release.yml

# Multi-Platform Release Workflow
#
# Triggers on version tag push (v*). Builds all 5 platforms in parallel,
# then creates a GitHub Release with all artifacts attached.
# App Store and Google Play uploads run independently from the GitHub Release
# so that store-side issues (e.g. version in review) never block the release.
#
# Beta tags (v1.0.0-beta.1) create pre-releases.
# Clean tags (v1.0.0) create full releases.
#
# Required Secrets - see docs/plans/2026-02-12-github-releases-design.md

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: true

env:
  FLUTTER_VERSION_FILE: '.github/flutter-version.txt'

jobs:
  # ============================================================================
  # macOS Build (signed DMG + Mac App Store)
  # ============================================================================
  build-macos:
    name: Build macOS
    runs-on: macos-15
    timeout-minutes: 45
    outputs:
      eddsa-signature: ${{ steps.sparkle-sign.outputs.eddsa-signature }}
      dmg-length: ${{ steps.sparkle-sign.outputs.dmg-length }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        id: setup-xcode-macos
        with:
          xcode-version: '26'

      - name: Verify selected Xcode (macOS build)
        run: |
          echo "setup-xcode selected: ${{ steps.setup-xcode-macos.outputs.version }}"
          echo "Xcode path: ${{ steps.setup-xcode-macos.outputs.path }}"
          xcodebuild -version

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: stable

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: |
          flutter pub get
          dart run build_runner build --delete-conflicting-outputs

      - name: Disable automatic signing for CI build
        run: |
          echo 'CODE_SIGNING_ALLOWED = NO' >> macos/Runner/Configs/Release.xcconfig
          echo 'CODE_SIGNING_REQUIRED = NO' >> macos/Runner/Configs/Release.xcconfig
          echo 'CODE_SIGN_IDENTITY = ' >> macos/Runner/Configs/Release.xcconfig

      - name: Build macOS release
        run: flutter build macos --release --dart-define=UPDATE_CHANNEL=github

      # -- Developer ID DMG (for GitHub Release) --

      - name: Import Developer ID certificate
        env:
          MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          MACOS_KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
        run: |
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          echo -n "$MACOS_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          echo "Certificate .p12 size: $(wc -c < $CERTIFICATE_PATH) bytes"
          security create-keychain -p "$MACOS_KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$MACOS_KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security import $CERTIFICATE_PATH -P "$MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple:,codesign: -k "$MACOS_KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH
          echo "Available signing identities:"
          security find-identity -v -p codesigning $KEYCHAIN_PATH

      - name: Codesign the app
        run: |
          APP_PATH="build/macos/Build/Products/Release/Submersion.app"
          IDENTITY=$(security find-identity -v -p codesigning $RUNNER_TEMP/app-signing.keychain-db | grep "Developer ID Application" | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ -z "$IDENTITY" ]; then
            echo "Error: No 'Developer ID Application' identity found in keychain."
            echo "Available identities:"
            security find-identity -v -p codesigning $RUNNER_TEMP/app-signing.keychain-db
            exit 1
          fi
          echo "Signing with: $IDENTITY"
          # Pass 1: Sign all nested frameworks/dylibs (no entitlements)
          codesign --deep --force --options runtime \
            --sign "$IDENTITY" \
            "$APP_PATH"
          # Pass 2: Re-sign only the top-level app with entitlements
          codesign --force --options runtime \
            --entitlements "macos/Runner/ReleaseNoSandbox.entitlements" \
            --sign "$IDENTITY" \
            "$APP_PATH"

      - name: Install create-dmg
        run: brew install create-dmg

      - name: Create DMG
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          create-dmg \
            --volname "Submersion" \
            --volicon "macos/Runner/Assets.xcassets/AppIcon.appiconset/app_icon_512.png" \
            --window-pos 200 120 \
            --window-size 600 400 \
            --icon-size 100 \
            --icon "Submersion.app" 150 200 \
            --app-drop-link 450 200 \
            "Submersion-${TAG_NAME}-macOS.dmg" \
            "build/macos/Build/Products/Release/Submersion.app" || {
              if [ -f "Submersion-${TAG_NAME}-macOS.dmg" ]; then
                echo "Warning: create-dmg returned non-zero but DMG exists (likely missing background image)"
              else
                echo "Error: create-dmg failed and DMG was not created"
                exit 1
              fi
            }

