#!/bin/zsh

set -euo pipefail

ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
SCRIPT_DIR="$ROOT_DIR/scripts"
APP_VERSION_CONFIG="$ROOT_DIR/Configs/AppVersion.xcconfig"
PROJECT_FILE="$ROOT_DIR/MacTools.xcodeproj"
XCODEBUILD="${XCODEBUILD:-$SCRIPT_DIR/xcodebuild-filtered.sh}"
APP_NAME="MacTools"
APP_ENTITLEMENTS="$ROOT_DIR/Configs/MacTools.entitlements"
FINDER_SYNC_ENTITLEMENTS="$ROOT_DIR/Sources/Extensions/RightClickFinderSync/RightClickFinderSync.entitlements"
SCHEME="MacTools"
CONFIG_FILE="${RELEASE_CONFIG_FILE:-$SCRIPT_DIR/release.local.env}"
DEFAULT_GITHUB_REPOSITORY="ggbond268/MacTools"

VERSION=""
BUILD_NUMBER=""
TAG=""
NOTES_FILE=""
SPARKLE_NOTES_FILE=""
PUBLISH=0
PUBLISH_EXISTING=0
SKIP_BUILD=0
SKIP_SIGN=0
SKIP_NOTARIZE=0
FORCE=0

if [[ -f "$CONFIG_FILE" ]]; then
  # shellcheck disable=SC1090
  source "$CONFIG_FILE"
fi

function usage() {
  cat <<'EOF'
Usage:
  ./scripts/release-local.sh [options]

Options:
  --version <version>        Release marketing version. Defaults to Configs/AppVersion.xcconfig.
  --build-number <number>    Release build number. Defaults to Configs/AppVersion.xcconfig.
  --tag <tag>                Git tag / release tag. Defaults to v<version>.
  --notes-file <path>        Release notes file for GitHub Release upload.
  --publish                  Push the tag and sync the DMG to GitHub Releases.
  --publish-existing         Upload the existing DMG artifact without rebuilding.
  --skip-build               Reuse the existing Release app in build/DerivedData.
  --skip-sign                Skip Developer ID signing. Implies --skip-notarize.
  --skip-notarize            Skip notarization and stapling.
  --force                    Recreate the local tag if it already points elsewhere.
  -h, --help                 Show this help message.

Environment:
  Copy scripts/release.local.env.sample to scripts/release.local.env
  and set:
    DEVELOPER_ID_APPLICATION
    APPLE_NOTARY_PROFILE
    GITHUB_REPOSITORY
    DMG_SIGNING_IDENTIFIER (optional)
    SPARKLE_KEYCHAIN_ACCOUNT (optional)
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --version)
      VERSION="${2:-}"
      shift 2
      ;;
    --build-number)
      BUILD_NUMBER="${2:-}"
      shift 2
      ;;
    --tag)
      TAG="${2:-}"
      shift 2
      ;;
    --notes-file)
      NOTES_FILE="${2:-}"
      shift 2
      ;;
    --publish)
      PUBLISH=1
      shift
      ;;
    --publish-existing)
      PUBLISH_EXISTING=1
      shift
      ;;
    --skip-build)
      SKIP_BUILD=1
      shift
      ;;
    --skip-sign)
      SKIP_SIGN=1
      SKIP_NOTARIZE=1
      shift
      ;;
    --skip-notarize)
      SKIP_NOTARIZE=1
      shift
      ;;
    --force)
      FORCE=1
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown option: $1" >&2
      usage >&2
      exit 1
      ;;
  esac
done

function info() {
  printf '[release] %s\n' "$1"
}

function fail() {
  printf '[release] error: %s\n' "$1" >&2
  exit 1
}

function require_command() {
  command -v "$1" >/dev/null 2>&1 || fail "Missing required command: $1"
}

function available_code_signing_identities() {
  security find-identity -v -p codesigning 2>/dev/null || true
}

function require_release_signing_identity() {
  local identities matched_identity

  identities="$(available_code_signing_identities)"
  [[ -n "$identities" ]] || fail "当前钥匙串里没有可用的代码签名身份。"

  matched_identity="$(printf '%s\n' "$identities" | grep -F "\"$DEVELOPER_ID_APPLICATION\"" || true)"

  if [[ -z "$matched_identity" ]]; then
    fail "未找到签名身份 \"$DEVELOPER_ID_APPLICATION\"。

