name: Build iOS

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - master
    paths:
      - 'lib/**'
      - 'ios/**'
      - 'pubspec.yaml'
      - '.github/workflows/build-ios.yml'
  pull_request:
    paths:
      - 'lib/**'
      - 'ios/**'
      - 'pubspec.yaml'
      - '.github/workflows/build-ios.yml'

env:
  FLUTTER_VERSION: '3.44.3'

jobs:
  build-ios:
    runs-on: macos-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: 'stable'

      - name: Setup Rust
        uses: ./.github/actions/setup-rust
        with:
          targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios

      - name: Get dependencies
        run: flutter pub get

      - name: Build iOS (no codesign)
        run: |
          flutter config --no-enable-swift-package-manager
          flutter build ios --release --no-codesign

      - name: Package unsigned IPA
        run: |
          mkdir -p dist build/ios/Payload
          cp -R build/ios/iphoneos/Runner.app build/ios/Payload/
          (cd build/ios && zip -qr ../../dist/Qlyra-ios-unsigned.ipa Payload)
          rm -rf build/ios/Payload

      - name: Upload unsigned iOS artifact
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-ios-unsigned
          path: dist/Qlyra-ios-unsigned.ipa
          if-no-files-found: error
          retention-days: 30

      - name: Install ldid
        run: brew install ldid

      - name: Pseudo-sign with ldid
        run: |
          set -euo pipefail
          APP="build/ios/iphoneos/Runner.app"
          ENT="$(mktemp -t ent).plist"
          cat > "$ENT" <<'PLIST'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>get-task-allow</key><true/>
            <key>application-identifier</key><string>ru.qlyra.app</string>
            <key>keychain-access-groups</key>
            <array><string>ru.qlyra.app</string></array>
          </dict>
          </plist>
          PLIST
          if [ -d "$APP/Frameworks" ]; then
            find "$APP/Frameworks" -type f -name "*.dylib" -print0 | xargs -0 -I{} ldid -S "{}"
            find "$APP/Frameworks" -type d -name "*.framework" | while read -r fw; do
              bin="$fw/$(basename "$fw" .framework)"
              [ -f "$bin" ] && ldid -S "$bin"
            done
          fi
          if [ -d "$APP/PlugIns" ]; then
            find "$APP/PlugIns" -type d -name "*.appex" | while read -r ext; do
              bin="$ext/$(basename "$ext" .appex)"
              [ -f "$bin" ] && ldid -S"$ENT" "$bin"
            done
          fi
          ldid -S"$ENT" "$APP/Runner"

      - name: Package IPA
        run: |
          mkdir -p dist build/ios/Payload
          cp -R build/ios/iphoneos/Runner.app build/ios/Payload/
          (cd build/ios && zip -qr ../../dist/Qlyra-ios-pseudosigned.ipa Payload)

      - name: Upload iOS artifact
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-ios-pseudosigned
          path: dist/Qlyra-ios-pseudosigned.ipa
          if-no-files-found: error
          retention-days: 30