      - name: Notarize DMG
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          DMG="Submersion-${TAG_NAME}-macOS.dmg"
          for attempt in 1 2 3; do
            if xcrun notarytool submit "$DMG" \
                --apple-id "$APPLE_ID" \
                --password "$APPLE_APP_PASSWORD" \
                --team-id "$APPLE_TEAM_ID" \
                --wait; then
              break
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "Notarization failed after 3 attempts"
              exit 1
            fi
            echo "Notarization attempt $attempt failed, retrying in 30s..."
            sleep 30
          done
          xcrun stapler staple "$DMG"

      - name: Sign DMG with Sparkle EdDSA
        id: sparkle-sign
        env:
          SPARKLE_EDDSA_PRIVATE_KEY: ${{ secrets.SPARKLE_EDDSA_PRIVATE_KEY }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          DMG="Submersion-${TAG_NAME}-macOS.dmg"

          if [ -z "$SPARKLE_EDDSA_PRIVATE_KEY" ]; then
            echo "Error: SPARKLE_EDDSA_PRIVATE_KEY secret is not configured"
            exit 1
          fi

          # sign_update is installed by CocoaPods as part of the Sparkle framework
          # (pulled in by the auto_updater Flutter package during flutter build macos).
          # Output format: sparkle:edSignature="<sig>" length="<len>"
          SIGN_OUTPUT=$(echo "$SPARKLE_EDDSA_PRIVATE_KEY" | ./macos/Pods/Sparkle/bin/sign_update --ed-key-file - "$DMG")

          # Parse signature and length from output
          EDDSA_SIG=$(echo "$SIGN_OUTPUT" | sed -n 's/.*edSignature="\([^"]*\)".*/\1/p')

          if [ -z "$EDDSA_SIG" ]; then
            echo "Error: Failed to extract EdDSA signature from sign_update output"
            exit 1
          fi

          DMG_LENGTH=$(echo "$SIGN_OUTPUT" | sed -n 's/.*length="\([^"]*\)".*/\1/p')

          if [ -z "$DMG_LENGTH" ]; then
            echo "Error: Failed to extract length from sign_update output"
            exit 1
          fi

          echo "DMG length: ${DMG_LENGTH} bytes"

          echo "eddsa-signature=${EDDSA_SIG}" >> "$GITHUB_OUTPUT"
          echo "dmg-length=${DMG_LENGTH}" >> "$GITHUB_OUTPUT"

      - name: Upload DMG artifact
        uses: actions/upload-artifact@v7
        with:
          name: macos-dmg
          path: Submersion-*.dmg
          retention-days: 5

      # -- Mac App Store (via Fastlane) --

      - name: Restore Release.xcconfig for App Store build
        run: git checkout macos/Runner/Configs/Release.xcconfig

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
          bundler-cache: true
          working-directory: macos

      - name: Import App Store certificates
        env:
          APPLE_DEVELOPMENT_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATE_BASE64 }}
          APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD }}
          APPLE_DISTRIBUTION_CERTIFICATE_BASE64: ${{ secrets.APPLE_DISTRIBUTION_CERTIFICATE_BASE64 }}
          APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          # Reuse the keychain from the DMG step if it exists, otherwise create it
          if ! security show-keychain-info "$KEYCHAIN_PATH" 2>/dev/null; then
            security create-keychain -p "ci-build" "$KEYCHAIN_PATH"
            security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          fi
          security unlock-keychain -p "ci-build" "$KEYCHAIN_PATH"
          # Import Apple Development certificate (for archive signing)
          DEV_CERT=$RUNNER_TEMP/apple_development.p12
          echo -n "$APPLE_DEVELOPMENT_CERTIFICATE_BASE64" | base64 --decode -o "$DEV_CERT"
          security import "$DEV_CERT" -P "$APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          rm -f "$DEV_CERT"
          # Import Apple Distribution certificate (for export signing)
          DIST_CERT=$RUNNER_TEMP/apple_distribution.p12
          echo -n "$APPLE_DISTRIBUTION_CERTIFICATE_BASE64" | base64 --decode -o "$DIST_CERT"
          security import "$DIST_CERT" -P "$APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          rm -f "$DIST_CERT"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -k "ci-build" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          echo "Available signing identities:"
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: Setup App Store Connect API Key
        env:
          APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY }}
        run: |
          mkdir -p macos/fastlane
          echo "$APP_STORE_CONNECT_API_KEY_KEY" | base64 --decode > macos/fastlane/AuthKey.p8

