codemagic.yaml

workflows:
  # ============================================
  # AUTO-DEPLOY WORKFLOWS (Triggered on push to main)
  # ============================================

  ios-internal-auto:
    name: Auto Deploy iOS to Internal TestFlight
    instance_type: mac_mini_m2
    max_build_duration: 120
    integrations:
      app_store_connect: codemagic_v4
    environment:
      ios_signing:
        provisioning_profiles:
          - codemagic_v4
          - codemagic_watchos_v4
        certificates:
          - codemagic_v4
      groups:
        - app_env
        - firebase
        - shorebird
      vars:
        APP_ID: 6502156163
      flutter: 3.35.3
      xcode: 16.4
      cocoapods: 1.16.2
    cache:
      cache_paths:
        - $HOME/.pub-cache
        - $HOME/.gradle/caches
        - $HOME/Library/Caches/CocoaPods
    triggering:
      events:
        - push
      branch_patterns:
        - pattern: main
          include: true
      cancel_previous_builds: true
    when:
      changeset:
        includes:
          - 'app/**'
    working_directory: app
    scripts:
      - name: Installing Opus
        script: |
          brew install opus
          brew install opus-tools

      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_prod.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12 \
            --android-package-name=com.friend.ios \
            --android-out=android/app/src/prod/  \
            --ios-out=ios/Config/Prod/ \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --ios-target="Runner" \
            --yes

          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_dev.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12.development \
            --android-package-name=com.friend.ios.dev \
            --android-out=android/app/src/dev/  \
            --ios-out=ios/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --ios-target="Runner" \
            --yes

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_IOS_API_KEY=$INTERCOM_IOS_API_KEY >> .env
          echo POSTHOG_API_KEY=$POSTHOG_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env

      - name: Set up Google Service Info
        script: |
          echo "$GOOGLE_INFO_PLIST_KEY" > "$(pwd)/ios/Runner/GoogleService-Info.plist"

      - name: Generate iOS Custom Config (Custom.xcconfig)
        script: |
          sh scripts/generate_ios_custom_config.sh ios/Config/Prod/GoogleService-Info.plist ios/Flutter/

      - name: Get Flutter packages
        script: |
          flutter pub get

      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs

      - name: Installs pod
        script: |
          cd ios && pod install --repo-update

      - name: Flutter build ipa
        script: |
          xcode-project use-profiles

          # Extract version name from pubspec.yaml (source of truth)
          PUBSPEC_VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | tr -d ' ')
          BUILD_NAME=$(echo "$PUBSPEC_VERSION" | cut -d'+' -f1)  # e.g., "1.0.78"

          # Auto-increment build number based on latest TestFlight build
          LATEST_BUILD=$(app-store-connect get-latest-testflight-build-number $APP_ID || echo "0")
          BUILD_NUMBER=$((LATEST_BUILD + 1))

          echo "Building iOS with version $BUILD_NAME ($BUILD_NUMBER)"

          flutter build ipa \
            --release \
            --build-name=$BUILD_NAME \
            --build-number=$BUILD_NUMBER \
            --flavor prod \
            --export-options-plist=$HOME/export_options.plist

    artifacts:
      - build/ios/ipa/*.ipa
      - /tmp/xcodebuild_logs/*.log
      - flutter_drive.log
      - $HOME/Library/Developer/Xcode/DerivedData/**/Build/**/*.dSYM
    publishing:
      scripts:
        - name: Upload debug symbols to Firebase Crashlytics
          script: |
            echo "Finding all debug symbol files..."
            dsymFiles=$(find $HOME/Library/Developer/Xcode/DerivedData -name "*.dSYM" -type d 2>/dev/null)
            if [[ -z "$dsymFiles" ]]; then
              echo "No debug symbols were found, skip publishing to Firebase Crashlytics"
            else
              echo "Found dSYM files:"
              echo "$dsymFiles"
              uploadScriptPath=$(find ios/Pods/FirebaseCrashlytics -name "upload-symbols" -type f 2>/dev/null | head -1)
              if [[ -n ${uploadScriptPath} ]]; then
                chmod +x "$uploadScriptPath"
                echo "$dsymFiles" | while IFS= read -r dsymPath; do
                  if [[ -n "$dsymPath" ]]; then
                    "$uploadScriptPath" -gsp ios/Runner/GoogleService-Info.plist -p ios "$dsymPath"
                  fi
                done
              fi
            fi
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: true
      app_store_connect:
        auth: integration
        submit_to_testflight: true
        beta_groups:
          - Internal
        submit_to_app_store: false

  android-internal-auto:
    name: Auto Deploy Android to Internal Play Store
    instance_type: mac_mini_m2
    max_build_duration: 120
    environment:
      android_signing:
        - prod_android_upload_keystore
      groups:
        - app_env
        - firebase
        - google_play
        - shorebird
      vars:
        PACKAGE_NAME: "com.friend.ios"
        JAVA_TOOL_OPTIONS: "-Xmx8g"
      flutter: 3.35.3
      xcode: 16.4
      cocoapods: 1.16.2
      java: 21
    cache:
      cache_paths:
        - $HOME/opt
        - $HOME/.pub-cache
        - $HOME/.gradle/caches
    triggering:
      events:
        - push
      branch_patterns:
        - pattern: main
          include: true
      cancel_previous_builds: true
    when:
      changeset:
        includes:
          - 'app/**'
    working_directory: app
    scripts:
      - name: Installing Android SDK
        script: |
          export ANDROID_HOME="$HOME/opt/android-sdk"
          if [ ! -d "$ANDROID_HOME" ]; then
            echo "$ANDROID_HOME does not exist. Installing..."
            mkdir -p $ANDROID_HOME
            cd "$HOME/opt" && \
            curl --fail --show-error --silent --connect-timeout 10.00 --max-time 120.00 \
              --output commandlinetools-mac-11076708_latest.zip \
              https://dl.google.com/android/repository/commandlinetools-mac-11076708_latest.zip && \
            7z -bd x commandlinetools-mac-11076708_latest.zip && \
            mkdir -p $ANDROID_HOME && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "tools" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "cmdline-tools;latest" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "ndk;28.2.13676358" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} --licenses  && \
            cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} --list
          fi
          if [ -d "$ANDROID_HOME" ]; then
            export PATH=$PATH:$ANDROID_HOME/tools:$ANDROID_HOME/tools/bin:$ANDROID_HOME/platform-tools
            echo ANDROID_HOME="$ANDROID_HOME" >> $CM_ENV
            echo ANDROID_SDK_ROOT="$ANDROID_HOME" >> $CM_ENV
            echo PATH="$PATH" >> $CM_ENV
          fi

      - name: Installing Opus
        script: |
          brew install opus
          brew install opus-tools

      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_prod.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12 \
            --android-package-name=com.friend.ios \
            --android-out=android/app/src/prod/  \
            --ios-out=ios/Config/Prod/ \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --ios-target="Runner" \
            --yes

          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_dev.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12.development \
            --android-package-name=com.friend.ios.dev \
            --android-out=android/app/src/dev/  \
            --ios-out=ios/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --ios-target="Runner" \
            --yes

      - name: Set up local.properties
        script: |
          echo "flutter.sdk=$HOME/programs/flutter" > "$(pwd)/android/local.properties"
          echo "sdk.dir=$ANDROID_HOME" >> "$(pwd)/android/local.properties"

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_ANDROID_API_KEY=$INTERCOM_ANDROID_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env

      - name: Get Flutter packages
        script: |
          flutter packages pub get

      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs

      - name: Build AAB with Flutter
        script: |
          # Extract version name from pubspec.yaml (source of truth)
          PUBSPEC_VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | tr -d ' ')
          BUILD_NAME=$(echo "$PUBSPEC_VERSION" | cut -d'+' -f1)  # e.g., "1.0.78"

          # Get latest build number from Google Play and increment
          LATEST_BUILD=$(google-play get-latest-build-number --package-name "$PACKAGE_NAME" --tracks internal || echo "0")
          BUILD_NUMBER=$((LATEST_BUILD + 1))

          echo "Building Android with version $BUILD_NAME ($BUILD_NUMBER)"

          flutter build appbundle \
            --release \
            --build-name=$BUILD_NAME \
            --build-number=$BUILD_NUMBER \
            --flavor prod

    artifacts:
      - build/**/outputs/**/*.aab
      - flutter_drive.log
    publishing:
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: true
      google_play:
        credentials: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        track: "internal"
        submit_as_draft: false

