name: Build macOS DMG (arm64)

on:
  workflow_dispatch:
    inputs:
      macos_version:
        description: macOS runner version
        required: true
        type: choice
        options:
          - "macos-15"
          - "macos-26"
        default: "macos-15"
      ref:
        description: Git ref to build (branch, tag, or sha)
        required: false
        default: ""

env:
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: short

jobs:
  build-macos-dmg-arm64:
    name: Build DMG (arm64, ${{ inputs.macos_version }})
    runs-on: ${{ inputs.macos_version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Setup bun
        uses: oven-sh/setup-bun@v2

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: packages/desktop/src-tauri
          key: aarch64-apple-darwin

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Install Apple Certificate
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          echo "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 \
            -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 \
            -k "$KEYCHAIN_PATH"

          security list-keychain -d user -s "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple:,codesign: \
            -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

      - name: Set up notarization credentials
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        run: |
          if [ -z "$APPLE_ID" ] || [ -z "$APPLE_TEAM_ID" ] || [ -z "$APPLE_PASSWORD" ]; then
            echo "Error: Missing Apple notarization credentials"
            exit 1
          fi

          xcrun notarytool store-credentials "openchamber-notarize" \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_PASSWORD"

      - name: Build UI package
        run: bun run --cwd packages/ui build

      - name: Build Desktop app (arm64)
        run: bun run --cwd packages/desktop build && bun run --cwd packages/desktop tauri build --target aarch64-apple-darwin
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Prepare DMG artifact
        run: |
          set -euo pipefail
          mkdir -p artifacts
          DMG_PATH="packages/desktop/src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/*.dmg"
          if ls $DMG_PATH 1> /dev/null 2>&1; then
            DMG_FILE=$(ls $DMG_PATH | head -n 1)
            DMG_NAME="OpenChamber_${{ inputs.macos_version }}_arm64.dmg"
            cp "$DMG_FILE" "artifacts/$DMG_NAME"
          else
            echo "Error: DMG file not found at $DMG_PATH"
            exit 1
          fi

      - name: Upload DMG artifact
        uses: actions/upload-artifact@v4
        with:
          name: dmg-${{ inputs.macos_version }}-arm64
          path: artifacts/*.dmg
          retention-days: 7