      - name: Build Mac App Store package
        working-directory: macos
        env:
          APP_STORE_CONNECT_API_KEY_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY_ID }}
          APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          APP_STORE_CONNECT_API_KEY_KEY_FILEPATH: fastlane/AuthKey.p8
        run: bundle exec fastlane build

      - name: Upload Mac App Store pkg artifact
        uses: actions/upload-artifact@v7
        with:
          name: macos-pkg
          path: macos/build/Submersion.pkg
          retention-days: 5
          if-no-files-found: error

      - name: Cleanup sensitive files
        if: always()
        run: rm -f macos/fastlane/AuthKey.p8

  # ============================================================================
  # Windows Build
  # ============================================================================
  build-windows:
    name: Build Windows
    runs-on: windows-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Read Flutter version
        id: flutter-ver
        # Windows runners default to PowerShell, where the bash-style
        # $(...) command substitution and $GITHUB_OUTPUT do not work. Without
        # this the version output is empty and subosito installs the latest
        # stable Flutter instead of the pinned version. See flutter-version.txt.
        shell: bash
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: stable

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~\.pub-cache
            ${{ github.workspace }}\.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: |
          flutter pub get
          dart run build_runner build --delete-conflicting-outputs

      - name: Build Windows release
        run: flutter build windows --release --dart-define=UPDATE_CHANNEL=github

      - name: Build Windows installer
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          $version = "$env:TAG_NAME" -replace '^v', ''
          $buildNumber = (Select-String -Path pubspec.yaml -Pattern '^\s*version:.*\+(\d+)' | ForEach-Object { $_.Matches.Groups[1].Value })
          iscc /DAPP_VERSION="$version" /DAPP_VERSION_CODE="$buildNumber" windows\installer\submersion.iss
          Move-Item "build\windows\installer\Submersion-*-Windows-Setup.exe" .

      - name: Upload Windows artifact
        uses: actions/upload-artifact@v7
        with:
          name: windows-setup
          path: Submersion-*-Setup.exe
          retention-days: 5

  # ============================================================================
  # Linux Build
  # ============================================================================
  build-linux:
    name: Build Linux
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Install Linux dependencies
        run: |
          sudo apt-get update -y
          sudo apt-get install -y \
            clang cmake ninja-build pkg-config \
            libgtk-3-dev liblzma-dev libstdc++-12-dev \
            libsqlite3-dev libsecret-1-dev

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: stable

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: |
          flutter pub get
          dart run build_runner build --delete-conflicting-outputs

      - name: Build Linux release
        run: flutter build linux --release --dart-define=UPDATE_CHANNEL=github

      - name: Create tarball
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          cd build/linux/x64/release/bundle
          tar czf "$GITHUB_WORKSPACE/Submersion-${TAG_NAME}-Linux.tar.gz" .

      - name: Upload Linux artifact
        uses: actions/upload-artifact@v7
        with:
          name: linux-tar
          path: Submersion-*.tar.gz
          retention-days: 5

  # ============================================================================
  # Android Build
  # ============================================================================
  build-android:
    name: Build Android
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: stable

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: |
          flutter pub get
          dart run build_runner build --delete-conflicting-outputs

      - name: Setup Android signing
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > android/app/release.keystore
          cat > android/key.properties <<EOL
          storePassword=$ANDROID_KEYSTORE_PASSWORD
          keyPassword=$ANDROID_KEY_PASSWORD
          keyAlias=$ANDROID_KEY_ALIAS
          storeFile=release.keystore
          EOL
          chmod 600 android/key.properties android/app/release.keystore

      - name: Build Android APK
        run: flutter build apk --release --dart-define=UPDATE_CHANNEL=github

      - name: Build Android App Bundle
        run: flutter build appbundle --release --dart-define=HEALTH_CONNECT_ENABLED=false

      # Guards against issue #318: a 4 KB-aligned native lib (liblibdc_jni.so)
      # silently shipped in v1.5.5.107 and crashed the app on Android 15+
      # 16 KB-page devices. Fail the release before publishing if any 64-bit
      # native library is not 16 KB-aligned, in either the APK or the AAB.
      - name: Verify 16 KB native library alignment
        run: |
          python3 scripts/check_16kb_alignment.py \
            build/app/outputs/flutter-apk/app-release.apk \
            build/app/outputs/bundle/release/app-release.aab