  # ============================================
  # PRODUCTION RELEASE WORKFLOWS (Triggered by tags)
  # ============================================

  ios-prod-testflight:
    name: Release iOS to Testflight
    instance_type: mac_mini_m2
    max_build_duration: 120
    integrations:
      app_store_connect: codemagic_v4
    environment:
      ios_signing:
        provisioning_profiles:
          - codemagic_v4
          - codemagic_watchos_v4
        certificates:
          - codemagic_v4
      groups:
        - app_env
        - firebase
        - shorebird
      vars:
        APP_ID: 6502156163
      flutter: 3.35.3
      xcode: 16.4
      cocoapods: 1.16.2
    cache:
      cache_paths:
        - $HOME/.pub-cache
        - $HOME/.gradle/caches
        - $HOME/Library/Caches/CocoaPods
    triggering:
      events:
        - tag
      tag_patterns:
        - pattern: "v*-ios-cm"
          include: true
        - pattern: "v*-mobile-cm"
          include: true
    working_directory: app
    scripts:
      - name: Installing Opus
        script: |
          brew install opus
          brew install opus-tools

      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          # https://github.com/invertase/flutterfire_cli/issues/233
          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_prod.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12 \
            --android-package-name=com.friend.ios \
            --android-out=android/app/src/prod/  \
            --ios-out=ios/Config/Prod/ \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --ios-target="Runner" \
            --yes

          # DEV, should remove
          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_dev.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12.development \
            --android-package-name=com.friend.ios.dev \
            --android-out=android/app/src/dev/  \
            --ios-out=ios/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --ios-target="Runner" \
            --yes

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_IOS_API_KEY=$INTERCOM_IOS_API_KEY >> .env
          echo POSTHOG_API_KEY=$POSTHOG_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env

      - name: Set up Google Service Info
        script: |
          # TODO: check why we need this ?
          echo "$GOOGLE_INFO_PLIST_KEY" > "$(pwd)/ios/Runner/GoogleService-Info.plist"

      - name: Generate iOS Custom Config (Custom.xcconfig)
        script: |
          sh scripts/generate_ios_custom_config.sh ios/Config/Prod/GoogleService-Info.plist ios/Flutter/

      - name: Get Flutter packages
        script: |
          flutter pub get

      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs

      - name: Installs pod
        script: |
          cd ios && pod install --repo-update

      - name: Flutter build ipa
        script: |
          # Set up code signing settings on Xcode project
          # -> $HOME/export_options.plist
          xcode-project use-profiles

          # Build
          BUILD_NAME=$(echo $CM_TAG | sed 's/^v\(.*\)+\(.*\)-mobile-cm$/\1/')
          BUILD_NUMBER=$(echo $CM_TAG | sed 's/^v\(.*\)+\(.*\)-mobile-cm$/\2/')
          flutter build ipa \
            --release \
            --build-name=$BUILD_NAME \
            --build-number=$BUILD_NUMBER \
            --flavor prod \
            --export-options-plist=$HOME/export_options.plist

    artifacts:
      - build/ios/ipa/*.ipa
      - /tmp/xcodebuild_logs/*.log
      - flutter_drive.log
      - $HOME/Library/Developer/Xcode/DerivedData/**/Build/**/*.dSYM
    publishing:
      scripts:
        - name: Upload debug symbols to Firebase Crashlytics
          script: |
            echo "Finding all debug symbol files..."

            # Find all dSYM files in the derived data directory
            dsymFiles=$(find $HOME/Library/Developer/Xcode/DerivedData -name "*.dSYM" -type d 2>/dev/null)

            if [[ -z "$dsymFiles" ]]
            then
              echo "No debug symbols were found, skip publishing to Firebase Crashlytics"
            else
              echo "Found dSYM files:"
              echo "$dsymFiles"
              echo ""

              # Find the upload-symbols script in the Pods directory
              uploadScriptPath=$(find ios/Pods/FirebaseCrashlytics -name "upload-symbols" -type f 2>/dev/null | head -1)

              if [[ -n ${uploadScriptPath} ]]
              then
                echo "Found upload-symbols script at: $uploadScriptPath"
                # Make sure it's executable
                chmod +x "$uploadScriptPath"

                # Upload each dSYM file
                echo "$dsymFiles" | while IFS= read -r dsymPath; do
                  if [[ -n "$dsymPath" ]]; then
                    echo "Uploading dSYM: $dsymPath"
                    "$uploadScriptPath" \
                      -gsp ios/Runner/GoogleService-Info.plist -p ios "$dsymPath"
                    echo "Completed upload for: $dsymPath"
                    echo ""
                  fi
                done

                echo "All dSYM files uploaded successfully"
              else
                echo "upload-symbols script not found. Skipping Firebase Crashlytics upload."
              fi
            fi
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: false
      app_store_connect:
        auth: integration
        submit_to_testflight: true
        beta_groups:
          - Internal
          - Discord Folks
        submit_to_app_store: false

  macos-prod-testflight:
    name: "[DISABLED] Flutter macOS to Testflight (legacy - replaced by omi-desktop-swift-release)"
    instance_type: mac_mini_m2
    max_build_duration: 120
    integrations:
      app_store_connect: codemagic_v4
    environment:
      groups:
        - app_env
        - firebase
        - appstore_credentials
      vars:
        APP_ID: 6502156163
        BUNDLE_ID: "com.friend-app-with-wearable.ios12"
      flutter: 3.35.3
      xcode: 26.0.1
      cocoapods: 1.16.2
    cache:
      cache_paths:
        - $HOME/.pub-cache
        - $HOME/Library/Caches/CocoaPods
    #triggering:
    #  events:
    #    - tag
    #  tag_patterns:
    #    - pattern: "v*-desktop-cm"
    #      include: true
    working_directory: app
    scripts:
      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          # https://github.com/invertase/flutterfire_cli/issues/233
          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="macos" \
            --out=lib/firebase_options_prod.dart \
            --macos-bundle-id=com.friend-app-with-wearable.ios12 \
            --macos-out=macos/Config/Prod \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --macos-target="Runner" \
            --yes

          # DEV, should remove
          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="macos" \
            --out=lib/firebase_options_dev.dart \
            --macos-bundle-id=com.friend-app-with-wearable.ios12.development \
            --macos-out=macos/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --macos-target="Runner" \
            --yes

      - name: Set up Google Service Info
        script: |
          # Copy GoogleService-Info.plist
          cp macos/Config/Prod/GoogleService-Info.plist macos/GoogleService-Info.plist

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_IOS_API_KEY=$INTERCOM_IOS_API_KEY >> .env
          echo POSTHOG_API_KEY=$POSTHOG_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env

      - name: Get Flutter packages
        script: |
          flutter pub get

      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs

      - name: Install pods
        script: |
          cd macos && pod install --repo-update

      - name: Set up keychain for code signing
        script: |
          keychain initialize

      - name: Fetch signing files
        script: |
          app-store-connect fetch-signing-files "$BUNDLE_ID" \
            --platform MAC_OS \
            --type MAC_APP_STORE \
            --create

      - name: Fetch Mac Installer Distribution certificates
        script: |
          # Try to find an existing certificate with our private key
          echo "Checking for existing Mac Installer Distribution certificate with our private key..."
          if app-store-connect certificates list --type MAC_INSTALLER_DISTRIBUTION --save 2>&1 | grep -q "Saved Signing Certificate"; then
            echo "Found existing certificate with matching private key"
          else
            echo "No matching certificate found, creating new one for Codemagic..."
            app-store-connect certificates create --type MAC_INSTALLER_DISTRIBUTION --save
          fi

      - name: Add certificates to keychain
        script: |
          keychain add-certificates

      - name: Set up code signing settings
        script: |
          xcode-project use-profiles

      - name: Flutter build macOS
        script: |
          # Build
          BUILD_NAME=$(echo $CM_TAG | sed 's/^v\(.*\)+\(.*\)-desktop-cm$/\1/')
          BUILD_NUMBER=$(echo $CM_TAG | sed 's/^v\(.*\)+\(.*\)-desktop-cm$/\2/')
          flutter build macos \
            --release \
            --build-name=$BUILD_NAME \
            --build-number=$BUILD_NUMBER \
            --flavor prod

      - name: Package application for App Store
        script: |
          set -x

          # Find the app bundle
          APP_NAME=$(find $(pwd) -name "Omi.app" | head -1)
          echo "Found app at: $APP_NAME"

          # Set output directory
          OUTPUT_DIR="$(pwd)/build/macos"
          mkdir -p "$OUTPUT_DIR"

          # Create unsigned package
          PACKAGE_NAME="Omi.pkg"
          xcrun productbuild --component "$APP_NAME" /Applications/ "$OUTPUT_DIR/unsigned.pkg"

          # Find the installer certificate common name in keychain
          INSTALLER_CERT_NAME=$(keychain list-certificates \
            | jq -r '.[] | select(.common_name | contains("3rd Party Mac Developer Installer")) | .common_name' \
            | head -1)

          if [ -z "$INSTALLER_CERT_NAME" ]; then
            echo "ERROR: No Mac Installer Distribution certificate found"
            echo "Available certificates:"
            keychain list-certificates | jq -r '.[].common_name'
            exit 1
          fi

          echo "Using installer certificate: $INSTALLER_CERT_NAME"

