build.sh

#!/bin/bash
#
# NotepadForMacOS - Build & Archive Script
#
# This script matches the current project layout (as of 2026-06-20).
# The project builds cleanly in Xcode. This script provides reliable
# CLI equivalents for build verification and distribution.
#
# Usage:
#   ./build.sh                # Debug build (default)
#   ./build.sh build          # Same as above
#   ./build.sh release        # Release build (arm64)
#   ./build.sh archive        # Create timestamped .xcarchive
#   ./build.sh dist           # Developer ID DMG (sign + notarize) — outside the App Store
#   ./build.sh appstore       # Mac App Store .pkg (export + optional upload)
#   ./build.sh upload         # Upload an existing .pkg to App Store Connect (no rebuild)
#   ./build.sh clean          # Clean build products
#   ./build.sh open           # Open in Xcode
#   ./build.sh --help
#

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

# === Current project settings ===
PROJECT="NotepadForMacOS/NotepadForMacOS.xcodeproj"
SCHEME="NotepadForMacOS"
BUILD_DIR="$SCRIPT_DIR/build"

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

info()    { echo -e "${BLUE}[INFO]${NC}    $1"; }
success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
warn()    { echo -e "${YELLOW}[WARN]${NC}    $1"; }
error()   { echo -e "${RED}[ERROR]${NC}   $1"; }

usage() {
  cat <<'EOF'
NotepadForMacOS Build Script

Commands:
  build     Build Debug configuration (default)
  release   Build Release configuration (Hardened Runtime)
  test      Run the unit test suite
  dist      Developer ID DMG for direct distribution: build Release + dist/Notepad.dmg
            (signs + notarizes if DEVID_APP/NOTARY_PROFILE set). NOT for the App Store.
  appstore  Mac App Store: archive Release, export dist/appstore/Notepad.pkg, and
            (if upload creds are set) upload to App Store Connect. Requires APPSTORE_TEAM_ID.
  upload    Upload an already-built .pkg to App Store Connect without rebuilding
            (defaults to dist/appstore/Notepad.pkg; needs ASC_* upload creds).
  archive   Archive for distribution (Release + .xcarchive)
  clean     Clean derived data, build folder, and dist
  open      Open the Xcode project
  help      Show this help message

Environment variables:
  Developer ID (dist):
    DEVID_APP        "Developer ID Application: Your Name (TEAMID)"
    NOTARY_PROFILE   keychain profile name from `xcrun notarytool store-credentials`
  App Store (appstore):
    APPSTORE_TEAM_ID 10-char Team ID (developer.apple.com -> Membership)         [required]
    ASC_KEY_ID       App Store Connect API key id  (key at
                     ~/.appstoreconnect/private_keys/AuthKey_<ASC_KEY_ID>.p8)     ] upload
    ASC_ISSUER_ID    App Store Connect API issuer id                             ] via API key
    ASC_APPLE_ID     Apple ID email                                              ] or upload via
    ASC_APP_PASSWORD app-specific password (appleid.apple.com)                   ] Apple ID

Examples:
  ./build.sh
  ./build.sh release
  ./build.sh test
  ./build.sh dist
  ./build.sh appstore
  ./build.sh clean
EOF
}

ensure_build_dir() {
  mkdir -p "$BUILD_DIR"
}

# Generate a complete multi-resolution AppIcon.icns and replace it in the built .app.
# This guarantees the Dock / Finder shows the real icon instead of a white square.
fix_app_icon() {
  local configuration="$1"
  local app_path="$BUILD_DIR/DerivedData/Build/Products/${configuration}/Notepad.app"

  if [[ ! -d "$app_path" ]]; then
    warn "Built app not found at $app_path — skipping icon fix"
    return
  fi

  # Prefer the high-res image the user prepared in the asset catalog if available.
  # Fall back to the Windows reference icon.
  local master_icon="NotepadForMacOS/NotepadForMacOS/Assets.xcassets/AppIcon.appiconset/AppIcon-512@2x.png"
  if [[ ! -f "$master_icon" ]]; then
    master_icon="Design/Windows_Notepad_icon.png"
  fi
  if [[ ! -f "$master_icon" ]]; then
    warn "No suitable master icon found — skipping icon fix"
    return
  fi

  local tmp_iconset="/tmp/NotepadAppIcon.$$.iconset"
  rm -rf "$tmp_iconset"
  mkdir -p "$tmp_iconset"