      - name: Rename artifacts
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          mv build/app/outputs/flutter-apk/app-release.apk \
            "Submersion-${TAG_NAME}-Android.apk"
          mv build/app/outputs/bundle/release/app-release.aab \
            "Submersion-${TAG_NAME}-Android.aab"

      - name: Upload Android APK artifact
        uses: actions/upload-artifact@v7
        with:
          name: android-apk
          path: Submersion-*.apk
          retention-days: 5

      - name: Upload Android AAB artifact
        uses: actions/upload-artifact@v7
        with:
          name: android-aab
          path: Submersion-*.aab
          retention-days: 5

      - name: Cleanup sensitive files
        if: always()
        run: |
          rm -f android/app/release.keystore
          rm -f android/key.properties

  # ============================================================================
  # iOS Build
  # ============================================================================
  build-ios:
    name: Build iOS
    runs-on: macos-15
    timeout-minutes: 60

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        id: setup-xcode-ios
        with:
          xcode-version: '26'

      - name: Verify Xcode and iOS SDK
        run: |
          echo "setup-xcode selected: ${{ steps.setup-xcode-ios.outputs.version }}"
          echo "Xcode path: ${{ steps.setup-xcode-ios.outputs.path }}"
          echo "DEVELOPER_DIR: ${DEVELOPER_DIR:-<not set>}"
          xcode-select -p
          xcodebuild -version
          XCODE_VERSION=$(xcodebuild -version | awk '/Xcode/ { print $2 }')
          XCODE_MAJOR=${XCODE_VERSION%%.*}
          IOS_SDK=$(xcrun --sdk iphoneos --show-sdk-version)
          IOS_SDK_MAJOR=${IOS_SDK%%.*}
          echo "Detected iOS SDK: ${IOS_SDK}"

          if [ -z "$XCODE_MAJOR" ] || [ "$XCODE_MAJOR" -lt 26 ]; then
            echo "Error: Xcode 26 or later is required for App Store uploads."
            exit 1
          fi

          if [ -z "$IOS_SDK_MAJOR" ] || [ "$IOS_SDK_MAJOR" -lt 26 ]; then
            echo "Error: iOS SDK 26 or later is required for App Store uploads."
            exit 1
          fi

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: stable

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
          bundler-cache: true
          working-directory: ios

      - name: Install dependencies
        run: |
          flutter pub get
          dart run build_runner build --delete-conflicting-outputs

      - name: Import App Store certificates
        env:
          APPLE_DEVELOPMENT_CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATE_BASE64 }}
          APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD }}
          APPLE_DISTRIBUTION_CERTIFICATE_BASE64: ${{ secrets.APPLE_DISTRIBUTION_CERTIFICATE_BASE64 }}
          APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          security create-keychain -p "ci-build" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "ci-build" "$KEYCHAIN_PATH"
          # Import Apple Development certificate (for archive signing)
          DEV_CERT=$RUNNER_TEMP/apple_development.p12
          echo -n "$APPLE_DEVELOPMENT_CERTIFICATE_BASE64" | base64 --decode -o "$DEV_CERT"
          security import "$DEV_CERT" -P "$APPLE_DEVELOPMENT_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          rm -f "$DEV_CERT"
          # Import Apple Distribution certificate (for export signing)
          DIST_CERT=$RUNNER_TEMP/apple_distribution.p12
          echo -n "$APPLE_DISTRIBUTION_CERTIFICATE_BASE64" | base64 --decode -o "$DIST_CERT"
          security import "$DIST_CERT" -P "$APPLE_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          rm -f "$DIST_CERT"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -k "ci-build" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          echo "Available signing identities:"
          security find-identity -v -p codesigning "$KEYCHAIN_PATH"

      - name: Setup App Store Connect API Key
        env:
          APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY }}
        run: |
          mkdir -p ios/fastlane
          echo "$APP_STORE_CONNECT_API_KEY_KEY" | base64 --decode > ios/fastlane/AuthKey.p8

      - name: Build iOS App Store package
        working-directory: ios
        env:
          APP_STORE_CONNECT_API_KEY_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY_ID }}
          APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          APP_STORE_CONNECT_API_KEY_KEY_FILEPATH: fastlane/AuthKey.p8
        run: bundle exec fastlane build

      - name: Rename IPA
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          mv ios/build/Submersion.ipa "Submersion-${TAG_NAME}-iOS.ipa"

      - name: Upload iOS artifact
        uses: actions/upload-artifact@v7
        with:
          name: ios-ipa
          path: Submersion-*.ipa
          retention-days: 5