          # Sign the package
          xcrun productsign --sign "$INSTALLER_CERT_NAME" "$OUTPUT_DIR/unsigned.pkg" "$OUTPUT_DIR/$PACKAGE_NAME"

          # Clean up
          rm -f "$OUTPUT_DIR/unsigned.pkg"

          echo "Package created at: $OUTPUT_DIR/$PACKAGE_NAME"

    artifacts:
      - build/macos/*.pkg
      - build/macos/**/*.app
    publishing:
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: false
      app_store_connect:
        auth: integration
        submit_to_testflight: true
        beta_groups:
          - Internal
          - Discord Folks
        submit_to_app_store: false

  android-prod-internal:
    name: Release Android Internal Production
    instance_type: mac_mini_m2
    max_build_duration: 120
    environment:
      android_signing:
        - prod_android_upload_keystore
      groups:
        - app_env
        - firebase
        - google_play
        - shorebird
      vars:
        PACKAGE_NAME: "com.friend.ios"
        JAVA_TOOL_OPTIONS: "-Xmx8g"
      flutter: 3.35.3
      xcode: 16.4
      cocoapods: 1.16.2
      java: 21
    cache:
      cache_paths:
        - $HOME/opt
        - $HOME/.pub-cache
        - $HOME/.gradle/caches
    triggering:
      events:
        - tag
      tag_patterns:
        - pattern: "v*-android-cm"
          include: true
        - pattern: "v*-mobile-cm"
          include: true
    working_directory: app
    scripts:
      - name: Installing Android SDK
        script: |
          export ANDROID_HOME="$HOME/opt/android-sdk"
          if [ ! -d "$ANDROID_HOME" ]; then
            echo "$ANDROID_HOME does not exist. Installing..."

            mkdir -p $ANDROID_HOME

            # Install cmdline-tools 11076708; NDK: 28.2.13676358
            cd "$HOME/opt" && \
            curl --fail --show-error --silent --connect-timeout 10.00 --max-time 120.00 \
              --output commandlinetools-mac-11076708_latest.zip \
              https://dl.google.com/android/repository/commandlinetools-mac-11076708_latest.zip && \
            7z -bd x commandlinetools-mac-11076708_latest.zip && \
            mkdir -p $ANDROID_HOME && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "tools" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "cmdline-tools;latest" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "ndk;28.2.13676358" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} --licenses  && \
            cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} --list
          fi

          if [ -d "$ANDROID_HOME" ]; then
            echo "$ANDROID_HOME does exist. Setting up env..."

            # PATH
            export PATH=$PATH:$ANDROID_HOME/tools:$ANDROID_HOME/tools/bin:$ANDROID_HOME/platform-tools

            # Override ENV
            echo ANDROID_HOME="$ANDROID_HOME" >> $CM_ENV
            echo ANDROID_SDK_ROOT="$ANDROID_HOME" >> $CM_ENV
            echo PATH="$PATH" >> $CM_ENV
          fi

      - name: Installing Opus
        script: |
          brew install opus
          brew install opus-tools

      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          # https://github.com/invertase/flutterfire_cli/issues/233
          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_prod.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12 \
            --android-package-name=com.friend.ios \
            --android-out=android/app/src/prod/  \
            --ios-out=ios/Config/Prod/ \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --ios-target="Runner" \
            --yes

          # DEV, should remove
          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_dev.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12.development \
            --android-package-name=com.friend.ios.dev \
            --android-out=android/app/src/dev/  \
            --ios-out=ios/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --ios-target="Runner" \
            --yes

      - name: Set up local.properties
        script: |
          echo "flutter.sdk=$HOME/programs/flutter" > "$(pwd)/android/local.properties"
          echo "sdk.dir=$ANDROID_HOME" >> "$(pwd)/android/local.properties"

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_ANDROID_API_KEY=$INTERCOM_ANDROID_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env

      - name: Get Flutter packages
        script: |
          flutter packages pub get
      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs
      - name: Build AAB with Flutter
        script: |
          # TODO: Don't tricky
          # Tricky Opus > build.gradle, force use NDK 28 to deal with "ERROR: Unknown host CPU architecture: arm64 and 16kb memory page size support"
          # echo "Z3JvdXAgJ2V1LmVwbncub3B1c19mbHV0dGVyX2FuZHJvaWQnDQp2ZXJzaW9uICcxLjAnDQoNCmJ1aWxkc2NyaXB0IHsNCiAgICByZXBvc2l0b3JpZXMgew0KICAgICAgICBnb29nbGUoKQ0KICAgICAgICBtYXZlbkNlbnRyYWwoKQ0KICAgIH0NCg0KICAgIGRlcGVuZGVuY2llcyB7DQogICAgICAgIGNsYXNzcGF0aCAnY29tLmFuZHJvaWQudG9vbHMuYnVpbGQ6Z3JhZGxlOjcuMy4wJw0KICAgIH0NCn0NCg0Kcm9vdFByb2plY3QuYWxscHJvamVjdHMgew0KICAgIHJlcG9zaXRvcmllcyB7DQogICAgICAgIGdvb2dsZSgpDQogICAgICAgIG1hdmVuQ2VudHJhbCgpDQogICAgfQ0KfQ0KDQphcHBseSBwbHVnaW46ICdjb20uYW5kcm9pZC5saWJyYXJ5Jw0KDQphbmRyb2lkIHsNCiAgICBpZiAocHJvamVjdC5hbmRyb2lkLmhhc1Byb3BlcnR5KCJuYW1lc3BhY2UiKSkgew0KICAgICAgICBuYW1lc3BhY2UgJ2V1LmVwbncub3B1c19mbHV0dGVyX2FuZHJvaWQnDQogICAgfQ0KDQogICAgY29tcGlsZVNka1ZlcnNpb24gMzMNCg0KICAgIGNvbXBpbGVPcHRpb25zIHsNCiAgICAgICAgc291cmNlQ29tcGF0aWJpbGl0eSBKYXZhVmVyc2lvbi5WRVJTSU9OXzFfOA0KICAgICAgICB0YXJnZXRDb21wYXRpYmlsaXR5IEphdmFWZXJzaW9uLlZFUlNJT05fMV84DQogICAgfQ0KDQogICAgZGVmYXVsdENvbmZpZyB7DQogICAgICAgIG1pblNka1ZlcnNpb24gMTkNCiAgICB9DQogICAgZXh0ZXJuYWxOYXRpdmVCdWlsZCB7DQogICAgICAgIG5ka0J1aWxkew0KICAgICAgICAgICAgcGF0aCAiQW5kcm9pZC5tayINCiAgICAgICAgfQ0KICAgIH0NCg0KICAgIGRlcGVuZGVuY2llcyB7DQogICAgICAgIHRlc3RJbXBsZW1lbnRhdGlvbiAnanVuaXQ6anVuaXQ6NC4xMy4yJw0KICAgICAgICB0ZXN0SW1wbGVtZW50YXRpb24gJ29yZy5tb2NraXRvOm1vY2tpdG8tY29yZTo1LjAuMCcNCiAgICB9DQoNCiAgICB0ZXN0T3B0aW9ucyB7DQogICAgICAgIHVuaXRUZXN0cy5hbGwgew0KICAgICAgICAgICAgdGVzdExvZ2dpbmcgew0KICAgICAgICAgICAgICAgZXZlbnRzICJwYXNzZWQiLCAic2tpcHBlZCIsICJmYWlsZWQiLCAic3RhbmRhcmRPdXQiLCAic3RhbmRhcmRFcnJvciINCiAgICAgICAgICAgICAgIG91dHB1dHMudXBUb0RhdGVXaGVuIHtmYWxzZX0NCiAgICAgICAgICAgICAgIHNob3dTdGFuZGFyZFN0cmVhbXMgPSB0cnVlDQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQogICAgbmRrVmVyc2lvbiAnMjcuMC4xMjA3Nzk3MycNCn0NCg==" | base64 -d > "$HOME/.pub-cache/hosted/pub.dev/opus_flutter_android-3.0.1/android/build.gradle"

