ci.yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  XCODE_PROJECT: mplayer.xcodeproj
  XCODE_SCHEME: mplayer
  XCODE_DESTINATION: 'platform=macOS'
  BUILD_SETTINGS: 'CODE_SIGNING_ALLOWED=NO'

jobs:
  build-and-test:
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Show Xcode version
        run: xcodebuild -version

      - name: Build and test (Debug)
        run: |
          xcodebuild test \
            -project ${{ env.XCODE_PROJECT }} \
            -scheme ${{ env.XCODE_SCHEME }} \
            -destination ${{ env.XCODE_DESTINATION }} \
            -configuration Debug \
            -derivedDataPath ./DerivedData \
            ${{ env.BUILD_SETTINGS }} \
            ONLY_ACTIVE_ARCH=YES

      - name: Build Release .app for distribution
        run: |
          echo "🚀 Building Release .app for distribution..."
          xcodebuild build \
            -project ${{ env.XCODE_PROJECT }} \
            -scheme ${{ env.XCODE_SCHEME }} \
            -destination ${{ env.XCODE_DESTINATION }} \
            -configuration Release \
            -derivedDataPath ./ReleaseData \
            ${{ env.BUILD_SETTINGS }} \
            ONLY_ACTIVE_ARCH=NO \
            ARCHS="arm64"

      - name: Package Release .app
        run: |
          # Create artifacts directory
          mkdir -p ./artifacts

          # Find and copy Release .app
          RELEASE_APP=$(find ./ReleaseData -path "*/Release/*.app" -type d | head -1)
          if [ -n "$RELEASE_APP" ]; then
            cp -R "$RELEASE_APP" ./artifacts/mplayer-Release.app
            echo "✅ Release .app packaged successfully"
            ls -la ./artifacts/
          else
            echo "❌ Release .app not found!"
            exit 1
          fi

      - name: Upload Release .app
        uses: actions/upload-artifact@v4
        with:
          name: mplayer-release-${{ github.run_number }}
          path: ./artifacts/
          retention-days: 30

  code-quality-check:
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run code quality checks
        run: |
          echo "🔍 Running code quality checks..."

          # Check for TODO/FIXME comments
          if grep -r "TODO\|FIXME\|XXX" mplayer/ --include="*.swift" || true; then
            echo "📝 Found TODO/FIXME comments (review needed)"
          fi

          # Check for potential force unwrapping
          if grep -r "!" mplayer/ --include="*.swift" | grep -v "//\|print" || true; then
            echo "⚠️ Found potential force unwrapping (review for safety)"
          fi

          # Check for print statements
          if grep -r "print(" mplayer/ --include="*.swift" || true; then
            echo "🐛 Found print statements (consider using proper logging)"
          fi

          echo "✅ Code quality check completed"

  security-check:
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Security and configuration checks
        run: |
          echo "🔒 Running security checks..."

          sensitive_found=false

          # Check for sensitive information
          if grep -ri "password\|secret\|api_key\|apikey\|token\|credential" mplayer/ --include="*.swift" --include="*.plist" || true; then
            echo "⚠️ Found potential sensitive information"
            sensitive_found=true
          fi

          # Check for AWS keys
          if grep -ri "AKIAI\|AKIA[0-9A-Z]\{16\}" mplayer/ --include="*.swift" --include="*.plist" || true; then
            echo "⚠️ Found potential AWS access key"
            sensitive_found=true
          fi

          if [ "$sensitive_found" = false ]; then
            echo "✅ No obvious sensitive information found"
          fi

          # Check project configuration
          echo "📋 Checking project configuration..."
          if grep -i "PRODUCT_BUNDLE_IDENTIFIER\|DEVELOPMENT_TEAM" ${{ env.XCODE_PROJECT }}/project.pbxproj | head -5; then
            echo "Project configuration found"
          fi

          echo "✅ Security checks completed"

  archive-verification:
    runs-on: macos-latest
    needs: build-and-test
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download Release artifact
        uses: actions/download-artifact@v4
        with:
          name: mplayer-release-${{ github.run_number }}
          path: ./downloaded-artifacts

      - name: Verify archive can be created from Release .app
        run: |
          echo "📦 Verifying archive creation..."

          if [ -d "./downloaded-artifacts/mplayer-Release.app" ]; then
            echo "✅ Release .app found and ready for distribution"
            ls -la ./downloaded-artifacts/

            # Get basic app info
            echo "App bundle contents:"
            ls -la "./downloaded-artifacts/mplayer-Release.app/Contents/"
          else
            echo "❌ Release .app verification failed"
            exit 1
          fi