请在 scripts/release.local.env 中把 DEVELOPER_ID_APPLICATION 设置为钥匙串里的完整证书名称，例如：
  DEVELOPER_ID_APPLICATION=\"Developer ID Application: Your Name (TEAMID)\"

当前可见的代码签名身份：
$identities"
  fi

  if [[ "$matched_identity" != *"Developer ID Application:"* ]]; then
    fail "当前匹配到的签名身份不是 Developer ID Application 证书：
$matched_identity

本脚本用于外部正式分发，必须使用 Developer ID Application 证书，而不是 Apple Development 证书。"
  fi
}

function read_version_setting() {
  local key="$1"
  awk -v key="$key" '$1 == key && $2 == "=" { print $3; exit }' "$APP_VERSION_CONFIG"
}

function git_repository() {
  if [[ -n "${GITHUB_REPOSITORY:-}" ]]; then
    printf '%s\n' "$GITHUB_REPOSITORY"
    return 0
  fi

  local remote_url
  remote_url="$(git -C "$ROOT_DIR" remote get-url origin 2>/dev/null || true)"

  case "$remote_url" in
    git@github.com:*)
      remote_url="${remote_url#git@github.com:}"
      printf '%s\n' "${remote_url%.git}"
      ;;
    https://github.com/*)
      remote_url="${remote_url#https://github.com/}"
      printf '%s\n' "${remote_url%.git}"
      ;;
    ssh://git@github.com/*)
      remote_url="${remote_url#ssh://git@github.com/}"
      printf '%s\n' "${remote_url%.git}"
      ;;
    *)
      printf '%s\n' "$DEFAULT_GITHUB_REPOSITORY"
      ;;
  esac
}

function sparkle_bin_dir() {
  local bin_dir="${SPARKLE_BIN_DIR:-$DERIVED_DATA/SourcePackages/artifacts/sparkle/Sparkle/bin}"
  [[ -x "$bin_dir/sign_update" ]] || fail "未找到 Sparkle 工具链：$bin_dir

请先执行一次 xcodebuild / make build，让 Xcode 拉取 Sparkle 包依赖后再发布。"
  printf '%s\n' "$bin_dir"
}

function sparkle_signature() {
  local dmg_path="$1"
  local bin_dir signature
  bin_dir="$(sparkle_bin_dir)"
  signature="$("$bin_dir/sign_update" --account "${SPARKLE_KEYCHAIN_ACCOUNT:-ed25519}" -p "$dmg_path")" \
    || fail "无法使用 Sparkle EdDSA 私钥为 DMG 签名。

请先运行：
  $(sparkle_bin_dir)/generate_keys

然后允许 Sparkle 访问本机钥匙串中的更新签名密钥。"

  [[ -n "$signature" ]] || fail "Sparkle EdDSA 签名结果为空。"
  printf '%s\n' "$signature"
}

function release_download_url() {
  local repository="$1"
  printf 'https://github.com/%s/releases/download/%s/%s.dmg\n' "$repository" "$TAG" "$APP_NAME"
}

function release_notes_url() {
  local repository="$1"
  printf 'https://github.com/%s/releases/tag/%s\n' "$repository" "$TAG"
}

function write_appcast() {
  local dmg_path="$1"
  local repository download_url notes_url signature file_size pub_date minimum_system_version

  repository="$(git_repository)"
  download_url="$(release_download_url "$repository")"
  notes_url="$(release_notes_url "$repository")"
  signature="$(sparkle_signature "$dmg_path")"
  file_size="$(stat -f '%z' "$dmg_path")"
  pub_date="$(LC_ALL=C date -u '+%a, %d %b %Y %H:%M:%S +0000')"
  minimum_system_version="${SPARKLE_MINIMUM_SYSTEM_VERSION:-14.0}"

  mkdir -p "$DOCS_DIR"

