ci.yml

name: CI

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v5

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore --configuration Release

      - name: Test
        run: dotnet test --no-build --configuration Release --logger trx --results-directory TestResults

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: TestResults/*.trx

      - name: Pack NuGet packages
        run: |
          dotnet pack src/EncDotNet.Iso8211/EncDotNet.Iso8211.csproj --no-build --configuration Release --output nupkgs
          dotnet pack src/EncDotNet.S57/EncDotNet.S57.csproj --no-build --configuration Release --output nupkgs
          dotnet pack src/EncDotNet.Noaa/EncDotNet.Noaa.csproj --no-build --configuration Release --output nupkgs

      - name: Upload NuGet packages
        uses: actions/upload-artifact@v4
        with:
          name: nupkgs
          path: nupkgs/*.nupkg

  format:
    name: Format check
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v5

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore

      - name: Verify formatting (whitespace)
        # Fix locally with: dotnet format whitespace EncDotNet.slnx
        run: dotnet format whitespace EncDotNet.slnx --no-restore --verify-no-changes

      - name: Verify usings (ordering + unused)
        # Fix locally with:
        #   dotnet format style EncDotNet.slnx --diagnostics IDE0005
        run: dotnet format style EncDotNet.slnx --diagnostics IDE0005 --severity warn --no-restore --verify-no-changes

  publish:
    needs: build
    strategy:
      matrix:
        include:
          - os: macos-latest
            rid: osx-arm64
            artifact: ChartViewer-osx-arm64
          - os: windows-latest
            rid: win-x64
            artifact: ChartViewer-win-x64
          - os: ubuntu-latest
            rid: linux-x64
            artifact: ChartViewer-linux-x64
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    env:
      # macOS signing/notarization is expensive (notary upload + polling) and is
      # not needed for PR validation — developers can clear the quarantine
      # attribute on unsigned PR artifacts if they need to run them. Gate it to
      # main CI runs (pushes to main and v* tags), i.e. skip on pull_request.
      MACOS_SIGNING_ENABLED: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12 != '' && github.event_name != 'pull_request' }}

    steps:
      - uses: actions/checkout@v5

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Publish ChartViewer
        run: >
          dotnet publish src/EncDotNet.ChartViewer/EncDotNet.ChartViewer.csproj
          --configuration Release
          --runtime ${{ matrix.rid }}
          ${{ matrix.rid == 'osx-arm64' && '-p:PublishSingleFile=false' || '' }}

      - name: Create macOS .app bundle
        if: matrix.rid == 'osx-arm64'
        run: |
          PUBLISH_DIR="src/EncDotNet.ChartViewer/bin/Release/net10.0/osx-arm64/publish"
          APP="EncDotNet.ChartViewer.app"
          mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
          cp src/EncDotNet.ChartViewer/Info.plist "$APP/Contents/"
          cp -a "$PUBLISH_DIR"/. "$APP/Contents/MacOS/"
          # Remove debug symbols; they are not needed in the release bundle
          # and codesign treats them as unsigned code objects.
          find "$APP" -name '*.pdb' -delete

      - name: Import signing certificate
        if: matrix.rid == 'osx-arm64' && env.MACOS_SIGNING_ENABLED == 'true'
        env:
          P12_BASE64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12 }}
          P12_PASSWORD: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
        run: |
          echo "$P12_BASE64" | base64 --decode > cert.p12
          security create-keychain -p "" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "" build.keychain
          security import cert.p12 -k build.keychain -P "$P12_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain

      - name: Sign macOS .app bundle
        if: matrix.rid == 'osx-arm64' && env.MACOS_SIGNING_ENABLED == 'true'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          APP="EncDotNet.ChartViewer.app"
          ENTITLEMENTS="src/EncDotNet.ChartViewer/entitlements.plist"
          MAIN_EXE="EncDotNet.ChartViewer"
          # Sign all subcomponents individually before sealing the bundle.
          # Exclude the main executable — it will be signed when we sign
          # the bundle itself, which also validates all subcomponents.
          find "$APP/Contents/MacOS" -type f ! -name "$MAIN_EXE" | while read -r f; do
            if file "$f" | grep -q "Mach-O"; then
              codesign --force --options runtime --timestamp \
                --entitlements "$ENTITLEMENTS" \
                --sign "$APPLE_SIGNING_IDENTITY" "$f"
            else
              codesign --force --timestamp \
                --sign "$APPLE_SIGNING_IDENTITY" "$f"
            fi
          done
          # Sign the bundle (signs main executable and seals everything)
          codesign --force --options runtime --timestamp \
            --entitlements "$ENTITLEMENTS" \
            --sign "$APPLE_SIGNING_IDENTITY" \
            "$APP"

      - name: Notarize macOS .app bundle
        if: matrix.rid == 'osx-arm64' && env.MACOS_SIGNING_ENABLED == 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
        run: |
          ditto -c -k --keepParent \
            EncDotNet.ChartViewer.app \
            ChartViewer.zip
          xcrun notarytool submit ChartViewer.zip \
            --apple-id "$APPLE_ID" \
            --team-id "$APPLE_TEAM_ID" \
            --password "$APPLE_APP_PASSWORD" \
            --wait \
            --output-format json | tee notarization-result.json
          STATUS=$(python3 -c "import json,sys; print(json.load(sys.stdin)['status'])" < notarization-result.json)
          if [ "$STATUS" != "Accepted" ]; then
            ID=$(python3 -c "import json,sys; print(json.load(sys.stdin)['id'])" < notarization-result.json)
            echo "::error::Notarization failed with status: $STATUS"
            xcrun notarytool log "$ID" \
              --apple-id "$APPLE_ID" \
              --team-id "$APPLE_TEAM_ID" \
              --password "$APPLE_APP_PASSWORD"
            exit 1
          fi

      - name: Staple notarization ticket
        if: matrix.rid == 'osx-arm64' && env.MACOS_SIGNING_ENABLED == 'true'
        continue-on-error: true
        run: |
          # The notarization ticket may not be immediately available in
          # CloudKit. Stapling is optional — Gatekeeper will verify the
          # notarization online on first launch if the ticket is absent.
          for i in 1 2 3 4 5; do
            if xcrun stapler staple EncDotNet.ChartViewer.app; then
              exit 0
            fi
            echo "Staple attempt $i failed, waiting 30s..."
            sleep 30
          done
          echo "::warning::Stapling failed after 5 attempts. The app is still notarized; Gatekeeper will verify online."

      - name: Archive macOS .app bundle
        if: matrix.rid == 'osx-arm64'
        run: tar -czf "${{ matrix.artifact }}.tar.gz" EncDotNet.ChartViewer.app

      - name: Archive published app
        if: matrix.rid != 'osx-arm64'
        shell: bash
        run: tar -czf "${{ matrix.artifact }}.tar.gz" -C "src/EncDotNet.ChartViewer/bin/Release/net10.0/${{ matrix.rid }}/publish" .

      - name: Upload published app
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: ${{ matrix.artifact }}.tar.gz

  publish-nuget:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write

    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Download NuGet packages
        uses: actions/download-artifact@v4
        with:
          name: nupkgs
          path: nupkgs

      - name: NuGet login
        uses: NuGet/login@v1
        id: login
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push to NuGet.org
        run: dotnet nuget push "nupkgs/*.nupkg" --api-key ${{steps.login.outputs.NUGET_API_KEY}} --source https://api.nuget.org/v3/index.json

  create-release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [build, publish]
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            artifacts/nupkgs/*.nupkg
            artifacts/ChartViewer-*/*.tar.gz