name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version (e.g., 2.0.0b6)"
        required: true
      variant:
        description: "Build variant"
        required: false
        default: external
        type: choice
        options: [external, pyinstaller]
      cpython_url:
        description: "Standalone CPython URL (python-build-standalone)"
        required: false
        default: ""
      r2_path:
        description: "R2 path prefix (default: releases/<version>/)"
        required: false
        default: ""

jobs:
  build-sign-notarize:
    runs-on: macos-14
    env:
      VERSION: ${{ inputs.version }}
      SIGN_ID: ${{ secrets.CSC_NAME }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve CPython (external variant)
        if: ${{ inputs.variant == 'external' }}
        run: |
          if [[ -z "${{ inputs.cpython_url }}" ]]; then
            if [[ ! -x python/bin/python3 && ! -x python/bin/python3.10 && ! -x python/bin/python3.12 ]]; then
              echo "No embedded python present; provide cpython_url input or commit ./python/bin/python3" >&2
              exit 1
            fi
          fi

      - name: Import Developer ID certificate (if provided)
        if: env.SIGN_ID != '' && secrets.MACOS_CERT_P12 != ''
        env:
          MACOS_CERT_P12: ${{ secrets.MACOS_CERT_P12 }}
          MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
        run: |
          KEYCHAIN=build.keychain
          security create-keychain -p "" "$KEYCHAIN"
          security set-keychain-settings -lut 21600 "$KEYCHAIN"
          security unlock-keychain -p "" "$KEYCHAIN"
          echo "$MACOS_CERT_P12" | base64 --decode > cert.p12
          security import cert.p12 -k "$KEYCHAIN" -P "$MACOS_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
          security list-keychain -d user -s "$KEYCHAIN" login.keychain-db
          rm -f cert.p12

      - name: Release build (external)
        if: ${{ inputs.variant == 'external' }}
        run: |
          chmod +x scripts/*.sh || true
          if [[ -n "${{ inputs.cpython_url }}" ]]; then
            CPYTHON_URL="${{ inputs.cpython_url }}" scripts/release.sh --variant external --disable-libval
          else
            scripts/release.sh --variant external --embedded-python "$PWD/python/bin/python3" --disable-libval
          fi

      - name: Release build (pyinstaller)
        if: ${{ inputs.variant == 'pyinstaller' }}
        run: |
          chmod +x scripts/*.sh || true
          scripts/release.sh --variant pyinstaller --disable-libval

      - name: Upload artifacts (tgz only)
        uses: actions/upload-artifact@v4
        with:
          name: release-artifacts-${{ inputs.version }}
          path: |
            artifacts/*.tgz

      - name: Upload to R2 (tgz)
        if: ${{ secrets.R2_ACCESS_KEY_ID != '' }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          R2_PATH_INPUT: ${{ inputs.r2_path }}
        run: |
          TGZ=$(ls -1 artifacts/*.tgz | tail -n1)
          if [[ -z "$TGZ" ]]; then echo "No tgz found" >&2; exit 1; fi
          pipx install awscli || python3 -m pip install --user awscli
          DEST_PATH="${R2_PATH_INPUT:-releases/${{ inputs.version }}/}"
          aws s3 cp "$TGZ" "s3://$R2_BUCKET/${DEST_PATH}" --endpoint-url "$R2_ENDPOINT"