name: OSX

on:
  pull_request:
    paths:
      - '**.c'
      - '**.h'
      - '**.m'
      - '**.sh'
      - .github/workflows/macos.yml
      - '**.am'
      - MacOSX/**
      - configure.ac
  push:

permissions:
  contents: read  #  to fetch code (actions/checkout)

jobs:
  build:
    strategy:
      matrix:
        os: [macos-12, macos-14]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
      - run: .github/setup-macos.sh
        env:
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
          PASS_SECRETS_TAR_ENC: ${{ secrets.PASS_SECRETS_TAR_ENC }}
      - run: .github/build.sh
        env:
          CODE_SIGN_IDENTITY: ${{ secrets.CODE_SIGN_IDENTITY }}
          DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
          INSTALLER_SIGN_IDENTITY: ${{ secrets.INSTALLER_SIGN_IDENTITY }}
      - name: Cache build artifacts
        uses: actions/upload-artifact@v3
        with:
          name: opensc-build-${{ matrix.os }}
          path:
            OpenSC*.dmg
      - run: .github/cleanup-macos.sh
        env:
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
          PASS_SECRETS_TAR_ENC: ${{ secrets.PASS_SECRETS_TAR_ENC }}

  push-artifacts:
    runs-on: macos-12
    needs: [build]
    steps:
      - uses: actions/checkout@v3
      - name: Pull build artifacts
        uses: actions/download-artifact@v3
        with:
          name: opensc-build-macos-12
      - run: git config --global user.email "builds@github.com"
      - run: git config --global user.name "Github Actions";
      - run: .github/push_artifacts.sh "Github Actions ${GITHUB_REF}"
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        if: ${{ github.repository == 'OpenSC/OpenSC' }}
