name: Test macOS DMG Build

on:
  workflow_dispatch:

jobs:
  build-and-verify-dmg:
    runs-on: macos-15
    env:
      UNSPLASH_KEY: ${{ secrets.UNSPLASH_KEY }}
      UNSPLASH_CLIENT_ID: ${{ secrets.UNSPLASH_CLIENT_ID }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Setup Electron build environment
        uses: ./.github/actions/setup-electron-build

      # @nx/nx-darwin-arm64 + dmg-license aren't in package.json (npm's
      # optional-dep bug skips them), so install them explicitly. That install
      # and `npm i` both run electron's flaky postinstall binary download, so
      # retry the whole thing — dropping node_modules/electron between tries
      # forces the postinstall to re-run (npm skips it for a present package).
      - name: Install npm packages
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 15
          shell: bash
          command: npm install @nx/nx-darwin-arm64 dmg-license && npm i || { rm -rf node_modules/electron; exit 1; }

      - name: Decode provisioning profile
        shell: bash
        env:
          PROVISION_PROFILE: ${{ secrets.dl_provision_profile }}
        run: |
          if [ -z "$PROVISION_PROFILE" ]; then
            echo "dl_provision_profile secret is missing"
            exit 1
          fi
          echo "$PROVISION_PROFILE" | base64 --decode > embedded.provisionprofile

      - name: Configure macOS signing keychain
        env:
          MAC_CERTS: ${{ secrets.mac_certs }}
          MAC_CERTS_PASSWORD: ${{ secrets.mac_certs_password }}
        run: |
          set -euo pipefail
          CERT_PATH="$RUNNER_TEMP/mac-certs.p12"
          echo "$MAC_CERTS" | base64 --decode > "$CERT_PATH"

          KEYCHAIN_PATH="$HOME/Library/Keychains/build.keychain-db"
          security create-keychain -p "" build.keychain
          security set-keychain-settings -lut 21600 build.keychain
          security unlock-keychain -p "" build.keychain
          security import "$CERT_PATH" -k build.keychain -P "$MAC_CERTS_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
          security list-keychains -s build.keychain login.keychain
          security default-keychain -s build.keychain
          security set-key-partition-list -S apple-tool:,apple: -k "" build.keychain

          {
            echo "CSC_KEYCHAIN=$KEYCHAIN_PATH"
            echo "CSC_LINK=file://$CERT_PATH"
            echo "CSC_KEY_PASSWORD=$MAC_CERTS_PASSWORD"
          } >> "$GITHUB_ENV"

      - name: Prepare for app notarization
        run: |
          mkdir -p ~/private_keys/
          echo '${{ secrets.mac_api_key }}' > ~/private_keys/AuthKey_${{ secrets.mac_api_key_id }}.p8

      - name: Generate environment & build sources
        run: |
          npm run env
          npm run build

      - name: Build Developer ID DMG
        env:
          API_KEY_ID: ${{ secrets.mac_api_key_id }}
          API_KEY_ISSUER_ID: ${{ secrets.mac_api_key_issuer_id }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
        run: npx electron-builder --mac --publish=never

      - name: Verify DMG signature
        run: |
          set -euo pipefail
          DMG_PATH=$(ls .tmp/app-builds/superProductivity-*.dmg | head -n 1)
          if [ -z "$DMG_PATH" ]; then
            echo "No DMG artefact found"
            exit 1
          fi

          MOUNT_POINT="/Volumes/SuperProductivityTest"
          hdiutil attach "$DMG_PATH" -mountpoint "$MOUNT_POINT" -nobrowse
          trap 'hdiutil detach "$MOUNT_POINT" || true' EXIT

          APP_PATH="$MOUNT_POINT/Super Productivity.app"
          /usr/bin/codesign --verify --deep --strict --verbose=4 "$APP_PATH"
          spctl --assess --verbose "$APP_PATH"
          AUTHORITY_OUTPUT=$(/usr/bin/codesign -dv "$APP_PATH" 2>&1 | grep Authority || true)
          if [ -n "$AUTHORITY_OUTPUT" ]; then
            echo "$AUTHORITY_OUTPUT"
          else
            echo "No Authority lines found in codesign -dv output"
          fi

      - name: Upload DMG artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mac-dmg-build
          path: .tmp/app-builds/*.dmg
          if-no-files-found: error
