name: "Apple: Distribute TestFlight"
run-name: "Apple: Distribute TestFlight (Build ${{ inputs.build_number }})"

on:
  workflow_dispatch:
    inputs:
      build_number:
        description: Already-uploaded App Store Connect build number
        required: true
      testflight_distribute_external:
        description: Distribute to external TestFlight groups
        required: false
        default: "false"
      testflight_groups:
        description: Optional comma-separated TestFlight groups
        required: false
        default: ""
      ios_uses_non_exempt_encryption:
        description: Set true only when the iOS build uses non-exempt encryption
        required: false
        default: "false"

permissions:
  contents: read

concurrency:
  group: burrow-distribute-testflight-${{ inputs.build_number }}
  cancel-in-progress: true

env:
  BURROW_NIX_CACHE_URL: ${{ vars.BURROW_NIX_CACHE_URL || 'https://nix.burrow.net/burrow' }}
  BURROW_NIX_CACHE_PUBLIC_KEY: ${{ vars.BURROW_NIX_CACHE_PUBLIC_KEY }}
  BURROW_APPLE_BUNDLE_ID: ${{ vars.BURROW_APPLE_BUNDLE_ID || 'net.burrow.app' }}
  TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS: ${{ vars.TESTFLIGHT_WAIT_PROCESSING_TIMEOUT_SECONDS || '7200' }}

jobs:
  distribute-ios-testflight:
    name: Distribute (TestFlight iOS Testers)
    runs-on: namespace-profile-linux-medium
    steps:
      - name: Checkout
        uses: https://code.forgejo.org/actions/checkout@v4
        with:
          token: ${{ github.token }}
          fetch-depth: 0

      - name: Ensure Nix
        shell: bash
        run: bash Scripts/ci/ensure-nix.sh

      - name: Configure Age
        shell: bash
        env:
          AGE_FORGE_SSH_KEY: ${{ secrets.AGE_FORGE_SSH_KEY }}
        run: Scripts/resolve-age-identity.sh >> "$GITHUB_ENV"

      - name: Decrypt Release Secrets
        uses: ./.forgejo/actions/decrypt-release-secrets

      - name: Validate App Store Credentials
        shell: bash
        run: Scripts/ci/check-release-config.sh app-store

      - name: Distribute iOS Build To TestFlight
        shell: bash
        env:
          BUILD_NUMBER: ${{ inputs.build_number }}
          TESTFLIGHT_DISTRIBUTE_EXTERNAL: ${{ inputs.testflight_distribute_external || 'false' }}
          TESTFLIGHT_GROUPS: ${{ inputs.testflight_groups || '' }}
          TESTFLIGHT_INTERNAL_GROUP: Internal
          IOS_USES_NON_EXEMPT_ENCRYPTION: ${{ inputs.ios_uses_non_exempt_encryption || 'false' }}
        run: Scripts/ci/distribute-testflight.sh