#!/usr/bin/env python3
"""Import the CI certificate into an isolated keychain for one release command."""
import base64
import os
import re
import secrets
import subprocess
import sys
import tempfile
from pathlib import Path


def security(*args):
    result = subprocess.run(["security", *args], capture_output=True, text=True)
    if result.returncode:
        raise RuntimeError(f"security {args[0]} failed (output withheld to protect credentials)")
    return result.stdout


with tempfile.TemporaryDirectory(prefix="meetingnotes-signing-", dir=os.environ["RUNNER_TEMP"]) as directory:
    keychain = str(Path(directory) / "release.keychain-db")
    certificate = Path(directory) / "certificate.p12"
    certificate.write_bytes(base64.b64decode(os.environ["APPLE_CERTIFICATE_P12"]))
    certificate.chmod(0o600)
    password = secrets.token_urlsafe(32)
    created = False
    try:
        security("create-keychain", "-p", password, keychain)
        created = True
        security("set-keychain-settings", "-lut", "21600", keychain)
        security("unlock-keychain", "-p", password, keychain)
        security("import", str(certificate), "-k", keychain, "-P", os.environ["APPLE_CERTIFICATE_PASSWORD"], "-T", "/usr/bin/codesign", "-T", "/usr/bin/security")
        security("set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychain)
        identities = security("find-identity", "-v", "-p", "codesigning", keychain)
        match = re.search(r'([0-9A-F]{40}) "Developer ID Application:', identities)
        if not match:
            raise RuntimeError("The certificate contains no valid Developer ID Application identity")
        environment = dict(os.environ, SIGNING_IDENTITY=match[1], SIGNING_KEYCHAIN=keychain)
        status = subprocess.run(sys.argv[1:], env=environment).returncode
    finally:
        if created:
            security("delete-keychain", keychain)
    sys.exit(status)