          # Should use bump version automatically by CI
          BUILD_NAME=$(echo $CM_TAG | sed 's/^v\(.*\)+\(.*\)-mobile-cm$/\1/')
          BUILD_NUMBER=$(echo $CM_TAG | sed 's/^v\(.*\)+\(.*\)-mobile-cm$/\2/')
          flutter build appbundle \
            --release \
            --build-name=$BUILD_NAME \
            --build-number=$BUILD_NUMBER \
            --flavor prod


    artifacts:
      - build/**/outputs/**/*.aab
      - flutter_drive.log
    publishing:
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: false
      google_play:
        credentials: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        track: "internal"
        submit_as_draft: false
        release_promotion:
          track: "alpha"

  ios-prod-patch:
    name: Patch iOS to Production
    instance_type: mac_mini_m2
    max_build_duration: 120
    integrations:
      app_store_connect: codemagic_v4
    environment:
      ios_signing:
        provisioning_profiles:
          - codemagic_v4
          - codemagic_watchos_v4
        certificates:
          - codemagic_v4
      groups:
        - app_env
        - firebase
        - shorebird
      vars:
        APP_ID: 6502156163
      flutter: 3.35.3
      xcode: 16.4
      cocoapods: 1.16.2
    cache:
      cache_paths:
        - $HOME/.pub-cache
        - $HOME/.gradle/caches
        - $HOME/Library/Caches/CocoaPods
    triggering:
      events:
        - tag
      tag_patterns:
        - pattern: "v*-ios-patch-cm"
          include: true
        - pattern: "v*-mobile-patch-cm"
          include: true
    working_directory: app
    scripts:
      - name: Installing Shorebird
        script: |
          # Install the Shorebird CLI
          curl --proto '=https' --tlsv1.2 https://raw.githubusercontent.com/shorebirdtech/install/main/install.sh -sSf | bash
          # Set Shorebird PATH
          echo PATH="/Users/builder/.shorebird/bin:$PATH" >> $CM_ENV

      - name: Installing Opus
        script: |
          brew install opus
          brew install opus-tools

      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          # https://github.com/invertase/flutterfire_cli/issues/233
          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_prod.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12 \
            --android-package-name=com.friend.ios \
            --android-out=android/app/src/prod/  \
            --ios-out=ios/Config/Prod/ \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --ios-target="Runner" \
            --yes

          # DEV, should remove
          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_dev.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12.development \
            --android-package-name=com.friend.ios.dev \
            --android-out=android/app/src/dev/  \
            --ios-out=ios/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --ios-target="Runner" \
            --yes

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_IOS_API_KEY=$INTERCOM_IOS_API_KEY >> .env
          echo POSTHOG_API_KEY=$POSTHOG_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env

      - name: Set up Google Service Info
        script: |
          # TODO: check why we need this ?
          echo "$GOOGLE_INFO_PLIST_KEY" > "$(pwd)/ios/Runner/GoogleService-Info.plist"

      - name: Get Flutter packages
        script: |
          flutter pub get

      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs

      - name: Installs pod
        script: |
          cd ios && pod install --repo-update

      - name: Patch iOS app with Shorebird
        script: |
          # Set up code signing settings on Xcode project
          # -> $HOME/export_options.plist
          xcode-project use-profiles

          # Build
          shorebird patch ios \
            --flavor prod -- \
            --export-options-plist=$HOME/export_options.plist
    artifacts:
      - build/ios/ipa/*.ipa
      - /tmp/xcodebuild_logs/*.log
      - flutter_drive.log
    publishing:
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: false

  macos-desktop-release:
    name: "[DISABLED] Flutter macOS Desktop Release (legacy - replaced by omi-desktop-swift-release)"
    instance_type: mac_mini_m2
    max_build_duration: 120
    integrations:
      app_store_connect: codemagic_v4
    environment:
      groups:
        - app_env
        - firebase
        - appstore_credentials
      vars:
        PLATFORM: "macos"
        BUNDLE_ID: "com.friend-app-with-wearable.ios12"
      flutter: 3.35.3
      xcode: 26.0.1
      cocoapods: 1.16.2
    cache:
      cache_paths:
        - $HOME/.pub-cache
        - $HOME/Library/Caches/CocoaPods
    # DISABLED: Triggering removed — replaced by omi-desktop-swift-release workflow
    working_directory: app
    scripts:
      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          # https://github.com/invertase/flutterfire_cli/issues/233
          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="macos" \
            --out=lib/firebase_options_prod.dart \
            --macos-bundle-id=com.friend-app-with-wearable.ios12 \
            --macos-out=macos/Config/Prod \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --macos-target="Runner" \
            --yes

          # DEV, should remove
          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="macos" \
            --out=lib/firebase_options_dev.dart \
            --macos-bundle-id=com.friend-app-with-wearable.ios12.development \
            --macos-out=macos/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --macos-target="Runner" \
            --yes

      - name: Set up Google Service Info
        script: |
          # Copy GoogleService-Info.plist
          cp macos/Config/Prod/GoogleService-Info.plist macos/GoogleService-Info.plist

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_IOS_API_KEY=$INTERCOM_IOS_API_KEY >> .env
          echo POSTHOG_API_KEY=$POSTHOG_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env
          echo GEMINI_API_KEY=$GEMINI_API_KEY >> .env

      - name: Extract version (from tag or auto-increment)
        script: |
          # Check if triggered by tag or push
          if [ -n "$CM_TAG" ]; then
            # Tag-triggered: extract version from tag (supports both -desktop-cm and -macos-cm)
            echo "Triggered by tag: $CM_TAG"
            BUILD_NAME=$(echo $CM_TAG | sed -E 's/^v([0-9.]+)\+([0-9]+)-(desktop|macos)-cm$/\1/')
            BUILD_NUMBER=$(echo $CM_TAG | sed -E 's/^v([0-9.]+)\+([0-9]+)-(desktop|macos)-cm$/\2/')
            TAG_NAME="$CM_TAG"
          else
            # Push-triggered: extract version from pubspec and auto-increment build number
            echo "Triggered by push to main, auto-incrementing build number..."

            # Extract version name from pubspec.yaml (source of truth)
            PUBSPEC_VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //' | tr -d ' ')
            BUILD_NAME=$(echo "$PUBSPEC_VERSION" | cut -d'+' -f1)  # e.g., "1.0.78"

            # Get latest build number from GitHub releases for desktop tags and increment
            LATEST_BUILD=$(gh release list --repo BasedHardware/omi --limit 100 | grep -E 'desktop-cm|macos-cm|desktop-auto' | head -1 | grep -oE '\+[0-9]+' | tr -d '+' || echo "0")
            if [ -z "$LATEST_BUILD" ] || [ "$LATEST_BUILD" = "0" ]; then
              # Fallback: try to get build number from release title format "Omi Desktop vX.X.X (BUILD_NUM)"
              LATEST_BUILD=$(gh release list --repo BasedHardware/omi --limit 100 | grep -i 'desktop\|macos' | head -1 | grep -oE '\([0-9]+\)' | tr -d '()' || echo "0")
            fi
            if [ -z "$LATEST_BUILD" ]; then
              LATEST_BUILD=0
            fi
            BUILD_NUMBER=$((LATEST_BUILD + 1))
            TAG_NAME="v${BUILD_NAME}+${BUILD_NUMBER}-desktop-auto"
          fi

          echo "Building macOS with version $BUILD_NAME ($BUILD_NUMBER)"

          # Export to environment for all subsequent steps
          echo BUILD_NAME="$BUILD_NAME" >> $CM_ENV
          echo BUILD_NUMBER="$BUILD_NUMBER" >> $CM_ENV
          echo VERSION="${BUILD_NAME}+${BUILD_NUMBER}" >> $CM_ENV
          echo TAG_NAME="$TAG_NAME" >> $CM_ENV

      - name: Get Flutter packages
        script: |
          flutter pub get

      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs

      - name: Install pods
        script: |
          cd macos && pod install --repo-update

      - name: Download Omi Computer app for bundling
        script: |
          # Get latest Omi Computer release (Swift app) to bundle into Flutter app
          echo "Looking for latest Omi Computer release..."
          LATEST_MACOS_TAG=$(gh release list --repo BasedHardware/omi --limit 50 | grep -E '\-macos\s' | head -1 | awk -F'\t' '{print $3}')

          if [ -n "$LATEST_MACOS_TAG" ]; then
            echo "Downloading Omi Computer from release: $LATEST_MACOS_TAG"

            # Create directory where bundle_helper.sh expects to find the app
            # bundle_helper.sh looks at: $PROJECT_DIR/../../../omi-desktop/build/
            # PROJECT_DIR = /path/clone/app/macos
            # ../../../omi-desktop = /path/omi-desktop (sibling to clone dir)
            # From working_directory (app/), that's ../../omi-desktop
            mkdir -p ../../omi-desktop/build

            # Download the signed app ZIP from GitHub releases
            gh release download "$LATEST_MACOS_TAG" \
              --repo BasedHardware/omi \
              --pattern "Omi.zip" \
              --dir /tmp

