name: Sign MacOS Binaries

on:
  workflow_dispatch:
    inputs:
      artifact-pattern:
        description: 'Pattern for artifacts to download (default: terragrunt_darwin_*)'
        required: false
        type: string
        default: 'terragrunt_darwin_*'
      upload-artifact-name:
        description: 'Name for the uploaded signed artifacts'
        required: false
        type: string
        default: 'macos-signed-files'
  workflow_call:
    inputs:
      artifact-pattern:
        description: 'Pattern for artifacts to download (default: terragrunt_darwin_*)'
        required: false
        type: string
        default: 'terragrunt_darwin_*'
      upload-artifact-name:
        description: 'Name for the uploaded signed artifacts'
        required: false
        type: string
        default: 'macos-signed-files'

jobs:
  build:
    name: Build (darwin/${{ matrix.arch }})
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [amd64, arm64]

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Use mise to install dependencies
        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
        with:
          version: 2026.1.9
          experimental: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - id: go-cache-paths
        run: |
          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"

      - name: Go Build Cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-build }}
          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}-darwin-${{ matrix.arch }}
          restore-keys: |
            ${{ runner.os }}-go-build-

      - name: Go Mod Cache
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
        with:
          path: ${{ steps.go-cache-paths.outputs.go-mod }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-mod-

      - name: Build Terragrunt
        env:
          GOOS: darwin
          GOARCH: ${{ matrix.arch }}
          CGO_ENABLED: 0
          BUILD_VERSION: ${{ github.ref_name }}
        run: |
          OUTPUT="bin/terragrunt_${GOOS}_${GOARCH}"
          go build -o "${OUTPUT}" \
            -ldflags "-s -w -X github.com/gruntwork-io/go-commons/version.Version=${BUILD_VERSION}" \
            .

      - name: Verify Static Linking
        env:
          GOOS: darwin
          GOARCH: ${{ matrix.arch }}
        run: |
          OUTPUT="bin/terragrunt_${GOOS}_${GOARCH}"
          .github/scripts/release/verify-static-binary.sh "${OUTPUT}" "${GOOS}" "${GOARCH}"

      - name: Upload Build Artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: terragrunt_darwin_${{ matrix.arch }}
          path: bin/terragrunt_darwin_${{ matrix.arch }}*

  sign-macos:
    name: Sign MacOS Binaries
    needs: build
    if: always() && (needs.build.result == 'success' || needs.build.result == 'skipped')
    runs-on: macos-latest
    env:
      MISE_PROFILE: cicd
      GON_VERSION: v0.0.37

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download macOS build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: ${{ inputs.artifact-pattern }}
          path: artifacts/

      - name: Prepare build artifacts
        run: .github/scripts/release/prepare-macos-artifacts.sh artifacts bin

      - name: Use mise to install dependencies
        uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
        with:
          version: 2026.1.9
          experimental: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Cache gon binary
        id: cache-gon
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
        with:
          path: gon
          key: gon-${{ env.GON_VERSION }}

      - name: Download and install gon
        if: steps.cache-gon.outputs.cache-hit != 'true'
        run: .github/scripts/release/install-gon.sh ${{ env.GON_VERSION }}

      - name: Verify gon installation
        run: gon --version

      - name: Sign MacOS Binaries
        env:
          AC_PASSWORD: ${{ secrets.MACOS_AC_PASSWORD }}
          AC_PROVIDER: ${{ secrets.MACOS_AC_PROVIDER }}
          AC_USERNAME: ${{ secrets.MACOS_AC_LOGIN }}
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
        run: .github/scripts/release/sign-macos-binaries.sh bin

      - name: Verify codesign signatures
        run: |
          # Get list of expected macOS binaries from config
          macos_binaries=$(jq -r '.platforms[] | select(.os == "darwin") | .binary' .github/assets/release-assets-config.json)

          for binary in $macos_binaries; do
            codesign -dv --verbose=4 "bin/$binary" 2>&1 || {
              echo "ERROR: No valid signature found for bin/$binary"
              exit 1
            }
          done

      - name: Upload Signed MacOS Binaries
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ inputs.upload-artifact-name }}
          path: bin/terragrunt_darwin_*
          if-no-files-found: error
