name: iOS TestFlight

on:
  workflow_dispatch:
  push:
    branches: [master]
    paths:
      - "ios/**"
      - ".github/workflows/ios-testflight.yml"

concurrency:
  group: ios-testflight-${{ github.ref }}
  cancel-in-progress: true

env:
  BUNDLE_ID: com.jcode.mobile
  SCHEME: JCodeMobile
  TEAM_ID: TAS6ARKDN7

jobs:
  test:
    name: swift test (JCodeKit)
    runs-on: macos-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Swift toolchain info
        run: |
          sw_vers
          xcodebuild -version
          swift --version

      - name: Run JCodeKit tests on macOS
        working-directory: ios
        run: swift test

  compile-check:
    name: xcodebuild (simulator, unsigned)
    runs-on: macos-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Install XcodeGen
        run: brew install xcodegen

      - name: Generate Xcode project
        working-directory: ios
        run: xcodegen generate

      - name: Build app target for iOS simulator (no signing)
        working-directory: ios
        run: |
          set -o pipefail
          xcodebuild build \
            -project JCodeMobile.xcodeproj \
            -scheme "$SCHEME" \
            -configuration Debug \
            -destination "generic/platform=iOS Simulator" \
            CODE_SIGNING_ALLOWED=NO \
            | tail -60

  build-and-upload:
    name: Build, sign, upload to TestFlight
    needs: [test, compile-check]
    runs-on: macos-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4

      - name: Install XcodeGen
        run: brew install xcodegen

      - name: Generate Xcode project
        working-directory: ios
        run: xcodegen generate

      - name: Write App Store Connect API key
        env:
          APPSTORE_API_KEY_P8: ${{ secrets.APPSTORE_API_KEY_P8 }}
        run: |
          mkdir -p ~/private_keys
          printf '%s' "$APPSTORE_API_KEY_P8" > ~/private_keys/AuthKey_${{ secrets.APPSTORE_API_KEY_ID }}.p8
          chmod 600 ~/private_keys/AuthKey_${{ secrets.APPSTORE_API_KEY_ID }}.p8

      - name: Archive (cloud-managed signing)
        working-directory: ios
        run: |
          set -o pipefail
          xcodebuild archive \
            -project JCodeMobile.xcodeproj \
            -scheme "$SCHEME" \
            -configuration Release \
            -destination "generic/platform=iOS" \
            -archivePath build/JCodeMobile.xcarchive \
            -allowProvisioningUpdates \
            -authenticationKeyPath "$HOME/private_keys/AuthKey_${{ secrets.APPSTORE_API_KEY_ID }}.p8" \
            -authenticationKeyID "${{ secrets.APPSTORE_API_KEY_ID }}" \
            -authenticationKeyIssuerID "${{ secrets.APPSTORE_ISSUER_ID }}" \
            CODE_SIGN_STYLE=Automatic \
            DEVELOPMENT_TEAM="$TEAM_ID" \
            CURRENT_PROJECT_VERSION="${{ github.run_number }}" \
            | tail -100

      - name: Write export options
        working-directory: ios
        run: |
          cat > ExportOptions.plist <<'EOF'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>method</key>
            <string>app-store-connect</string>
            <key>destination</key>
            <string>upload</string>
            <key>teamID</key>
            <string>TAS6ARKDN7</string>
            <key>uploadSymbols</key>
            <true/>
            <key>manageAppVersionAndBuildNumber</key>
            <false/>
          </dict>
          </plist>
          EOF

      - name: Export and upload to App Store Connect
        working-directory: ios
        run: |
          set -o pipefail
          xcodebuild -exportArchive \
            -archivePath build/JCodeMobile.xcarchive \
            -exportOptionsPlist ExportOptions.plist \
            -exportPath build/export \
            -allowProvisioningUpdates \
            -authenticationKeyPath "$HOME/private_keys/AuthKey_${{ secrets.APPSTORE_API_KEY_ID }}.p8" \
            -authenticationKeyID "${{ secrets.APPSTORE_API_KEY_ID }}" \
            -authenticationKeyIssuerID "${{ secrets.APPSTORE_ISSUER_ID }}" \
            | tail -60

      - name: Cleanup API key
        if: always()
        run: rm -rf ~/private_keys