  APP_NAME="$APP_NAME" \
  VERSION="$VERSION" \
  BUILD_NUMBER="$BUILD_NUMBER" \
  DOWNLOAD_URL="$download_url" \
  RELEASE_NOTES_URL="$notes_url" \
  PUB_DATE="$pub_date" \
  FILE_SIZE="$file_size" \
  ED_SIGNATURE="$signature" \
  MINIMUM_SYSTEM_VERSION="$minimum_system_version" \
  SPARKLE_NOTES_FILE="$SPARKLE_NOTES_FILE" \
  APPCAST_PATH="$APPCAST_PATH" \
  python3 <<'PY_APPCAST'
import os
import xml.sax.saxutils as xml
from pathlib import Path

values = {
    key: os.environ[key]
    for key in [
        "APP_NAME",
        "VERSION",
        "BUILD_NUMBER",
        "DOWNLOAD_URL",
        "RELEASE_NOTES_URL",
        "PUB_DATE",
        "FILE_SIZE",
        "ED_SIGNATURE",
        "MINIMUM_SYSTEM_VERSION",
    ]
}
release_notes = Path(os.environ["SPARKLE_NOTES_FILE"]).read_text(encoding="utf-8")
cdata_release_notes = release_notes.replace("]]>", "]]]]><![CDATA[>")

content = f'''<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" xmlns:dc="http://purl.org/dc/elements/1.1/">
    <channel>
        <title>{xml.escape(values["APP_NAME"])} Releases</title>
        <description>Latest release metadata for {xml.escape(values["APP_NAME"])}.</description>
        <language>en</language>
        <item>
            <title>Version {xml.escape(values["VERSION"])}</title>
            <link>{xml.escape(values["RELEASE_NOTES_URL"])}</link>
            <sparkle:version>{xml.escape(values["BUILD_NUMBER"])}</sparkle:version>
            <sparkle:shortVersionString>{xml.escape(values["VERSION"])}</sparkle:shortVersionString>
            <description sparkle:format="markdown"><![CDATA[{cdata_release_notes}]]></description>
            <sparkle:fullReleaseNotesLink>{xml.escape(values["RELEASE_NOTES_URL"])}</sparkle:fullReleaseNotesLink>
            <pubDate>{xml.escape(values["PUB_DATE"])}</pubDate>
            <enclosure url="{xml.escape(values["DOWNLOAD_URL"])}" length="{xml.escape(values["FILE_SIZE"])}" type="application/octet-stream" sparkle:edSignature="{xml.escape(values["ED_SIGNATURE"])}" />
            <sparkle:minimumSystemVersion>{xml.escape(values["MINIMUM_SYSTEM_VERSION"])}</sparkle:minimumSystemVersion>
        </item>
    </channel>
</rss>
'''
Path(os.environ["APPCAST_PATH"]).write_text(content, encoding="utf-8")
PY_APPCAST

  python3 -c 'import sys, xml.etree.ElementTree as ET; ET.parse(sys.argv[1])' "$APPCAST_PATH"

  info "Appcast updated: $APPCAST_PATH"
}

function ensure_clean_git() {
  local worktree_status
  worktree_status="$(git -C "$ROOT_DIR" status --porcelain)"
  [[ -z "$worktree_status" ]] || fail "Git 工作区必须干净后才能 --publish。"
}

function ensure_tag_ready() {
  local head_commit existing_commit
  head_commit="$(git -C "$ROOT_DIR" rev-parse HEAD)"

