name: Publish macOS Packages

on:
  workflow_dispatch:

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: macos-15-intel
          - arch: arm64
            runner: macos-15

    runs-on: ${{ matrix.runner }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install Wails CLI
        run: go install github.com/wailsapp/wails/v2/cmd/wails@v2.11.0

      - name: Add Go bin to PATH
        run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      - name: Build unsigned macOS package
        run: bash publish/mac/publish-mac.sh --arch ${{ matrix.arch }}

      - name: Validate app bundle
        run: |
          set -euo pipefail
          app_path="$(ls -1d publish/output/AntBrowser-*-macos-${{ matrix.arch }}.app | head -n 1)"
          zip_path="$(ls -1 publish/output/AntBrowser-*-macos-${{ matrix.arch }}.zip | head -n 1)"
          echo "Validating: $app_path"
          test -x "$app_path/Contents/MacOS/ant-chrome"
          test -x "$app_path/Contents/MacOS/bin/xray"
          test -x "$app_path/Contents/MacOS/bin/sing-box"
          plutil -lint "$app_path/Contents/Info.plist"
          ditto -x -k "$zip_path" /tmp/ant-browser-macos-validate
          test -x "/tmp/ant-browser-macos-validate/$(basename "$app_path")/Contents/MacOS/ant-chrome"

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ant-browser-macos-${{ matrix.arch }}
          path: |
            publish/output/AntBrowser-*-macos-${{ matrix.arch }}.app
            publish/output/AntBrowser-*-macos-${{ matrix.arch }}.zip