name: Deploy to App Store

on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  build-and-deploy:
    runs-on: macos-15

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Select Xcode
        run: |
          XCODE=$(ls -d /Applications/Xcode_16*.app 2>/dev/null | sort -V | tail -1)
          echo "Using: $XCODE"
          sudo xcode-select -s "$XCODE/Contents/Developer"
          xcodebuild -version

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "9.0.x"

      - name: Install MAUI Workload
        run: dotnet workload install maui-ios

      - name: Import Signing Certificate
        env:
          CERTIFICATE_P12: ${{ secrets.CERTIFICATE_P12 }}
          CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
        run: |
          CERT_PATH=$RUNNER_TEMP/certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          echo -n "$CERTIFICATE_P12" | base64 --decode -o $CERT_PATH

          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security import $CERT_PATH -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

      - name: Import Provisioning Profile
        env:
          PROVISIONING_PROFILE: ${{ secrets.PROVISIONING_PROFILE }}
        run: |
          PROFILE_PATH=$RUNNER_TEMP/profile.mobileprovision
          echo -n "$PROVISIONING_PROFILE" | base64 --decode -o $PROFILE_PATH

          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
          cp $PROFILE_PATH ~/Library/MobileDevice/Provisioning\ Profiles/

      - name: Build IPA
        working-directory: Xamarin.Neo4j/Xamarin.Neo4j/Xamarin.Neo4j.iOS
        run: |
          dotnet publish -f net9.0-ios \
            -c Release \
            -p:ArchiveOnBuild=true \
            -p:RuntimeIdentifier=ios-arm64 \
            -p:CodesignKey="${{ secrets.CODESIGN_KEY_NAME }}" \
            -p:CodesignProvision="${{ secrets.PROVISIONING_PROFILE_NAME }}"

      - name: Upload to App Store Connect
        env:
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          APP_STORE_CONNECT_KEY: ${{ secrets.APP_STORE_CONNECT_KEY }}
        run: |
          KEY_PATH=$RUNNER_TEMP/AuthKey.p8
          echo -n "$APP_STORE_CONNECT_KEY" > $KEY_PATH

          IPA_PATH=$(find . -name "*.ipa" -type f | head -1)
          echo "Uploading $IPA_PATH"

          xcrun altool --upload-app \
            -f "$IPA_PATH" \
            -t ios \
            --apiKey "$APP_STORE_CONNECT_KEY_ID" \
            --apiIssuer "$APP_STORE_CONNECT_ISSUER_ID" \
            --api-key-path "$KEY_PATH"

      - name: Cleanup
        if: always()
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db 2>/dev/null || true
          rm -f $RUNNER_TEMP/certificate.p12 $RUNNER_TEMP/profile.mobileprovision $RUNNER_TEMP/AuthKey.p8