  if git -C "$ROOT_DIR" rev-parse -q --verify "refs/tags/$TAG" >/dev/null 2>&1; then
    existing_commit="$(git -C "$ROOT_DIR" rev-list -n 1 "$TAG")"
    if [[ "$existing_commit" != "$head_commit" ]]; then
      [[ "$FORCE" -eq 1 ]] || fail "标签 $TAG 已存在且不指向当前提交，添加 --force 才会重建。"
      git -C "$ROOT_DIR" tag -d "$TAG" >/dev/null
    fi
  fi

  if ! git -C "$ROOT_DIR" rev-parse -q --verify "refs/tags/$TAG" >/dev/null 2>&1; then
    git -C "$ROOT_DIR" tag -a "$TAG" -m "Release $TAG"
  fi

  if [[ "$FORCE" -eq 1 ]]; then
    git -C "$ROOT_DIR" push --force origin "refs/tags/$TAG"
  else
    git -C "$ROOT_DIR" push origin "refs/tags/$TAG"
  fi
}

function sign_path() {
  local path="$1"
  /usr/bin/codesign \
    --force \
    --sign "$DEVELOPER_ID_APPLICATION" \
    --options runtime \
    --timestamp \
    "$path"
}

function sign_path_preserving_entitlements() {
  local path="$1"
  /usr/bin/codesign \
    --force \
    --sign "$DEVELOPER_ID_APPLICATION" \
    --options runtime \
    --timestamp \
    --preserve-metadata=entitlements \
    "$path"
}

function sign_path_with_entitlements() {
  local path="$1"
  local entitlements="$2"

  [[ -f "$entitlements" ]] || fail "未找到 entitlements：$entitlements"

  /usr/bin/codesign \
    --force \
    --sign "$DEVELOPER_ID_APPLICATION" \
    --options runtime \
    --timestamp \
    --entitlements "$entitlements" \
    "$path"
}

function sign_app_path() {
  local path="$1"

  [[ -f "$APP_ENTITLEMENTS" ]] || fail "未找到 app entitlements：$APP_ENTITLEMENTS"

  /usr/bin/codesign \
    --force \
    --sign "$DEVELOPER_ID_APPLICATION" \
    --options runtime \
    --timestamp \
    --entitlements "$APP_ENTITLEMENTS" \
    "$path"
}

function is_inside_sparkle_framework() {
  local path="$1"
  [[ "$path" == *"/Sparkle.framework" || "$path" == *"/Sparkle.framework/"* ]]
}

function is_right_click_finder_sync_extension() {
  local path="$1"
  [[ "$(basename "$path")" == "RightClickFinderSync.appex" ]]
}

function sign_sparkle_framework() {
  local app_path="$1"
  local sparkle_framework="$app_path/Contents/Frameworks/Sparkle.framework"
  local sparkle_current="$sparkle_framework/Versions/Current"

  [[ -d "$sparkle_framework" ]] || return 0

  if [[ -d "$sparkle_current/XPCServices/Installer.xpc" ]]; then
    sign_path "$sparkle_current/XPCServices/Installer.xpc"
  fi

  if [[ -d "$sparkle_current/XPCServices/Downloader.xpc" ]]; then
    sign_path_preserving_entitlements "$sparkle_current/XPCServices/Downloader.xpc"
  fi

  if [[ -f "$sparkle_current/Autoupdate" ]]; then
    sign_path "$sparkle_current/Autoupdate"
  fi

  if [[ -d "$sparkle_current/Updater.app" ]]; then
    sign_path "$sparkle_current/Updater.app"
  fi

  sign_path "$sparkle_framework"
}

function validate_finder_sync_extension() {
  local app_path="$1"
  local extension_path="$app_path/Contents/PlugIns/RightClickFinderSync.appex"
  local extension_point entitlements