            # Extract - the ZIP contains "Omi Computer.app"
            unzip -o /tmp/Omi.zip -d ../../omi-desktop/build/

            # Verify extraction
            if [ -d "../../omi-desktop/build/Omi Computer.app" ]; then
              echo "SUCCESS: Omi Computer app ready for bundling"
              ls -la "../../omi-desktop/build/"
            else
              echo "WARNING: Extraction may have failed, checking contents..."
              ls -la ../../omi-desktop/build/
            fi
          else
            echo "WARNING: No Omi Computer release found with -macos tag"
            echo "The Flutter app will be built without bundled Omi Computer"
          fi

      - name: Verify Sparkle signing key
        script: |
          if [ -z "$SPARKLE_PRIVATE_KEY" ]; then
            echo "ERROR: SPARKLE_PRIVATE_KEY environment variable not set"
            exit 1
          fi

      - name: Clean up entitlements (this step can be removed once we move away from AppStore)
        script: |
          # Process all Release entitlements files (including -prod variants)
          find macos -name "*Release*.entitlements" -type f | while read entitlements_file; do
            # Remove Sign in with Apple (if present)
            grep -q "applesignin" "$entitlements_file" 2>/dev/null && \
              /usr/libexec/PlistBuddy -c "Delete :com.apple.developer.applesignin" "$entitlements_file" 2>/dev/null || true

            # Remove App Sandbox (if present)
            grep -q "com.apple.security.app-sandbox" "$entitlements_file" 2>/dev/null && \
              /usr/libexec/PlistBuddy -c "Delete :com.apple.security.app-sandbox" "$entitlements_file" 2>/dev/null || true

            # Remove get-task-allow (debug-only, blocks notarization)
            /usr/libexec/PlistBuddy -c "Delete :com.apple.security.get-task-allow" "$entitlements_file" 2>/dev/null || true

            # Add hardened runtime entitlements
            /usr/libexec/PlistBuddy -c "Set :com.apple.security.cs.allow-jit bool true" "$entitlements_file" 2>/dev/null || \
              /usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.allow-jit bool true" "$entitlements_file" 2>/dev/null || true
            /usr/libexec/PlistBuddy -c "Set :com.apple.security.cs.allow-unsigned-executable-memory bool true" "$entitlements_file" 2>/dev/null || \
              /usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.allow-unsigned-executable-memory bool true" "$entitlements_file" 2>/dev/null || true
            /usr/libexec/PlistBuddy -c "Set :com.apple.security.cs.disable-library-validation bool true" "$entitlements_file" 2>/dev/null || \
              /usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" "$entitlements_file" 2>/dev/null || true
          done

      - name: Set up keychain and import Developer ID certificate
        script: |
          # Initialize keychain
          keychain initialize

          # Import Developer ID Application certificate
          echo "$MACOS_DEVELOPER_ID_P12" | base64 --decode > /tmp/developer_id.p12

          KEYCHAIN_PATH=$(keychain get-default)

          security import /tmp/developer_id.p12 \
            -k "$KEYCHAIN_PATH" \
            -P "${MACOS_DEVELOPER_ID_P12_PASSWORD:-}" \
            -T /usr/bin/codesign \
            -T /usr/bin/security

          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" "$KEYCHAIN_PATH" 2>/dev/null || true

          rm /tmp/developer_id.p12

          # Find and export the Developer ID cert name
          DEVELOPER_ID_CERT=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')

          if [ -z "$DEVELOPER_ID_CERT" ]; then
            echo "ERROR: No Developer ID Application certificate found!"
            exit 1
          fi

          echo "DEVELOPER_ID_CERT=$DEVELOPER_ID_CERT" >> $CM_ENV

      - name: Install Developer ID provisioning profile
        script: |
          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"

          # Decode and save the provisioning profile
          echo "$MACOS_DEVELOPER_ID_PROFILE" | base64 --decode > /tmp/developer_id.provisionprofile

          # Extract the plist from the CMS-signed provisioning profile
          security cms -D -i /tmp/developer_id.provisionprofile > /tmp/profile.plist

          # Get the profile UUID
          PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print :UUID" /tmp/profile.plist)

          # Now install it with the UUID as the filename (this is what Xcode expects)
          cp /tmp/developer_id.provisionprofile "$HOME/Library/MobileDevice/Provisioning Profiles/$PROFILE_UUID.provisionprofile"

          # Export UUID for later use
          echo "PROFILE_UUID=$PROFILE_UUID" >> $CM_ENV

      - name: Configure Xcode project for Developer ID signing
        script: |
          cd macos

          # Use Codemagic's xcode-project tool to configure manual signing
          xcode-project use-profiles \
            --project Runner.xcodeproj \
            --code-signing-setup-verbose-logging

          cd ..

      - name: Flutter build macOS
        script: |
          # Build with release configuration using Developer ID certificate and provisioning profile
          export CODE_SIGN_STYLE=Manual
          export CODE_SIGN_IDENTITY="$DEVELOPER_ID_CERT"
          export DEVELOPMENT_TEAM=9536L8KLMP
          export PROVISIONING_PROFILE_SPECIFIER="$PROFILE_UUID"

          flutter build macos \
            --release \
            --build-name=$BUILD_NAME \
            --build-number=$BUILD_NUMBER \
            --flavor prod

      - name: Bundle .env into app
        script: |
          # Copy .env file into app bundle for native Swift code to access
          APP_PATH=$(find $(pwd)/build/macos -name "Omi.app" -type d | head -1)
          cp .env "$APP_PATH/Contents/Resources/.env"
          echo "Bundled .env into $APP_PATH/Contents/Resources/.env"

      - name: Sign app for notarization
        script: |
          # Find the built app
          APP_PATH=$(find $(pwd)/build/macos -name "Omi.app" -type d | head -1)

          # Create hardened runtime entitlements for notarization
          cat > /tmp/notarization.entitlements << 'ENTITLEMENTS_EOF'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>com.apple.security.cs.allow-jit</key>
            <true/>
            <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
            <true/>
            <key>com.apple.security.cs.disable-library-validation</key>
            <true/>
            <key>com.apple.security.device.audio-input</key>
            <true/>
            <key>com.apple.security.device.bluetooth</key>
            <true/>
            <key>com.apple.security.network.client</key>
            <true/>
            <key>com.apple.security.network.server</key>
            <true/>
            <key>com.apple.security.personal-information.calendars</key>
            <true/>
            <key>com.apple.security.files.user-selected.read-only</key>
            <true/>
            <key>com.apple.developer.aps-environment</key>
            <string>production</string>
            <key>keychain-access-groups</key>
            <array>
              <string>9536L8KLMP.com.google.GIDSignIn</string>
              <string>9536L8KLMP.com.friend-app-with-wearable.ios12</string>
            </array>
          </dict>
          </plist>
          ENTITLEMENTS_EOF

          # Sign ALL embedded frameworks FIRST (REQUIRED when re-signing app with --force)
          # Sign embedded frameworks
          find "$APP_PATH/Contents/Frameworks" -name "*.framework" -type d -print0 | while IFS= read -r -d '' framework; do
            codesign --force --timestamp --options runtime \
              --sign "$DEVELOPER_ID_CERT" \
              "$framework"
          done

          # Sign any dylibs
          find "$APP_PATH" -name "*.dylib" -type f -print0 | while IFS= read -r -d '' dylib; do
            codesign --force --timestamp --options runtime \
              --sign "$DEVELOPER_ID_CERT" \
              "$dylib"
          done

          # Sign bundled Omi Computer.app (if present)
          # The bundled app was signed with a different cert, must re-sign with our Developer ID
          BUNDLED_APP="$APP_PATH/Contents/MacOS/Omi Computer.app"
          if [ -d "$BUNDLED_APP" ]; then
            echo "Signing bundled Omi Computer.app..."
            # Sign all nested code first
            find "$BUNDLED_APP" -name "*.framework" -type d | while read fw; do
              codesign --force --timestamp --options runtime \
                --sign "$DEVELOPER_ID_CERT" "$fw"
            done
            find "$BUNDLED_APP" -name "*.dylib" -type f | while read lib; do
              codesign --force --timestamp --options runtime \
                --sign "$DEVELOPER_ID_CERT" "$lib"
            done
            # Sign the bundled app itself
            codesign --force --timestamp --options runtime \
              --sign "$DEVELOPER_ID_CERT" \
              "$BUNDLED_APP"
            echo "Bundled Omi Computer.app signed"
          fi

          # Sign Sparkle framework and its components first
          SPARKLE_FW="$APP_PATH/Contents/Frameworks/Sparkle.framework"

          if [ -d "$SPARKLE_FW" ]; then
            # Sign XPC services
            find "$SPARKLE_FW" -name "*.xpc" -type d | while read xpc; do
              codesign --force --timestamp --options runtime \
                --sign "$DEVELOPER_ID_CERT" \
                "$xpc"
            done

            # Sign Updater.app
            [ -d "$SPARKLE_FW/Versions/B/Updater.app" ] && \
              codesign --force --timestamp --options runtime \
                --sign "$DEVELOPER_ID_CERT" \
                "$SPARKLE_FW/Versions/B/Updater.app"

