name: "Apple: iOS Distribution KMS CSR"
run-name: "Apple: iOS Distribution KMS CSR (${{ github.event.inputs.kms_key || 'apple-ios-distribution' }})"

on:
  workflow_dispatch:
    inputs:
      kms_key:
        description: Google KMS key name in the Burrow identity key ring
        required: false
        default: apple-ios-distribution
      kms_version:
        description: Google KMS key version
        required: false
        default: "1"
      common_name:
        description: CSR common name
        required: false
        default: Burrow iOS Distribution
      email_address:
        description: CSR email address
        required: false
        default: release@burrow.net

permissions:
  contents: read

concurrency:
  group: apple-ios-distribution-kms-csr-${{ github.ref }}
  cancel-in-progress: false

env:
  BURROW_GOOGLE_PROJECT_ID: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
  GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_PROJECT_ID || 'project-88c23ce9-918a-470a-b33' }}
  BURROW_GOOGLE_PROJECT_NUMBER: ${{ vars.GOOGLE_PROJECT_NUMBER || '416198671487' }}
  BURROW_GOOGLE_WIF_POOL_ID: ${{ vars.BURROW_GOOGLE_WIF_POOL_ID || 'burrow-authentik' }}
  BURROW_GOOGLE_WIF_PROVIDER_ID: ${{ vars.BURROW_GOOGLE_WIF_PROVIDER_ID || 'forgejo-runners' }}
  BURROW_GOOGLE_WIF_SERVICE_ACCOUNT: ${{ vars.BURROW_GOOGLE_WIF_SERVICE_ACCOUNT || 'burrow-forgejo-runner@project-88c23ce9-918a-470a-b33.iam.gserviceaccount.com' }}
  BURROW_AUTHENTIK_WIF_ISSUER: ${{ vars.BURROW_AUTHENTIK_WIF_ISSUER || 'https://auth.burrow.net/application/o/google-cloud/' }}
  BURROW_AUTHENTIK_WIF_AUDIENCE: ${{ vars.BURROW_AUTHENTIK_WIF_AUDIENCE || 'google-wif.burrow.net' }}
  BURROW_AUTHENTIK_WIF_CLIENT_ID: ${{ vars.BURROW_AUTHENTIK_WIF_CLIENT_ID || 'google-wif.burrow.net' }}
  BURROW_AUTHENTIK_WIF_CLIENT_SECRET: ${{ secrets.BURROW_AUTHENTIK_WIF_CLIENT_SECRET }}
  BURROW_KMS_LOCATION: global
  BURROW_KMS_KEYRING: burrow-identity

jobs:
  csr:
    name: Generate CSR
    runs-on: [self-hosted, linux, x86_64, burrow-forge]
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: https://code.forgejo.org/actions/checkout@v4
        with:
          token: ${{ github.token }}
          fetch-depth: 0

      - name: Ensure Nix
        shell: bash
        run: bash Scripts/ci/ensure-nix.sh

      - name: Authenticate Google WIF
        shell: bash
        run: nix develop .#ci -c Scripts/ci/google-wif-auth.sh

      - name: Generate KMS-backed CSR
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist/apple-ios-distribution
          nix develop .#ci -c Scripts/apple/google-kms-csr.py \
            --kms-key "${{ github.event.inputs.kms_key || 'apple-ios-distribution' }}" \
            --kms-version "${{ github.event.inputs.kms_version || '1' }}" \
            --common-name "${{ github.event.inputs.common_name || 'Burrow iOS Distribution' }}" \
            --email-address "${{ github.event.inputs.email_address || 'release@burrow.net' }}" \
            --output dist/apple-ios-distribution/ios-distribution.certSigningRequest \
            --public-key-output dist/apple-ios-distribution/google-kms-public-key.pem
          if command -v openssl >/dev/null 2>&1; then
            openssl req -in dist/apple-ios-distribution/ios-distribution.certSigningRequest -noout -verify
          fi
          cat > dist/apple-ios-distribution/README.txt <<'EOF'
          This CSR is backed by a non-exportable Google Cloud KMS key in the Burrow
          identity key ring.

          Create an iOS Distribution certificate explicitly through App Store Connect:

          Scripts/apple/create-asc-certificate.mjs \
            --certificate-type IOS_DISTRIBUTION \
            --csr-file ios-distribution.certSigningRequest \
            --out-dir Apple/Certificates

          Keep the returned .cer file with release artifacts. The private key remains in
          Google Cloud KMS and is never exported as a p12.
          EOF

      - name: Upload CSR Artifact
        uses: https://code.forgejo.org/actions/upload-artifact@v3
        with:
          name: burrow-ios-distribution-kms-csr
          path: dist/apple-ios-distribution