      - name: Cleanup sensitive files
        if: always()
        run: |
          rm -f ios/fastlane/AuthKey.p8
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db 2>/dev/null || true

  # ============================================================================
  # Upload macOS to App Store (gated on all builds)
  # ============================================================================
  upload-macos:
    name: Upload macOS to App Store
    runs-on: macos-15
    needs: [build-macos, build-windows, build-linux, build-android, build-ios]
    timeout-minutes: 20

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
          bundler-cache: true
          working-directory: macos

      - name: Setup App Store Connect API Key
        env:
          APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY }}
        run: |
          mkdir -p macos/fastlane
          echo "$APP_STORE_CONNECT_API_KEY_KEY" | base64 --decode > macos/fastlane/AuthKey.p8

      - name: Download macOS pkg artifact
        uses: actions/download-artifact@v8
        with:
          name: macos-pkg
          path: macos/build

      - name: Determine Fastlane lane
        id: lane
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          if echo "$TAG_NAME" | grep -qE '\-(alpha|beta|rc)'; then
            echo "lane=upload_testflight_only" >> "$GITHUB_OUTPUT"
          else
            echo "lane=upload_only" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload to App Store / TestFlight
        working-directory: macos
        env:
          FASTLANE_LANE: ${{ steps.lane.outputs.lane }}
          APP_STORE_CONNECT_API_KEY_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY_ID }}
          APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          APP_STORE_CONNECT_API_KEY_KEY_FILEPATH: fastlane/AuthKey.p8
        run: |
          for attempt in 1 2; do
            if bundle exec fastlane "$FASTLANE_LANE"; then
              break
            fi
            if [ "$attempt" -eq 2 ]; then
              echo "Fastlane upload failed after 2 attempts"
              exit 1
            fi
            echo "Fastlane attempt $attempt failed, retrying in 30s..."
            sleep 30
          done

      - name: Cleanup sensitive files
        if: always()
        run: rm -f macos/fastlane/AuthKey.p8

  # ============================================================================
  # Upload iOS to App Store (gated on all builds)
  # ============================================================================
  upload-ios:
    name: Upload iOS to App Store
    runs-on: macos-15
    needs: [build-macos, build-windows, build-linux, build-android, build-ios]
    timeout-minutes: 20

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
          bundler-cache: true
          working-directory: ios

      - name: Setup App Store Connect API Key
        env:
          APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY }}
        run: |
          mkdir -p ios/fastlane
          echo "$APP_STORE_CONNECT_API_KEY_KEY" | base64 --decode > ios/fastlane/AuthKey.p8

      - name: Download iOS IPA artifact
        uses: actions/download-artifact@v8
        with:
          name: ios-ipa

      - name: Determine Fastlane lane
        id: lane
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          if echo "$TAG_NAME" | grep -qE '\-(alpha|beta|rc)'; then
            echo "lane=upload_testflight_only" >> "$GITHUB_OUTPUT"
          else
            echo "lane=upload_only" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload to App Store / TestFlight
        working-directory: ios
        env:
          FASTLANE_LANE: ${{ steps.lane.outputs.lane }}
          APP_STORE_CONNECT_API_KEY_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY_ID }}
          APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          APP_STORE_CONNECT_API_KEY_KEY_FILEPATH: fastlane/AuthKey.p8
        run: |
          IPA_PATH=$(ls $GITHUB_WORKSPACE/Submersion-*-iOS.ipa 2>/dev/null | head -1)
          if [ -z "$IPA_PATH" ]; then
            echo "Error: No IPA artifact found"
            ls -la $GITHUB_WORKSPACE/
            exit 1
          fi
          echo "Found IPA: $IPA_PATH"
          for attempt in 1 2; do
            if bundle exec fastlane "$FASTLANE_LANE" ipa:"$IPA_PATH"; then
              break
            fi
            if [ "$attempt" -eq 2 ]; then
              echo "Fastlane upload failed after 2 attempts"
              exit 1
            fi
            echo "Fastlane attempt $attempt failed, retrying in 30s..."
            sleep 30
          done

      - name: Cleanup sensitive files
        if: always()
        run: rm -f ios/fastlane/AuthKey.p8

  # ============================================================================
  # Upload Android to Google Play (gated on all builds)
  # ============================================================================
  upload-android:
    name: Upload Android to Google Play
    runs-on: ubuntu-latest
    needs: [build-macos, build-windows, build-linux, build-android, build-ios]
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
          bundler-cache: true
          working-directory: android