            # Sign Autoupdate binary
            [ -f "$SPARKLE_FW/Versions/B/Autoupdate" ] && \
              codesign --force --timestamp --options runtime \
                --sign "$DEVELOPER_ID_CERT" \
                "$SPARKLE_FW/Versions/B/Autoupdate"

            # Sign the framework itself
            codesign --force --timestamp --options runtime \
              --sign "$DEVELOPER_ID_CERT" \
              "$SPARKLE_FW"
          fi

          # Sign the app bundle with --force to update entitlements
          codesign --force --timestamp --options runtime \
            --sign "$DEVELOPER_ID_CERT" \
            --entitlements /tmp/notarization.entitlements \
            "$APP_PATH"

          # Verify no get-task-allow entitlement (blocks notarization)
          if codesign -d --entitlements :- "$APP_PATH" 2>&1 | grep -q "get-task-allow"; then
            echo "ERROR: get-task-allow entitlement found"
            exit 1
          fi

      - name: Notarize app
        script: |
          set -e

          APP_PATH=$(find $(pwd)/build/macos -name "Omi.app" -type d | head -1)
          APP_ZIP="build/macos/Omi.zip"
          ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$APP_ZIP"

          # Check if private key is a file or content
          if [[ "$APP_STORE_CONNECT_PRIVATE_KEY" == /* ]] || [[ "$APP_STORE_CONNECT_PRIVATE_KEY" == @file:* ]]; then
            PRIVATE_KEY_PATH="${APP_STORE_CONNECT_PRIVATE_KEY#@file:}"
          else
            mkdir -p ~/private_keys
            PRIVATE_KEY_PATH=~/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_IDENTIFIER}.p8
            echo -e "$APP_STORE_CONNECT_PRIVATE_KEY" > "$PRIVATE_KEY_PATH"
          fi

          RESULT=$(xcrun notarytool submit "$APP_ZIP" \
            --key "$PRIVATE_KEY_PATH" \
            --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
            --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
            --wait \
            --output-format json)

          SUBMISSION_ID=$(echo "$RESULT" | jq -r '.id')
          STATUS=$(echo "$RESULT" | jq -r '.status')

          if [ "$STATUS" != "Accepted" ]; then
            echo "Notarization failed"
            xcrun notarytool log "$SUBMISSION_ID" \
              --key "$PRIVATE_KEY_PATH" \
              --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
              --issuer "$APP_STORE_CONNECT_ISSUER_ID"
            exit 1
          fi

          xcrun stapler staple "$APP_PATH"

      - name: Install create-dmg
        script: |
          brew install create-dmg

      - name: Create DMG installer
        script: |
          set -e
          APP_PATH=$(find $(pwd)/build/macos -name "Omi.app" -type d | head -1)

          mkdir -p build/macos/dmg
          DMG_NAME="Omi.dmg"
          DMG_PATH="build/macos/dmg/${DMG_NAME}"

          # Create professional DMG with Applications folder shortcut
          # Use --skip-jenkins to avoid AppleScript timeout issues in CI
          create-dmg \
            --volname "Omi ${VERSION}" \
            --volicon "$APP_PATH/Contents/Resources/prodAppIcon.icns" \
            --window-pos 200 120 \
            --window-size 660 400 \
            --icon-size 130 \
            --text-size 16 \
            --icon "Omi.app" 180 180 \
            --hide-extension "Omi.app" \
            --app-drop-link 480 180 \
            --no-internet-enable \
            --skip-jenkins \
            "$DMG_PATH" \
            "$APP_PATH"

          # Sign DMG
          codesign --force --sign "$DEVELOPER_ID_CERT" "$DMG_PATH"
          codesign --verify --verbose "$DMG_PATH"

      - name: Notarize DMG
        script: |
          set -e

          DMG_PATH=$(find build/macos/dmg -name "Omi.dmg" | head -1)

          # Check if private key is a file or content
          if [[ "$APP_STORE_CONNECT_PRIVATE_KEY" == /* ]] || [[ "$APP_STORE_CONNECT_PRIVATE_KEY" == @file:* ]]; then
            PRIVATE_KEY_PATH="${APP_STORE_CONNECT_PRIVATE_KEY#@file:}"
          else
            mkdir -p ~/private_keys
            PRIVATE_KEY_PATH=~/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_IDENTIFIER}.p8
            echo -e "$APP_STORE_CONNECT_PRIVATE_KEY" > "$PRIVATE_KEY_PATH"
          fi

          RESULT=$(xcrun notarytool submit "$DMG_PATH" \
            --key "$PRIVATE_KEY_PATH" \
            --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
            --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
            --wait \
            --output-format json)

          SUBMISSION_ID=$(echo "$RESULT" | jq -r '.id')
          STATUS=$(echo "$RESULT" | jq -r '.status')

          if [ "$STATUS" != "Accepted" ]; then
            echo "DMG notarization failed"
            xcrun notarytool log "$SUBMISSION_ID" \
              --key "$PRIVATE_KEY_PATH" \
              --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
              --issuer "$APP_STORE_CONNECT_ISSUER_ID"
            exit 1
          fi

          xcrun stapler staple "$DMG_PATH"

      - name: Create and sign Sparkle-compatible ZIP
        script: |
          APP_PATH="$(pwd)/build/macos/Build/Products/Release-prod/Omi.app"

          ZIP_NAME="Omi.zip"
          DIST_DIR="dist/${VERSION}-macos"
          APP_DIR=$(pwd)

          mkdir -p "$DIST_DIR"

          # Create ZIP that Sparkle can use
          cd "$(dirname "$APP_PATH")"
          ditto -c -k --sequesterRsrc --keepParent "Omi.app" "$(pwd)/$ZIP_NAME"
          mv "$ZIP_NAME" "$APP_DIR/$DIST_DIR/"

          # Sign the ZIP file for Sparkle
          cd "$APP_DIR"

          [ ! -f "macos/Pods/Sparkle/bin/sign_update" ] && echo "ERROR: Sparkle sign_update binary not found" && exit 1

          # Sign using Sparkle's sign_update with private key from environment variable
          SIGN_OUTPUT=$(echo "$SPARKLE_PRIVATE_KEY" | macos/Pods/Sparkle/bin/sign_update --ed-key-file - "$DIST_DIR/$ZIP_NAME" 2>&1)

          # Extract the signature value
          SIGNATURE=$(echo "$SIGN_OUTPUT" | grep -oE 'sparkle:edSignature="[^"]+"' | sed 's/sparkle:edSignature="//;s/"$//')

          if [ -z "$SIGNATURE" ]; then
            echo "ERROR: Failed to extract signature"
            echo "Output: $SIGN_OUTPUT"
            exit 1
          fi

          echo "$SIGNATURE" > "$DIST_DIR/signature.txt"

      - name: Create GitHub Release
        script: |
          # Get the recent commits for changelog
          PREVIOUS_TAG=$(git describe --tags --abbrev=0 ${TAG_NAME}^ 2>/dev/null || echo "")

          if [ -n "$PREVIOUS_TAG" ]; then
            CHANGELOG=$(git log --pretty=format:"* %s" $PREVIOUS_TAG..$TAG_NAME | grep -v "Merge" | head -20)
          else
            CHANGELOG=$(git log --pretty=format:"* %s" -10 | grep -v "Merge")
          fi

          # Read the EdDSA signature for Sparkle
          SIGNATURE=$(cat "dist/${VERSION}-${PLATFORM}/signature.txt" 2>/dev/null || echo "")

          # Create release notes
          cat > /tmp/release_notes.md <<EOF
          ## What's Changed

          $CHANGELOG

          **Full Changelog**: https://github.com/BasedHardware/omi/compare/${PREVIOUS_TAG}...${TAG_NAME}

          <!-- KEY_VALUE_START
          changelog: macOS desktop app update | Bug fixes and improvements | Performance enhancements
          mandatory: false
          minimum_app_version: 1.0.70
          isLive: true
          edSignature: $SIGNATURE
          KEY_VALUE_END -->
          EOF

          # Find the DMG file
          DMG_FILE=$(find build/macos/dmg -name "Omi.dmg" | head -1)

          # Find the Sparkle ZIP and signature files
          SPARKLE_ZIP="dist/${VERSION}-${PLATFORM}/Omi.zip"
          SIGNATURE_FILE="dist/${VERSION}-${PLATFORM}/signature.txt"

          # Create GitHub release with DMG, Sparkle ZIP, and signature attachments
          if [ -f "$DMG_FILE" ]; then
            # Create the release with the DMG first
            gh release create "$TAG_NAME" \
              --title "Omi Desktop v${BUILD_NAME} (${BUILD_NUMBER})" \
              --notes-file /tmp/release_notes.md \
              --repo BasedHardware/omi \
              "$DMG_FILE"

