name: "iOS Publish"

# 构建 Expo App 并上传 App Store Connect（之后在 App Store Connect 提交审核）。
#
# Required GitHub Secrets:
#
#   IOS_CERTIFICATE_BASE64         - Apple distribution certificate (.p12) encoded in base64
#   IOS_CERTIFICATE_PASSWORD       - Password for the .p12 certificate
#   IOS_PROVISION_PROFILE_BASE64   - App Store provisioning profile (.mobileprovision) encoded in base64
#   IOS_SHARE_EXTENSION_PROVISION_PROFILE_BASE64 - Share extension App Store provisioning profile (.mobileprovision) encoded in base64
#   ASC_API_KEY_P8_BASE64          - App Store Connect API key (.p8) encoded in base64
#   ASC_API_KEY_ID                 - App Store Connect API Key ID
#   ASC_ISSUER_ID                  - App Store Connect Issuer ID

on:
  workflow_dispatch:
    inputs:
      upload:
        description: 上传到 App Store Connect（关闭则只构建 IPA artifact）
        type: boolean
        default: true

permissions:
  contents: read

concurrency:
  group: ios-publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Build
    uses: ./.github/workflows/app-build.yml
    with:
      platform: ios
      ios_export_method: app-store
      release: true
    secrets: inherit

  submit:
    name: Submit to App Store Connect
    needs: build
    if: inputs.upload
    runs-on: macos-26
    timeout-minutes: 60
    environment: build

    steps:
      - uses: actions/download-artifact@v4
        with:
          name: app-ios
          path: ipa-output

      - uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Upload IPA
        env:
          ASC_API_KEY_ID: ${{ secrets.ASC_API_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_API_KEY_P8_BASE64: ${{ secrets.ASC_API_KEY_P8_BASE64 }}
        run: |
          set -euo pipefail

          mkdir -p ~/private_keys
          echo "$ASC_API_KEY_P8_BASE64" | base64 --decode > ~/private_keys/AuthKey_${ASC_API_KEY_ID}.p8

          IPA_PATH=$(find ipa-output -name "*.ipa" | head -1)
          if [ -z "$IPA_PATH" ]; then
            echo "No IPA file found in ipa-output"
            exit 1
          fi
          echo "Uploading: $IPA_PATH"

          xcrun altool --upload-app \
            -f "$IPA_PATH" \
            --type ios \
            --apiKey "$ASC_API_KEY_ID" \
            --apiIssuer "$ASC_ISSUER_ID"

      - name: Clean up
        if: always()
        run: rm -rf ~/private_keys