  # Create all required sizes (macOS App Icon requirements)
  sips -s format png -z 16 16   "$master_icon" --out "$tmp_iconset/icon_16x16.png"     >/dev/null 2>&1
  sips -s format png -z 32 32   "$master_icon" --out "$tmp_iconset/icon_16x16@2x.png"  >/dev/null 2>&1
  sips -s format png -z 32 32   "$master_icon" --out "$tmp_iconset/icon_32x32.png"     >/dev/null 2>&1
  sips -s format png -z 64 64   "$master_icon" --out "$tmp_iconset/icon_32x32@2x.png"  >/dev/null 2>&1
  sips -s format png -z 128 128 "$master_icon" --out "$tmp_iconset/icon_128x128.png"   >/dev/null 2>&1
  sips -s format png -z 256 256 "$master_icon" --out "$tmp_iconset/icon_128x128@2x.png" >/dev/null 2>&1
  sips -s format png -z 256 256 "$master_icon" --out "$tmp_iconset/icon_256x256.png"   >/dev/null 2>&1
  sips -s format png -z 512 512 "$master_icon" --out "$tmp_iconset/icon_256x256@2x.png" >/dev/null 2>&1
  sips -s format png -z 512 512 "$master_icon" --out "$tmp_iconset/icon_512x512.png"   >/dev/null 2>&1
  sips -s format png -z 1024 1024 "$master_icon" --out "$tmp_iconset/icon_512x512@2x.png" >/dev/null 2>&1

  local new_icns="/tmp/NotepadAppIcon.$$.icns"
  if iconutil --convert icns --output "$new_icns" "$tmp_iconset" >/dev/null 2>&1; then
    local target_icns="$app_path/Contents/Resources/AppIcon.icns"
    cp "$new_icns" "$target_icns"
    rm -f "$new_icns"
    success "Replaced AppIcon.icns with complete version (all sizes up to 1024)"
  else
    warn "Failed to generate full .icns"
  fi
  rm -rf "$tmp_iconset"

  # Help macOS notice the new icon
  touch "$app_path"

  # Replacing AppIcon.icns + touch after Xcode signed the bundle invalidates the
  # code signature ("a sealed resource is missing or invalid"), which prevents a
  # sandboxed app from launching. Re-sign (ad-hoc) with the real entitlements.
  # The Developer ID path in do_dist re-signs again afterward.
  if codesign --force --options runtime \
       --entitlements "$SCRIPT_DIR/NotepadForMacOS/Notepad.entitlements" \
       --sign - "$app_path" >/dev/null 2>&1; then
    success "Re-signed bundle (ad-hoc) after icon fix"
  else
    warn "Re-sign after icon fix failed"
  fi
}

build_target() {
  local configuration="$1"
  local destination="$2"

  ensure_build_dir

  info "Building scheme '$SCHEME' ($configuration) → arm64"

  xcodebuild \
    -project "$PROJECT" \
    -scheme "$SCHEME" \
    -configuration "$configuration" \
    -destination "$destination" \
    -derivedDataPath "$BUILD_DIR/DerivedData" \
    -parallelizeTargets \
    clean build \
    | tee "$BUILD_DIR/last-build.log"

  success "Build finished: $configuration"
  echo "  Log: $BUILD_DIR/last-build.log"

  # Ensure the app has a complete, proper AppIcon (the asset catalog sometimes
  # produces incomplete .icns missing 256/512 sizes, resulting in white square in Dock).
  fix_app_icon "$configuration"
}

do_archive() {
  ensure_build_dir

  local timestamp
  timestamp=$(date +%Y%m%d-%H%M%S)
  local archive_name="NotepadForMacOS-${timestamp}"
  local archive_path="$BUILD_DIR/${archive_name}.xcarchive"

  info "Creating archive for distribution..."

  xcodebuild \
    -project "$PROJECT" \
    -scheme "$SCHEME" \
    -configuration Release \
    -destination 'generic/platform=macOS' \
    -archivePath "$archive_path" \
    archive \
    | tee "$BUILD_DIR/last-archive.log"

  success "Archive created successfully!"
  echo ""
  echo "  Archive: $archive_path"
  echo ""
  echo "Next steps for exporting .app:"
  echo "  1. Open Xcode → Window > Organizer"
  echo "  2. Select the archive → 'Distribute App'"
  echo "  3. Choose 'Copy App' (for direct distribution) or Developer ID"
  echo ""
  echo "Or export from command line if you have an exportOptions.plist."
}

run_tests() {
  ensure_build_dir
  info "Running unit tests..."
  xcodebuild test \
    -project "$PROJECT" \
    -scheme "$SCHEME" \
    -destination 'platform=macOS,arch=arm64' \
    -derivedDataPath "$BUILD_DIR/DerivedData" \
    | tee "$BUILD_DIR/last-test.log"
  success "Tests finished"
}