            # Upload Sparkle ZIP if it exists
            if [ -f "$SPARKLE_ZIP" ]; then
              echo "Uploading Sparkle ZIP: $SPARKLE_ZIP"
              gh release upload "$TAG_NAME" \
                "$SPARKLE_ZIP" \
                --repo BasedHardware/omi \
                --clobber
            else
              echo "WARNING: Sparkle ZIP not found at $SPARKLE_ZIP"
            fi

            # Upload signature file if it exists
            if [ -f "$SIGNATURE_FILE" ]; then
              echo "Uploading signature file: $SIGNATURE_FILE"
              gh release upload "$TAG_NAME" \
                "$SIGNATURE_FILE" \
                --repo BasedHardware/omi \
                --clobber
            else
              echo "WARNING: Signature file not found at $SIGNATURE_FILE"
            fi
          else
            echo "ERROR: DMG file not found"
            exit 1
          fi

    artifacts:
      - dist/**/*
      - build/macos/**/*.app
      - build/macos/dmg/*.dmg
    publishing:
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: false

  android-prod-patch:
    name: Patch Android to Production
    instance_type: mac_mini_m2
    max_build_duration: 120
    environment:
      android_signing:
        - prod_android_upload_keystore
      groups:
        - app_env
        - firebase
        - shorebird
      vars:
        PACKAGE_NAME: "com.friend.ios"
      flutter: 3.35.3
      xcode: 16.4
      cocoapods: 1.16.2
      java: 21
    cache:
      cache_paths:
        - $HOME/opt
        - $HOME/.pub-cache
        - $HOME/.gradle/caches
    triggering:
      events:
        - tag
      tag_patterns:
        - pattern: "v*-android-patch-cm"
          include: true
        - pattern: "v*-mobile-patch-cm"
          include: true
    working_directory: app
    scripts:
      - name: Installing Shorebird
        script: |
          # Install the Shorebird CLI
          curl --proto '=https' --tlsv1.2 https://raw.githubusercontent.com/shorebirdtech/install/main/install.sh -sSf | bash
          # Set Shorebird PATH
          echo PATH="/Users/builder/.shorebird/bin:$PATH" >> $CM_ENV

      - name: Installing Android SDK
        script: |
          export ANDROID_HOME="$HOME/opt/android-sdk"
          if [ ! -d "$ANDROID_HOME" ]; then
            echo "$ANDROID_HOME does not exist. Installing..."

            mkdir -p $ANDROID_HOME

            # Install cmdline-tools 11076708; NDK: 28.2.13676358
            cd "$HOME/opt" && \
            curl --fail --show-error --silent --connect-timeout 10.00 --max-time 120.00 \
              --output commandlinetools-mac-11076708_latest.zip \
              https://dl.google.com/android/repository/commandlinetools-mac-11076708_latest.zip && \
            7z -bd x commandlinetools-mac-11076708_latest.zip && \
            mkdir -p $ANDROID_HOME && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "tools" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "cmdline-tools;latest" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} "ndk;28.2.13676358" && \
            yes | cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} --licenses  && \
            cmdline-tools/bin/sdkmanager --sdk_root=${ANDROID_HOME} --list
          fi

          if [ -d "$ANDROID_HOME" ]; then
            echo "$ANDROID_HOME does exist. Setting up env..."

            # PATH
            export PATH=$PATH:$ANDROID_HOME/tools:$ANDROID_HOME/tools/bin:$ANDROID_HOME/platform-tools

            # Override ENV
            echo ANDROID_HOME="$ANDROID_HOME" >> $CM_ENV
            echo ANDROID_SDK_ROOT="$ANDROID_HOME" >> $CM_ENV
            echo PATH="$PATH" >> $CM_ENV
          fi

      - name: Installing Opus
        script: |
          brew install opus
          brew install opus-tools

      - name: Set up Firebase
        script: |
          dart pub global activate flutterfire_cli

          # https://github.com/invertase/flutterfire_cli/issues/233
          echo "$FIREBASE_SERVICE_ACCOUNT_KEY" > ./firebase_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_prod.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12 \
            --android-package-name=com.friend.ios \
            --android-out=android/app/src/prod/  \
            --ios-out=ios/Config/Prod/ \
            --service-account="./firebase_key.json" \
            --project="based-hardware" \
            --ios-target="Runner" \
            --yes

          # DEV, should remove
          echo "$FIREBASE_SERVICE_ACCOUNT_DEV_KEY" > ./firebase_dev_key.json
          flutterfire config \
            --platforms="android,ios" \
            --out=lib/firebase_options_dev.dart \
            --ios-bundle-id=com.friend-app-with-wearable.ios12.development \
            --android-package-name=com.friend.ios.dev \
            --android-out=android/app/src/dev/  \
            --ios-out=ios/Config/Dev/ \
            --service-account="./firebase_dev_key.json" \
            --project="based-hardware-dev" \
            --ios-target="Runner" \
            --yes

      - name: Set up local.properties
        script: |
          echo "flutter.sdk=$HOME/programs/flutter" > "$(pwd)/android/local.properties"
          echo "sdk.dir=$ANDROID_HOME" >> "$(pwd)/android/local.properties"

      - name: Set up App .env
        script: |
          echo OPENAI_API_KEY=$OPENAI_API_KEY >> .env
          echo INSTABUG_API_KEY=$INSTABUG_API_KEY >> .env
          echo MIXPANEL_PROJECT_TOKEN=$MIXPANEL_PROJECT_TOKEN >> .env
          echo ONESIGNAL_APP_ID=$ONESIGNAL_APP_ID >> .env
          echo API_BASE_URL=$API_BASE_URL >> .env
          echo GROWTHBOOK_API_KEY=$GROWTHBOOK_API_KEY >> .env
          echo GOOGLE_MAPS_API_KEY=$GOOGLE_MAPS_API_KEY >> .env
          echo INTERCOM_APP_ID=$INTERCOM_APP_ID >> .env
          echo INTERCOM_ANDROID_API_KEY=$INTERCOM_ANDROID_API_KEY >> .env
          echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> .env
          echo GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET >> .env

      - name: Get Flutter packages
        script: |
          flutter packages pub get
      - name: Run build runner
        script: |
          dart run build_runner build --delete-conflicting-outputs
      - name: Patch Android app with Shorebird
        script: |
          # TODO: Don't tricky
          # Tricky Opus > build.gradle, force use NDK 27 to deal with "ERROR: Unknown host CPU architecture: arm64"
          # echo "Z3JvdXAgJ2V1LmVwbncub3B1c19mbHV0dGVyX2FuZHJvaWQnDQp2ZXJzaW9uICcxLjAnDQoNCmJ1aWxkc2NyaXB0IHsNCiAgICByZXBvc2l0b3JpZXMgew0KICAgICAgICBnb29nbGUoKQ0KICAgICAgICBtYXZlbkNlbnRyYWwoKQ0KICAgIH0NCg0KICAgIGRlcGVuZGVuY2llcyB7DQogICAgICAgIGNsYXNzcGF0aCAnY29tLmFuZHJvaWQudG9vbHMuYnVpbGQ6Z3JhZGxlOjcuMy4wJw0KICAgIH0NCn0NCg0Kcm9vdFByb2plY3QuYWxscHJvamVjdHMgew0KICAgIHJlcG9zaXRvcmllcyB7DQogICAgICAgIGdvb2dsZSgpDQogICAgICAgIG1hdmVuQ2VudHJhbCgpDQogICAgfQ0KfQ0KDQphcHBseSBwbHVnaW46ICdjb20uYW5kcm9pZC5saWJyYXJ5Jw0KDQphbmRyb2lkIHsNCiAgICBpZiAocHJvamVjdC5hbmRyb2lkLmhhc1Byb3BlcnR5KCJuYW1lc3BhY2UiKSkgew0KICAgICAgICBuYW1lc3BhY2UgJ2V1LmVwbncub3B1c19mbHV0dGVyX2FuZHJvaWQnDQogICAgfQ0KDQogICAgY29tcGlsZVNka1ZlcnNpb24gMzMNCg0KICAgIGNvbXBpbGVPcHRpb25zIHsNCiAgICAgICAgc291cmNlQ29tcGF0aWJpbGl0eSBKYXZhVmVyc2lvbi5WRVJTSU9OXzFfOA0KICAgICAgICB0YXJnZXRDb21wYXRpYmlsaXR5IEphdmFWZXJzaW9uLlZFUlNJT05fMV84DQogICAgfQ0KDQogICAgZGVmYXVsdENvbmZpZyB7DQogICAgICAgIG1pblNka1ZlcnNpb24gMTkNCiAgICB9DQogICAgZXh0ZXJuYWxOYXRpdmVCdWlsZCB7DQogICAgICAgIG5ka0J1aWxkew0KICAgICAgICAgICAgcGF0aCAiQW5kcm9pZC5tayINCiAgICAgICAgfQ0KICAgIH0NCg0KICAgIGRlcGVuZGVuY2llcyB7DQogICAgICAgIHRlc3RJbXBsZW1lbnRhdGlvbiAnanVuaXQ6anVuaXQ6NC4xMy4yJw0KICAgICAgICB0ZXN0SW1wbGVtZW50YXRpb24gJ29yZy5tb2NraXRvOm1vY2tpdG8tY29yZTo1LjAuMCcNCiAgICB9DQoNCiAgICB0ZXN0T3B0aW9ucyB7DQogICAgICAgIHVuaXRUZXN0cy5hbGwgew0KICAgICAgICAgICAgdGVzdExvZ2dpbmcgew0KICAgICAgICAgICAgICAgZXZlbnRzICJwYXNzZWQiLCAic2tpcHBlZCIsICJmYWlsZWQiLCAic3RhbmRhcmRPdXQiLCAic3RhbmRhcmRFcnJvciINCiAgICAgICAgICAgICAgIG91dHB1dHMudXBUb0RhdGVXaGVuIHtmYWxzZX0NCiAgICAgICAgICAgICAgIHNob3dTdGFuZGFyZFN0cmVhbXMgPSB0cnVlDQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQogICAgbmRrVmVyc2lvbiAnMjcuMC4xMjA3Nzk3MycNCn0NCg==" | base64 -d > "$HOME/.pub-cache/hosted/pub.dev/opus_flutter_android-3.0.1/android/build.gradle"

