name: Beta (TestFlight, on PR to develop)

on:
  pull_request:
    branches:
      - develop

jobs:
  build-and-upload:
    runs-on: macos-build

    steps:
      - name: Checkout repository (workaround - Gitea git-upload-pack bug, see go-gitea/gitea#21819)
        run: |
          curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            -o /tmp/repo.tar.gz \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
          tar -xzf /tmp/repo.tar.gz --strip-components=1 -C "$GITHUB_WORKSPACE"

      - name: Check ASC secrets are present (no values printed)
        run: |
          for s in ASC_KEY_ID ASC_ISSUER_ID ASC_KEY_CONTENT CI_KEYCHAIN_PASSWORD; do
            eval "v=\${${s}:-}"
            if [ -n "$v" ]; then echo "$s: SET (${#v} chars)"; else echo "$s: EMPTY"; fi
          done
        env:
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_KEY_CONTENT: ${{ secrets.ASC_KEY_CONTENT }}
          CI_KEYCHAIN_PASSWORD: ${{ secrets.CI_KEYCHAIN_PASSWORD }}

      - name: Write App Store Connect API key
        run: |
          cat > fastlane/apikey.json <<EOF
          {
            "key_id": "${{ secrets.ASC_KEY_ID }}",
            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
            "key": "${{ secrets.ASC_KEY_CONTENT }}",
            "is_key_content_base64": true,
            "duration": 1200,
            "in_house": false
          }
          EOF

      - name: Unlock keychain and run fastlane beta
        run: |
          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-build.keychain-db
          security list-keychains -d user -s ~/Library/Keychains/ci-build.keychain-db ~/Library/Keychains/login.keychain-db
          security find-identity -v -p codesigning
          fastlane beta

      - name: Clean up API key
        if: always()
        run: rm -f fastlane/apikey.json

      - name: Email notification
        if: always()
        env:
          SMTP_USER: ${{ secrets.SMTP_USER }}
          SMTP_PASS: ${{ secrets.SMTP_PASS }}
          NOTIFY_EMAIL_TO: ${{ secrets.NOTIFY_EMAIL_TO }}
        run: |
          STATUS="${{ job.status }}"
          SUBJECT="[PediFoods CI] ${STATUS} - ${{ github.workflow }}"
          BODY="Job: ${{ github.workflow }} / ${{ github.job }}
          Status: ${STATUS}
          Branch: ${{ github.ref_name }}
          Commit: ${{ github.sha }}
          Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

          printf 'From: PediFoods CI <%s>\r\nTo: %s\r\nSubject: %s\r\n\r\n%s\r\n' \
            "$SMTP_USER" "$NOTIFY_EMAIL_TO" "$SUBJECT" "$BODY" | \
          curl --silent --show-error \
            --url "smtp://mail.loverde.com.br:587" \
            --ssl-reqd \
            --mail-from "$SMTP_USER" \
            --mail-rcpt "$NOTIFY_EMAIL_TO" \
            --user "$SMTP_USER:$SMTP_PASS" \
            --upload-file - || true