#!/bin/zsh
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
cd "$ROOT"
APP_NAME=OrionToolbar
PROJECT="$ROOT/OrionToolbar.xcodeproj"
DERIVED="$ROOT/.build"
WORK="$ROOT/.build/release"
DIST="$ROOT/dist"
SIGNING_IDENTITY="${SIGNING_IDENTITY:-B99D353C88996866C49E4389B375645F76870A3F}"
TEAM_ID="${TEAM_ID:-39R6U3437D}"
NOTARY_PROFILE="${NOTARY_PROFILE:-orion-notary}"
mkdir -p "$ROOT/build-logs" "$DIST"
LOG="$ROOT/build-logs/release-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee "$LOG") 2>&1
command -v xcodebuild >/dev/null
command -v hdiutil >/dev/null
security find-identity -v -p codesigning | grep -q "$SIGNING_IDENTITY" || { echo 'Developer ID identity missing' >&2; exit 1; }
xcrun notarytool history --keychain-profile "$NOTARY_PROFILE" >/dev/null
rm -rf "$WORK"
mkdir -p "$WORK/export" "$WORK/dmg"
cat > "$WORK/ExportOptions.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>method</key><string>developer-id</string>
<key>signingStyle</key><string>automatic</string>
<key>teamID</key><string>$TEAM_ID</string>
</dict></plist>
PLIST
xcodebuild -project "$PROJECT" -scheme "$APP_NAME" -configuration Release -destination 'generic/platform=macOS' -archivePath "$WORK/$APP_NAME.xcarchive" archive
xcodebuild -exportArchive -archivePath "$WORK/$APP_NAME.xcarchive" -exportPath "$WORK/export" -exportOptionsPlist "$WORK/ExportOptions.plist"
APP="$WORK/export/$APP_NAME.app"
[[ -d "$APP" ]] || { echo 'Exported app missing' >&2; exit 1; }
codesign --verify --deep --strict --verbose=2 "$APP"
ACTUAL_TEAM=$(codesign -dv --verbose=4 "$APP" 2>&1 | sed -n 's/^TeamIdentifier=//p')
[[ "$ACTUAL_TEAM" == "$TEAM_ID" ]] || { echo "Unexpected team: $ACTUAL_TEAM" >&2; exit 1; }
VERSION=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$APP/Contents/Info.plist")
[[ -n "$VERSION" ]] || { echo 'Missing marketing version' >&2; exit 1; }
DMG="$DIST/$APP_NAME-$VERSION.dmg"
ZIP="$WORK/$APP_NAME.zip"
ditto -c -k --keepParent "$APP" "$ZIP"
notarize() {
  local file="$1" result status
  result=$(xcrun notarytool submit "$file" --keychain-profile "$NOTARY_PROFILE" --wait --output-format json)
  echo "$result"
  status=$(printf '%s' "$result" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("status", ""))')
  [[ "$status" == Accepted ]] || { echo "Notarization not accepted for $file: $status" >&2; exit 1; }
}
notarize "$ZIP"
xcrun stapler staple "$APP"
xcrun stapler validate "$APP"
spctl --assess --type execute --verbose=4 "$APP"
ditto "$APP" "$WORK/dmg/$APP_NAME.app"
ln -s /Applications "$WORK/dmg/Applications"
rm -f "$DMG"
hdiutil create -volname "$APP_NAME" -srcfolder "$WORK/dmg" -ov -format UDZO "$DMG"
codesign --force --timestamp --sign "$SIGNING_IDENTITY" "$DMG"
codesign --verify --verbose=2 "$DMG"
notarize "$DMG"
xcrun stapler staple "$DMG"
xcrun stapler validate "$DMG"
spctl --assess --type open --context context:primary-signature --verbose=4 "$DMG"
shasum -a 256 "$DMG" | tee "$DMG.sha256"
echo "Release complete: $DMG"
echo "Checksum: $DMG.sha256"
echo "Log: $LOG"