  [[ -d "$extension_path" ]] || fail "未找到 Finder Sync 扩展：$extension_path"

  extension_point="$(/usr/libexec/PlistBuddy -c "Print :NSExtension:NSExtensionPointIdentifier" "$extension_path/Contents/Info.plist" 2>/dev/null || true)"
  [[ "$extension_point" == "com.apple.FinderSync" ]] \
    || fail "Finder Sync 扩展 Info.plist 缺少正确的 NSExtensionPointIdentifier。"

  entitlements="$(/usr/bin/codesign -d --entitlements :- "$extension_path" 2>/dev/null || true)"
  [[ "$entitlements" == *"com.apple.security.app-sandbox"* ]] \
    || fail "Finder Sync 扩展签名缺少 com.apple.security.app-sandbox entitlement。"

  [[ "$entitlements" == *"com.apple.security.temporary-exception.files.home-relative-path.read-only"* ]] \
    || fail "Finder Sync 扩展签名缺少读取右键配置文件所需的 temporary exception entitlement。"
}

function app_bundle_identifier() {
  local app_path="$1"
  /usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" "$app_path/Contents/Info.plist" 2>/dev/null \
    || fail "无法从 $app_path 读取 CFBundleIdentifier。"
}

function dmg_signing_identifier() {
  local app_path="$1"

  if [[ -n "${DMG_SIGNING_IDENTIFIER:-}" ]]; then
    printf '%s\n' "$DMG_SIGNING_IDENTIFIER"
    return 0
  fi

  printf '%s\n' "$(app_bundle_identifier "$app_path").disk-image"
}

function sign_app_bundle() {
  local app_path="$1"

  if [[ -d "$app_path/Contents" ]]; then
    while IFS= read -r binary; do
      [[ -n "$binary" ]] || continue
      sign_path "$binary"
    done < <(find "$app_path/Contents" -type f \( -name "*.dylib" -o -name "*.so" \) -print)

    while IFS= read -r bundle; do
      [[ -n "$bundle" ]] || continue
      if is_inside_sparkle_framework "$bundle"; then
        continue
      fi
      if is_right_click_finder_sync_extension "$bundle"; then
        sign_path_with_entitlements "$bundle" "$FINDER_SYNC_ENTITLEMENTS"
      else
        sign_path "$bundle"
      fi
    done < <(find "$app_path/Contents" -depth -type d \( -name "*.framework" -o -name "*.app" -o -name "*.xpc" -o -name "*.appex" \) -print)

    sign_sparkle_framework "$app_path"
  fi

  sign_app_path "$app_path"
  validate_finder_sync_extension "$app_path"
  /usr/bin/codesign --verify --deep --strict --verbose=2 "$app_path"
}

function sign_disk_image() {
  local dmg_path="$1"
  local identifier="$2"

  /usr/bin/codesign \
    --force \
    --sign "$DEVELOPER_ID_APPLICATION" \
    --timestamp \
    --identifier "$identifier" \
    "$dmg_path"

  /usr/bin/codesign --verify --verbose=2 "$dmg_path"
}

function build_release_app() {
  require_command xcodegen
  require_command "$XCODEBUILD"

  info "Generating Xcode project"
  (cd "$ROOT_DIR" && make generate >/dev/null)

  info "Building Release app version=$VERSION build=$BUILD_NUMBER"
  "$XCODEBUILD" \
    -project "$PROJECT_FILE" \
    -scheme "$SCHEME" \
    -configuration Release \
    -destination "generic/platform=macOS" \
    -derivedDataPath "$DERIVED_DATA" \
    MARKETING_VERSION="$VERSION" \
    CURRENT_PROJECT_VERSION="$BUILD_NUMBER" \
    CODE_SIGNING_ALLOWED=NO \
    CODE_SIGNING_REQUIRED=NO \
    CODE_SIGN_IDENTITY= \
    build \
    -quiet
}

function create_dmg() {
  local app_path="$1"
  local dmg_path="$2"
  local volume_name="${DMG_VOLUME_NAME:-$APP_NAME}"
  local stage_dir
  stage_dir="$(/usr/bin/mktemp -d "${TMPDIR:-/tmp}/mactools-release-dmg.XXXXXX")"

  ditto "$app_path" "$stage_dir/$APP_NAME.app"
  ln -s /Applications "$stage_dir/Applications"

  info "Creating DMG at $dmg_path"
  hdiutil create \
    -volname "$volume_name" \
    -srcfolder "$stage_dir" \
    -ov \
    -format UDZO \
    "$dmg_path" >/dev/null