      - name: Setup Google Play service account key
        env:
          GOOGLE_PLAY_SERVICE_ACCOUNT_KEY: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_KEY }}
        run: |
          mkdir -p android/fastlane
          echo "$GOOGLE_PLAY_SERVICE_ACCOUNT_KEY" | base64 --decode > android/fastlane/play-store-key.json
          chmod 600 android/fastlane/play-store-key.json

      - name: Download Android AAB artifact
        uses: actions/download-artifact@v8
        with:
          name: android-aab

      - name: Upload to Google Play
        working-directory: android
        env:
          GOOGLE_PLAY_JSON_KEY_PATH: fastlane/play-store-key.json
        run: |
          for attempt in 1 2; do
            if bundle exec fastlane upload; then
              break
            fi
            if [ "$attempt" -eq 2 ]; then
              echo "Fastlane upload failed after 2 attempts"
              exit 1
            fi
            echo "Fastlane attempt $attempt failed, retrying in 30s..."
            sleep 30
          done

      - name: Cleanup sensitive files
        if: always()
        run: rm -f android/fastlane/play-store-key.json

  # ============================================================================
  # Generate Appcast & Checksums
  # ============================================================================
  generate-appcast:
    name: Generate Appcast & Checksums
    runs-on: ubuntu-latest
    needs: [build-macos, build-windows, build-linux, build-android, build-ios]
    if: >-
      !contains(github.ref_name, '-alpha') &&
      !contains(github.ref_name, '-beta') &&
      !contains(github.ref_name, '-rc')

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          merge-multiple: true

      - name: Generate release notes HTML
        run: |
          ./scripts/release/generate_changelog.sh --notes-only | \
            ./scripts/generate_release_notes_html.sh > release-notes.html

      - name: Generate appcast.xml
        env:
          TAG_NAME: ${{ github.ref_name }}
          SPARKLE_EDDSA_SIGNATURE: ${{ needs.build-macos.outputs.eddsa-signature }}
          SPARKLE_DMG_LENGTH: ${{ needs.build-macos.outputs.dmg-length }}
        run: |
          VERSION="${TAG_NAME#v}"
          BUILD_NUMBER=$(grep '^version:' pubspec.yaml | sed 's/.*+//')
          DATE=$(date -R)
          MACOS_URL="https://github.com/${{ github.repository }}/releases/download/${TAG_NAME}/Submersion-${TAG_NAME}-macOS.dmg"
          WINDOWS_URL="https://github.com/${{ github.repository }}/releases/download/${TAG_NAME}/Submersion-${TAG_NAME}-Windows-Setup.exe"
          ./scripts/generate_appcast.sh "$VERSION" "$BUILD_NUMBER" "$DATE" "$MACOS_URL" "$WINDOWS_URL" "release-notes.html" > appcast.xml

      - name: Generate checksums
        run: sha256sum Submersion-* > checksums-sha256.txt

      - name: Upload appcast artifact
        uses: actions/upload-artifact@v7
        with:
          name: appcast
          path: |
            appcast.xml
            release-notes.html
          retention-days: 5

      - name: Upload checksums artifact
        uses: actions/upload-artifact@v7
        with:
          name: checksums
          path: checksums-sha256.txt
          retention-days: 5

  # ============================================================================
  # Create GitHub Release
  # ============================================================================
  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [build-macos, build-windows, build-linux, build-android, build-ios, generate-appcast]
    if: ${{ !cancelled() && !failure() }}
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Generate release notes
        run: |
          ./scripts/release/generate_changelog.sh --notes-only > release-notes.md

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          merge-multiple: true

      - name: List artifacts
        run: ls -la

      - name: Generate checksums
        run: sha256sum Submersion-* > checksums-sha256.txt

      - name: Determine if pre-release
        id: prerelease
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          if echo "$TAG_NAME" | grep -qE '\-(beta|rc|alpha)'; then
            echo "prerelease=true" >> "$GITHUB_OUTPUT"
          else
            echo "prerelease=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          files: |
            Submersion-*
            appcast.xml
            release-notes.html
            checksums-sha256.txt
          prerelease: ${{ steps.prerelease.outputs.prerelease }}
          body_path: release-notes.md