# Build Release, produce a distributable .dmg in dist/, and (if a Developer ID
# identity + notary profile are provided via env) sign, notarize, and staple.
do_dist() {
  build_target "Release" "platform=macOS,arch=arm64"

  local app_path="$BUILD_DIR/DerivedData/Build/Products/Release/Notepad.app"
  if [[ ! -d "$app_path" ]]; then
    error "Release app not found at $app_path"; exit 1
  fi

  local dist_dir="$SCRIPT_DIR/dist"
  mkdir -p "$dist_dir"
  local dmg_path="$dist_dir/Notepad.dmg"

  # Developer ID signing (optional) — needs $DEVID_APP (e.g. "Developer ID Application: Name (TEAMID)")
  if [[ -n "${DEVID_APP:-}" ]]; then
    info "Signing with Developer ID + Hardened Runtime: $DEVID_APP"
    codesign --force --options runtime --timestamp \
      --entitlements "NotepadForMacOS/Notepad.entitlements" \
      --sign "$DEVID_APP" "$app_path"
  else
    warn "DEVID_APP not set — keeping ad-hoc signature (Gatekeeper will warn on other Macs)."
  fi

  info "Creating $dmg_path"
  rm -f "$dmg_path"
  local staging="/tmp/NotepadDist.$$"
  rm -rf "$staging"; mkdir -p "$staging"
  cp -R "$app_path" "$staging/"
  ln -s /Applications "$staging/Applications"
  hdiutil create -volname "Notepad" -srcfolder "$staging" -ov -format UDZO "$dmg_path" >/dev/null
  rm -rf "$staging"
  success "Created $dmg_path"

  # Notarize (optional) — needs $NOTARY_PROFILE stored via `xcrun notarytool store-credentials`
  if [[ -n "${DEVID_APP:-}" && -n "${NOTARY_PROFILE:-}" ]]; then
    info "Submitting for notarization (profile: $NOTARY_PROFILE)..."
    xcrun notarytool submit "$dmg_path" --keychain-profile "$NOTARY_PROFILE" --wait
    info "Stapling ticket..."
    xcrun stapler staple "$dmg_path"
    success "Notarized + stapled: $dmg_path"
  else
    echo ""
    echo "To produce a Gatekeeper-friendly build, set:"
    echo "  export DEVID_APP=\"Developer ID Application: Your Name (TEAMID)\""
    echo "  export NOTARY_PROFILE=\"notary-profile\"   # via: xcrun notarytool store-credentials"
    echo "then re-run: ./build.sh dist"
  fi
}

# Upload a .pkg to App Store Connect via altool, using whichever credentials are set.
# Returns non-zero (and prints how to set creds) if no credentials are available.
upload_pkg() {
  local pkg="$1"
  if [[ -n "${ASC_KEY_ID:-}" && -n "${ASC_ISSUER_ID:-}" ]]; then
    info "Uploading to App Store Connect via API key $ASC_KEY_ID..."
    xcrun altool --upload-app --type macos --file "$pkg" \
      --api-key "$ASC_KEY_ID" --api-issuer "$ASC_ISSUER_ID"
    success "Upload submitted. Watch App Store Connect -> your app -> Activity."
    return 0
  elif [[ -n "${ASC_APPLE_ID:-}" && -n "${ASC_APP_PASSWORD:-}" ]]; then
    info "Uploading to App Store Connect as $ASC_APPLE_ID..."
    xcrun altool --upload-app --type macos --file "$pkg" \
      --username "$ASC_APPLE_ID" --password "$ASC_APP_PASSWORD"
    success "Upload submitted. Watch App Store Connect -> your app -> Activity."
    return 0
  fi
  echo ""
  echo "Package NOT uploaded ($pkg). To upload, set ONE of:"
  echo "  - API key:  export ASC_KEY_ID=XXXXXXXXXX ASC_ISSUER_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  echo "              (place the key at ~/.appstoreconnect/private_keys/AuthKey_XXXXXXXXXX.p8)"
  echo "  - Apple ID: export ASC_APPLE_ID=you@example.com ASC_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx"
  echo "then:  ./build.sh upload        (uploads the existing .pkg, no rebuild)"
  return 1
}