  /bin/rm -rf "$stage_dir"
}

function notarize_dmg() {
  local dmg_path="$1"
  [[ -n "${APPLE_NOTARY_PROFILE:-}" ]] || fail "缺少 APPLE_NOTARY_PROFILE，无法公证。"

  info "Submitting DMG for notarization"
  xcrun notarytool submit "$dmg_path" --keychain-profile "$APPLE_NOTARY_PROFILE" --wait

  info "Stapling notarization ticket"
  xcrun stapler staple -v "$dmg_path"
}

function validate_notarized_dmg() {
  local dmg_path="$1"
  local assessment_output

  assessment_output="$(spctl -a -t open --context context:primary-signature -v "$dmg_path" 2>&1)" \
    || fail "Gatekeeper 未接受最终 DMG：
$assessment_output"

  info "Gatekeeper assessment passed"
  printf '%s\n' "$assessment_output"
}

function require_existing_dmg() {
  local dmg_path="$1"
  [[ -f "$dmg_path" ]] || fail "未找到现有 DMG：$dmg_path

如果你想先构建并公证新包，请直接运行：
  ./scripts/release-local.sh

如果你已经做过一次完整发布，请确认要上传的 DMG 仍在上面的路径。"
}

function publish_release() {
  local dmg_path="$1"
  local repository
  repository="$(git_repository)" || fail "无法推断 GitHub 仓库，请在 scripts/release.local.env 中设置 GITHUB_REPOSITORY。"

  require_command gh
  gh auth status >/dev/null 2>&1 || fail "gh 尚未登录，请先运行 gh auth login。"
  ensure_clean_git
  ensure_tag_ready

  if [[ -z "$NOTES_FILE" ]]; then
    NOTES_FILE="$(mktemp "${TMPDIR:-/tmp}/mactools-release-notes.XXXXXX.md")"
    python3 "$ROOT_DIR/scripts/changelog.py" extract --tag "$TAG" --output "$NOTES_FILE"
  fi

  SPARKLE_NOTES_FILE="$(mktemp "${TMPDIR:-/tmp}/mactools-sparkle-notes.XXXXXX.md")"
  python3 "$ROOT_DIR/scripts/changelog.py" compose-sparkle \
    --tag "$TAG" \
    --app-notes "$NOTES_FILE" \
    --output "$SPARKLE_NOTES_FILE"

  info "Syncing asset to GitHub Release $TAG ($repository)"

  if gh release view "$TAG" --repo "$repository" >/dev/null 2>&1; then
    gh release upload "$TAG" "$dmg_path" --repo "$repository" --clobber
    gh release edit "$TAG" --repo "$repository" --title "$APP_NAME $VERSION" --notes-file "$NOTES_FILE"
  else
    gh release create "$TAG" "$dmg_path" --repo "$repository" --title "$APP_NAME $VERSION" --notes-file "$NOTES_FILE"
  fi
}

require_command ditto
require_command hdiutil
require_command shasum
require_command codesign
require_command git

VERSION="${VERSION:-$(read_version_setting MARKETING_VERSION)}"
BUILD_NUMBER="${BUILD_NUMBER:-$(read_version_setting CURRENT_PROJECT_VERSION)}"
TAG="${TAG:-v$VERSION}"
NOTES_FILE="${NOTES_FILE:-${GITHUB_RELEASE_NOTES_FILE:-}}"

