name: Beta (TestFlight, on PR to develop)

on:
  pull_request:
    branches:
      - develop

jobs:
  build-and-upload:
    runs-on: macos-build

    env:
      BUILD_NUMBER: ${{ github.run_number }}

    steps:
      - name: Checkout repository (workaround - Gitea git-upload-pack bug, see go-gitea/gitea#21819)
        run: |
          curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -o /tmp/repo.tar.gz \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
          tar -xzf /tmp/repo.tar.gz --strip-components=1 -C "$GITHUB_WORKSPACE"

      - name: Check ASC secrets are present (no values printed)
        run: |
          for s in ASC_KEY_ID ASC_ISSUER_ID ASC_KEY_CONTENT CI_KEYCHAIN_PASSWORD; do
            eval "v=\${${s}:-}"
            if [ -n "$v" ]; then echo "$s: SET (${#v} chars)"; else echo "$s: EMPTY"; fi
          done
        env:
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_KEY_CONTENT: ${{ secrets.ASC_KEY_CONTENT }}
          CI_KEYCHAIN_PASSWORD: ${{ secrets.CI_KEYCHAIN_PASSWORD }}

      - name: Write App Store Connect API key
        run: |
          cat > fastlane/apikey.json <<EOF
          {
            "key_id": "${{ secrets.ASC_KEY_ID }}",
            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
            "key": "${{ secrets.ASC_KEY_CONTENT }}",
            "is_key_content_base64": true,
            "duration": 1200,
            "in_house": false
          }
          EOF

      - name: Unlock keychain and run fastlane beta
        run: |
          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-build.keychain-db
          security list-keychains -d user -s ~/Library/Keychains/ci-build.keychain-db ~/Library/Keychains/login.keychain-db
          security find-identity -v -p codesigning
          fastlane beta

      - name: Clean up API key
        if: always()
        run: rm -f fastlane/apikey.json