  # ============================================================================
  # Validate Release
  # ============================================================================
  validate-release:
    name: Validate Release
    needs: create-release
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Verify release assets
        env:
          TAG_NAME: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "=== Verifying release assets for $TAG_NAME ==="

          ASSETS=$(gh release view "$TAG_NAME" \
            --repo "${{ github.repository }}" \
            --json assets -q '.assets[].name')

          EXPECTED=(
            "Submersion-${TAG_NAME}-macOS.dmg"
            "Submersion-${TAG_NAME}-Windows-Setup.exe"
            "Submersion-${TAG_NAME}-Linux.tar.gz"
            "Submersion-${TAG_NAME}-Android.apk"
            "Submersion-${TAG_NAME}-Android.aab"
            "checksums-sha256.txt"
          )

          # Appcast is only generated for stable releases
          if ! echo "$TAG_NAME" | grep -qE '\-(alpha|beta|rc)'; then
            EXPECTED+=("appcast.xml")
          fi

          MISSING=()
          for expected in "${EXPECTED[@]}"; do
            if echo "$ASSETS" | grep -q "$expected"; then
              echo "  [OK] $expected"
            else
              echo "  [MISSING] $expected"
              MISSING+=("$expected")
            fi
          done

          if [ ${#MISSING[@]} -gt 0 ]; then
            echo ""
            echo "ERROR: ${#MISSING[@]} expected asset(s) missing from release"
            exit 1
          fi

          echo ""
          echo "All expected assets present."

      - name: Verify checksums
        env:
          TAG_NAME: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "=== Verifying checksums ==="
          gh release download "$TAG_NAME" \
            --repo "${{ github.repository }}" \
            --pattern "checksums-sha256.txt" \
            --pattern "Submersion-*"

          if sha256sum -c checksums-sha256.txt; then
            echo "All checksums verified."
          else
            echo "ERROR: Checksum verification failed"
            exit 1
          fi

      - name: Validate appcast XML
        if: >-
          !contains(github.ref_name, '-alpha') &&
          !contains(github.ref_name, '-beta') &&
          !contains(github.ref_name, '-rc')
        env:
          TAG_NAME: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "=== Validating appcast.xml ==="
          gh release download "$TAG_NAME" \
            --repo "${{ github.repository }}" \
            --pattern "appcast.xml" \
            --clobber

          if python3 -c "import xml.etree.ElementTree as ET; ET.parse('appcast.xml'); print('Valid XML')"; then
            echo "Appcast is well-formed."
          else
            echo "ERROR: appcast.xml is not valid XML"
            exit 1
          fi

  # ============================================================================
  # Notify on Store Upload Failures
  # ============================================================================
  notify-upload-failures:
    name: Notify Upload Failures
    runs-on: ubuntu-latest
    needs: [upload-macos, upload-ios, upload-android]
    if: always() && contains(needs.*.result, 'failure')
    permissions:
      issues: write

    steps:
      - name: Build failure summary
        id: summary
        env:
          MACOS_RESULT: ${{ needs.upload-macos.result }}
          IOS_RESULT: ${{ needs.upload-ios.result }}
          ANDROID_RESULT: ${{ needs.upload-android.result }}
        run: |
          FAILURES=""
          if [ "$MACOS_RESULT" = "failure" ]; then
            FAILURES="${FAILURES}- **macOS** App Store upload failed\n"
          fi
          if [ "$IOS_RESULT" = "failure" ]; then
            FAILURES="${FAILURES}- **iOS** App Store upload failed\n"
          fi
          if [ "$ANDROID_RESULT" = "failure" ]; then
            FAILURES="${FAILURES}- **Android** Google Play upload failed\n"
          fi
          echo "failures<<EOF" >> "$GITHUB_OUTPUT"
          echo -e "$FAILURES" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Ensure ci label exists
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh label create ci --color "0E8A16" --repo "${{ github.repository }}" 2>/dev/null || true

      - name: Create GitHub Issue
        env:
          TAG_NAME: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
          FAILURES: ${{ steps.summary.outputs.failures }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          gh issue create \
            --repo "${{ github.repository }}" \
            --title "Store upload failures for ${TAG_NAME}" \
            --label "ci" \
            --body "$(cat <<EOF
          The GitHub Release for \`${TAG_NAME}\` was created successfully, but one or more store uploads failed:

          ${FAILURES}
          **Workflow run:** ${RUN_URL}

          The builds are available as workflow artifacts. Re-upload manually or re-run the failed jobs.
          EOF
          )"