[[ -n "$VERSION" ]] || fail "无法从 Configs/AppVersion.xcconfig 读取 MARKETING_VERSION。"
[[ -n "$BUILD_NUMBER" ]] || fail "无法从 Configs/AppVersion.xcconfig 读取 CURRENT_PROJECT_VERSION。"
if [[ -n "$NOTES_FILE" && ! -f "$NOTES_FILE" ]]; then
  fail "Release notes 文件不存在：$NOTES_FILE"
fi
if [[ "$PUBLISH" -eq 1 && "$PUBLISH_EXISTING" -eq 1 ]]; then
  fail "--publish 和 --publish-existing 不能同时使用。"
fi

ARTIFACT_DIR="$ROOT_DIR/build/release/$TAG"
DERIVED_DATA="$ROOT_DIR/build/DerivedData"
APP_PATH="$DERIVED_DATA/Build/Products/Release/$APP_NAME.app"
SIGNED_APP_PATH="$ARTIFACT_DIR/$APP_NAME.app"
DMG_PATH="$ARTIFACT_DIR/$APP_NAME.dmg"
DMG_IDENTIFIER=""
DOCS_DIR="$ROOT_DIR/docs"
APPCAST_PATH="$DOCS_DIR/appcast.xml"

mkdir -p "$ARTIFACT_DIR"

if [[ "$PUBLISH_EXISTING" -eq 1 ]]; then
  require_existing_dmg "$DMG_PATH"
  validate_notarized_dmg "$DMG_PATH"
else
  if [[ "$SKIP_BUILD" -eq 0 ]]; then
    build_release_app
  fi

  [[ -d "$APP_PATH" ]] || fail "未找到 Release app：$APP_PATH"

  info "Preparing artifact directory $ARTIFACT_DIR"
  rm -rf "$SIGNED_APP_PATH" "$DMG_PATH"
  ditto "$APP_PATH" "$SIGNED_APP_PATH"

  if [[ "$SKIP_SIGN" -eq 0 ]]; then
    [[ -n "${DEVELOPER_ID_APPLICATION:-}" ]] || fail "缺少 DEVELOPER_ID_APPLICATION，无法做正式签名。"
    require_release_signing_identity
    info "Signing app with Developer ID"
    sign_app_bundle "$SIGNED_APP_PATH"
    DMG_IDENTIFIER="$(dmg_signing_identifier "$SIGNED_APP_PATH")"
  else
    info "Skipping code signing"
  fi

  create_dmg "$SIGNED_APP_PATH" "$DMG_PATH"

  if [[ "$SKIP_SIGN" -eq 0 ]]; then
    info "Signing DMG with Developer ID identifier=$DMG_IDENTIFIER"
    sign_disk_image "$DMG_PATH" "$DMG_IDENTIFIER"
  fi

  if [[ "$SKIP_NOTARIZE" -eq 0 ]]; then
    require_command xcrun
    notarize_dmg "$DMG_PATH"
    validate_notarized_dmg "$DMG_PATH"
  else
    info "Skipping notarization"
  fi
fi

DMG_SHA256="$(shasum -a 256 "$DMG_PATH" | awk '{print $1}')"
info "DMG ready: $DMG_PATH"
info "SHA256: $DMG_SHA256"

if [[ "$PUBLISH" -eq 1 ]]; then
  publish_release "$DMG_PATH"
  write_appcast "$DMG_PATH"
  info "Appcast updated after GitHub Release publish: $APPCAST_PATH"
fi

if [[ "$PUBLISH_EXISTING" -eq 1 ]]; then
  publish_release "$DMG_PATH"
  write_appcast "$DMG_PATH"
  info "Appcast updated after existing artifact publish: $APPCAST_PATH"
fi

if [[ "$PUBLISH" -eq 0 && "$PUBLISH_EXISTING" -eq 0 ]]; then
  info "Skipping appcast update because this run did not publish a GitHub Release."
fi

info "Done"