# Archive Release, export a Mac App Store .pkg, and (if upload creds are set) upload
# it to App Store Connect.
#
# Requires:
#   - An "Apple Distribution" cert AND a "Mac Installer Distribution" (a.k.a.
#     "3rd Party Mac Developer Installer") cert in your keychain.
#   - An Xcode account signed in (Xcode > Settings > Accounts) so that
#     -allowProvisioningUpdates can fetch/create the Mac App Store provisioning profile.
#   - The App ID + app record already created in App Store Connect.
#
# Required env:  APPSTORE_TEAM_ID
# Upload (optional — pick ONE group; otherwise the .pkg is only exported):
#   API key (recommended, no 2FA):  ASC_KEY_ID + ASC_ISSUER_ID
#   Apple ID:                        ASC_APPLE_ID + ASC_APP_PASSWORD
do_appstore() {
  ensure_build_dir
  : "${APPSTORE_TEAM_ID:?Set APPSTORE_TEAM_ID (10-char Team ID from developer.apple.com -> Membership)}"

  local timestamp archive_path export_dir
  timestamp=$(date +%Y%m%d-%H%M%S)
  archive_path="$BUILD_DIR/AppStore-${timestamp}.xcarchive"
  export_dir="$SCRIPT_DIR/dist/appstore"
  rm -rf "$export_dir"; mkdir -p "$export_dir"

  info "Archiving Release for the App Store (team $APPSTORE_TEAM_ID)..."
  xcodebuild \
    -project "$PROJECT" \
    -scheme "$SCHEME" \
    -configuration Release \
    -destination 'generic/platform=macOS' \
    -archivePath "$archive_path" \
    -allowProvisioningUpdates \
    DEVELOPMENT_TEAM="$APPSTORE_TEAM_ID" \
    CODE_SIGN_STYLE=Automatic \
    archive \
    | tee "$BUILD_DIR/last-appstore-archive.log"

  # The export "method" string changed across Xcode versions (app-store ->
  # app-store-connect). Try the modern name first, fall back if this Xcode rejects it.
  local export_log="$BUILD_DIR/last-appstore-export.log"
  local eo="$BUILD_DIR/ExportOptions-appstore.plist"
  local exported=0 method
  for method in app-store-connect app-store; do
    info "Exporting App Store package (method=$method)..."
    cat > "$eo" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>method</key><string>$method</string>
  <key>teamID</key><string>$APPSTORE_TEAM_ID</string>
  <key>signingStyle</key><string>automatic</string>
  <key>destination</key><string>export</string>
</dict>
</plist>
EOF
    if xcodebuild -exportArchive \
         -archivePath "$archive_path" \
         -exportPath "$export_dir" \
         -exportOptionsPlist "$eo" \
         -allowProvisioningUpdates >"$export_log" 2>&1; then
      exported=1; break
    fi
    if ! grep -qi "for key .method." "$export_log"; then
      # Failure is unrelated to the method string — surface it and stop retrying.
      cat "$export_log"; break
    fi
    warn "method=$method rejected by this Xcode — trying the alternative name..."
  done

  if [[ "$exported" != "1" ]]; then
    error "App Store export failed — see $export_log"
    exit 1
  fi

  local pkg
  pkg=$(/usr/bin/find "$export_dir" -maxdepth 1 -name '*.pkg' | head -1)
  if [[ -z "$pkg" ]]; then
    error "No .pkg produced in $export_dir"; exit 1
  fi
  success "Exported App Store package: $pkg"

  upload_pkg "$pkg" || true
}

# Upload an already-built .pkg to App Store Connect WITHOUT rebuilding.
#   ./build.sh upload [path-to.pkg]   (defaults to dist/appstore/Notepad.pkg)
do_upload() {
  local pkg="${1:-}"
  pkg="${pkg:-$SCRIPT_DIR/dist/appstore/Notepad.pkg}"
  if [[ ! -f "$pkg" ]]; then
    error "No package at $pkg — run ./build.sh appstore first (or pass a path)."
    exit 1
  fi
  info "Uploading existing package: $pkg"
  upload_pkg "$pkg"
}

do_clean() {
  info "Cleaning project..."

  if [[ -f "$PROJECT" ]]; then
    xcodebuild -project "$PROJECT" -scheme "$SCHEME" clean || true
  fi

  rm -rf "$BUILD_DIR" "$SCRIPT_DIR/dist"
  success "Clean complete"
}

open_in_xcode() {
  info "Opening project in Xcode..."
  open "$PROJECT"
}

# === Main dispatch ===
command="${1:-build}"

case "$command" in
  build|"")
    build_target "Debug" "platform=macOS,arch=arm64"
    ;;
  release)
    build_target "Release" "platform=macOS,arch=arm64"
    ;;
  test)
    run_tests
    ;;
  dist)
    do_dist
    ;;
  appstore)
    do_appstore
    ;;
  upload)
    do_upload "${2:-}"
    ;;
  archive)
    do_archive
    ;;
  clean)
    do_clean
    ;;
  open)
    open_in_xcode
    ;;
  help|--help|-h)
    usage
    ;;
  *)
    error "Unknown command: $command"
    usage
    exit 1
    ;;
esac