name: Release

# Runs only when code lands on main (i.e. after a PR is merged).
on:
  push:
    branches: [main]

# ⚠️ Same runner-label caveat as ci.yml — adjust `runs-on` to match your registered runner.
jobs:
  archive-and-export:
    runs-on: [self-hosted, macos]

    env:
      SCHEME: KisaniCal
      PROJECT: KisaniCal.xcodeproj
      # A real distribution build MUST be signed. This requires an Apple
      # Distribution certificate + provisioning profile installed in the
      # runner's login keychain (see notes at the bottom of this file).

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Regenerate Xcode project (XcodeGen)
        run: |
          if command -v xcodegen >/dev/null 2>&1; then xcodegen generate; fi

      - name: Archive
        run: |
          set -o pipefail
          xcodebuild archive \
            -project "$PROJECT" \
            -scheme "$SCHEME" \
            -configuration Release \
            -destination 'generic/platform=iOS' \
            -archivePath "$RUNNER_TEMP/KisaniCal.xcarchive" \
            -allowProvisioningUpdates

      # Write the App Store Connect API key to disk. xcodebuild's auto-discovery
      # looks for exactly this filename pattern under ~/private_keys.
      - name: Write App Store Connect API key
        run: |
          mkdir -p ~/private_keys
          echo "${{ secrets.APP_STORE_CONNECT_API_KEY_P8 }}" > ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8

      # Export AND upload in one step: passing the API key credentials to
      # -exportArchive makes xcodebuild upload directly to App Store Connect
      # (method "app-store" in ExportOptions.plist) — no separate altool/
      # Transporter step needed. (altool's own upload path was retired by
      # Apple in 2023; this is the current supported mechanism.)
      - name: Export IPA and upload to TestFlight
        run: |
          set -o pipefail
          xcodebuild -exportArchive \
            -archivePath "$RUNNER_TEMP/KisaniCal.xcarchive" \
            -exportOptionsPlist ExportOptions.plist \
            -exportPath "$RUNNER_TEMP/export" \
            -allowProvisioningUpdates \
            -authenticationKeyPath ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8 \
            -authenticationKeyID ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }} \
            -authenticationKeyIssuerID ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          ls -la "$RUNNER_TEMP/export"

      - name: Clean up API key
        if: always()
        run: rm -rf ~/private_keys