# 临时诊断 workflow —— 只检查 App Store Connect API key (.p8) 的 PEM 合法性，不编译。
# 不打印密钥本体，仅输出 PEM 头尾/字节数/openssl 解析结果。验证后删除。
name: Verify macOS Signing

on:
  push:
    branches:
      - verify-macos-signing

jobs:
  diag-apikey:
    runs-on: mac
    steps:
      - name: Diagnose API key (.p8) — no secret leakage
        env:
          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }}
          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }}
        run: |
          mkdir -p /Users/wangjia/.cache
          RF=/Users/wangjia/.cache/jiu-verify-result.txt
          {
            echo "=== diag @ $(date) ==="
            echo "KEY_ID    set=$([ -n "$APPSTORE_API_KEY_ID" ] && echo "yes(${#APPSTORE_API_KEY_ID})" || echo NO)"
            echo "ISSUER    set=$([ -n "$APPSTORE_API_ISSUER_ID" ] && echo "yes(${#APPSTORE_API_ISSUER_ID})" || echo NO)"
            echo "P8_B64    set=$([ -n "$APPSTORE_API_KEY_P8_BASE64" ] && echo "yes(${#APPSTORE_API_KEY_P8_BASE64})" || echo NO)"
            echo "P12_B64   set=$([ -n "$MACOS_DEVELOPER_ID_CERT_P12_BASE64" ] && echo "yes(${#MACOS_DEVELOPER_ID_CERT_P12_BASE64})" || echo NO)"
            echo "P12_PWD   set=$([ -n "$MACOS_DEVELOPER_ID_CERT_PASSWORD" ] && echo yes || echo NO)"
            echo "--- decode .p8 ---"
            printf '%s' "$APPSTORE_API_KEY_P8_BASE64" | base64 --decode > /tmp/diag.p8 2>/tmp/diag.err
            echo "decode_rc=$?  bytes=$(wc -c < /tmp/diag.p8 | tr -d ' ')"
            echo "decode_err=$(cat /tmp/diag.err)"
            echo "first_line=[$(head -1 /tmp/diag.p8)]"
            echo "last_line=[$(tail -1 /tmp/diag.p8)]"
            echo "has_CR=$(LC_ALL=C grep -c $'\r' /tmp/diag.p8 2>/dev/null || echo 0)"
            echo "line_count=$(wc -l < /tmp/diag.p8 | tr -d ' ')"
            openssl pkcs8 -nocrypt -in /tmp/diag.p8 -inform PEM -out /dev/null 2>&1 && echo "OPENSSL_PKCS8_OK" || echo "OPENSSL_PKCS8_FAILED"
            rm -f /tmp/diag.p8 /tmp/diag.err
            echo "=== END @ $(date) ==="
          } > "$RF" 2>&1