATE_P12" | base64 --decode > "$certificate_path"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
          security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
          security list-keychain -d user -s "$keychain_path"
          security default-keychain -d user -s "$keychain_path"
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path"
          signing_identity=$(security find-identity -v -p codesigning "$keychain_path" | awk -F '"' '/Developer ID Application/{print $2; exit}')
          if [[ -z "$signing_identity" ]]; then
            echo "The .p12 does not contain a Developer ID Application identity" >&2
            exit 1
          fi
          echo "SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
          echo "RELEASE_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"

      - name: Build, sign, notarize, and create appcast
        run: scripts/package_release.sh

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="v$VERSION"
          if git rev-parse "$tag" >/dev/null 2>&1; then
            echo "Tag already exists: $tag" >&2
            exit 1
          fi
          gh release create "$tag" \
            "$RUNNER_TEMP/meetingnotes-release/release/Meetingnotes-$VERSION.zip" \
            "$RUNNER_TEMP/meetingnotes-release/release/appcast.xml" \
            --target "$GITHUB_SHA" \
            --title "Meetingnotes $VERSION" \
            --generate-notes

      - name: Remove signing keychain
        if: always()
        run: |
          if [[ -n "${RELEASE_KEYCHAIN:-}" ]]; then
            security delete-keychain "$RELEASE_KEYCHAIN" || true
          fi