name: Build Native macOS App

on:
  push:
    branches: [ main ]
    paths:
      - 'ios/**'
      - '!ios/**/*.md'
      - '.github/workflows/build-apps.yml'
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - 'ios/**'
      - '!ios/**/*.md'
  workflow_dispatch:

concurrency:
  group: build-apps-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: macos-latest
    if: false
    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # Nothing here pushes back to the repo — the release step uses the
          # GITHUB_TOKEN via the API, not the persisted git credential.
          persist-credentials: false

      - name: Install xcodegen
        run: brew install xcodegen

      - name: Generate Xcode project
        working-directory: ios
        run: xcodegen generate

      - name: Cache Swift Package Manager checkouts
        uses: actions/cache@v4
        with:
          path: ios/build/SourcePackages
          key: spm-${{ runner.os }}-${{ hashFiles('ios/project.yml') }}
          restore-keys: |
            spm-${{ runner.os }}-

      - name: Build macOS (native)
        working-directory: ios
        run: |
          xcodebuild -project LChat.xcodeproj -scheme LChatMac \
            -destination 'generic/platform=macOS' \
            -derivedDataPath build \
            CODE_SIGN_STYLE=Automatic \
            CODE_SIGN_IDENTITY='-' \
            build

      - name: Package app
        run: |
          cd ios/build/Build/Products/Debug
          ditto -c -k --sequesterRsrc --keepParent Eleven.app Eleven.app.zip
          ls -lh Eleven.app.zip

      - name: Create release
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        # Third-party action, so pinned by commit (a mutable tag could be
        # repointed at hostile code that sees this job's contents: write).
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        with:
          files: ios/build/Build/Products/Debug/Eleven.app.zip
          tag_name: app-build-${{ github.run_number }}
          name: App Build ${{ github.run_number }}
          body: |
            Built from commit ${{ github.sha }}

            ## Download & Run

            1. Download `Eleven.app.zip`
            2. Unzip it
            3. Open Terminal and run:
               ```bash
               xattr -d com.apple.quarantine ~/Downloads/Eleven.app
               ```
            4. Double-click `Eleven.app` to launch

            (The `xattr` command removes macOS's quarantine flag so the app can run without security warnings.)

      - name: Upload artifacts for PR
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: Eleven.app
          path: ios/build/Build/Products/Debug/Eleven.app.zip
          retention-days: 7