          # Should use bump version automatically by CI
          shorebird patch android \
            --flavor prod
    artifacts:
      - build/**/outputs/**/*.aab
      - build/**/outputs/**/mapping.txt
      - flutter_drive.log
    publishing:
      email:
        recipients:
          - ngocthinhdp@gmail.com
          - joan@basedhardware.com
          - nik@basedhardware.com
          - mohsin.lp710@gmail.com
          - i@m13v.com
        notify:
          success: true
          failure: false

  # ============================================
  # OMI DESKTOP SWIFT RELEASE
  # Builds, signs, notarizes, and publishes the Swift macOS app from omi/desktop/.
  # Source code is synced from the omi-desktop repo via git-dashboard.
  #
  # Trigger: push a tag like v0.0.10+10-macos to BasedHardware/omi
  #   git tag v0.0.10+10-macos && git push origin v0.0.10+10-macos
  #
  # Required CodeMagic secret group "omi_desktop":
  #   MACOS_DEVELOPER_ID_P12          — base64 .p12 (Developer ID Application: Matthew Diakonov S6DP5HF77G)
  #   MACOS_DEVELOPER_ID_P12_PASSWORD — .p12 password
  #   MACOS_DEVELOPER_ID_PROFILE      — base64 provisioning profile
  #   SPARKLE_PRIVATE_KEY             — EdDSA private key for Sparkle auto-update signing
  #   RELEASE_SECRET                  — shared secret for Firestore release registration API
  #   GCP_SERVICE_ACCOUNT_KEY         — base64 GCP service account JSON
  #                                     (needs: Cloud Run Admin, Storage Object Admin, GCR push)
  #   OMI_DESKTOP_APP_ENV             — base64-encoded .env.app (runtime secrets bundled into .app)
  #   FIREBASE_PROJECT_ID, FIREBASE_API_KEY
  #   APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_PRIVATE_KEY
  #   RESEND_API_KEY
  #   SENTRY_AUTH_TOKEN, SENTRY_ADMIN_UID, SENTRY_WEBHOOK_SECRET
  #   REDIS_DB_HOST, REDIS_DB_PORT, REDIS_DB_PASSWORD
  #
  # Re-uses from existing groups:
  #   app_env:            GEMINI_API_KEY, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
  #   appstore_credentials: APP_STORE_CONNECT_PRIVATE_KEY, APP_STORE_CONNECT_KEY_IDENTIFIER,
  #                         APP_STORE_CONNECT_ISSUER_ID (used for notarization)
  # ============================================
  omi-desktop-swift-release:
    name: Release OMI Desktop (Swift)
    instance_type: mac_mini_m2
    max_build_duration: 120
    environment:
      groups:
        - app_env
        - firebase
        - appstore_credentials
        - omi_desktop
      vars:
        BINARY_NAME: "Omi Computer"
        APP_NAME: "Omi Beta"
        BUNDLE_ID: "com.omi.computer-macos"
        BUILD_DIR: "build"
        GITHUB_REPO: "BasedHardware/omi"
        DESKTOP_BACKEND_URL: "https://desktop-backend-hhibjajaja-uc.a.run.app"
        GCP_PROJECT: "based-hardware"
        GCP_REGION: "us-central1"
        CLOUD_RUN_SERVICE: "desktop-backend"
        BACKEND_IMAGE: "gcr.io/based-hardware/desktop-backend"
      xcode: 16.4
    triggering:
      events:
        - tag
      tag_patterns:
        - pattern: "v*-macos"
          include: true
    working_directory: desktop
    scripts:
      - name: Extract version and build number from tag
        script: |
          # Tag format: v{version}+{build}-macos  e.g. v0.0.10+10-macos
          VERSION=$(echo "$CM_TAG" | sed -E 's/^v([0-9.]+)\+([0-9]+)-macos$/\1/')
          BUILD_NUMBER=$(echo "$CM_TAG" | sed -E 's/^v([0-9.]+)\+([0-9]+)-macos$/\2/')
          if [ -z "$VERSION" ] || [ "$VERSION" = "$CM_TAG" ]; then
            echo "ERROR: Could not parse version from tag: $CM_TAG"
            echo "Expected format: v{version}+{build}-macos (e.g. v0.0.10+10-macos)"
            exit 1
          fi
          echo "VERSION=$VERSION" >> $CM_ENV
          echo "BUILD_NUMBER=$BUILD_NUMBER" >> $CM_ENV
          echo "APP_BUNDLE=$BUILD_DIR/$APP_NAME.app" >> $CM_ENV
          echo "DMG_PATH=$BUILD_DIR/$APP_NAME.dmg" >> $CM_ENV
          echo "SPARKLE_ZIP_PATH=$BUILD_DIR/Omi.zip" >> $CM_ENV
          echo "Building OMI Desktop v$VERSION (build $BUILD_NUMBER)"

      - name: Set up keychain and import Developer ID certificate
        script: |
          keychain initialize
          echo "$MACOS_DEVELOPER_ID_P12" | base64 --decode > /tmp/developer_id.p12
          KEYCHAIN_PATH=$(keychain get-default)
          security import /tmp/developer_id.p12 \
            -k "$KEYCHAIN_PATH" \
            -P "${MACOS_DEVELOPER_ID_P12_PASSWORD:-}" \
            -T /usr/bin/codesign \
            -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" "$KEYCHAIN_PATH" 2>/dev/null || true
          rm /tmp/developer_id.p12
          SIGN_IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
          if [ -z "$SIGN_IDENTITY" ]; then
            echo "ERROR: Developer ID Application certificate not found in keychain"
            exit 1
          fi
          echo "SIGN_IDENTITY=$SIGN_IDENTITY" >> $CM_ENV
          echo "Found signing identity: $SIGN_IDENTITY"

      - name: Install provisioning profile
        script: |
          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
          echo "$MACOS_DEVELOPER_ID_PROFILE" | base64 --decode > /tmp/developer_id.provisionprofile
          # Copy into Desktop/ so the bundle creation step can embed it
          cp /tmp/developer_id.provisionprofile Desktop/embedded.provisionprofile
          # Install system-wide for toolchain
          security cms -D -i /tmp/developer_id.provisionprofile > /tmp/profile.plist
          PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print :UUID" /tmp/profile.plist)
          cp /tmp/developer_id.provisionprofile \
            "$HOME/Library/MobileDevice/Provisioning Profiles/$PROFILE_UUID.provisionprofile"
          echo "PROFILE_UUID=$PROFILE_UUID" >> $CM_ENV

      - name: Build acp-bridge (TypeScript → JavaScript)
        script: |
          cd acp-bridge
          npm install --no-fund --no-audit
          npx tsc
          cd ..

      - name: Prepare universal ffmpeg (arm64 + x86_64)
        script: |
          FFMPEG_RESOURCE="Desktop/Sources/Resources/ffmpeg"
          if file "$FFMPEG_RESOURCE" 2>/dev/null | grep -q "universal binary"; then
            echo "ffmpeg already universal, skipping download"
          else
            echo "Creating universal ffmpeg..."
            TEMP_DIR="/tmp/ffmpeg-universal-$$"
            mkdir -p "$TEMP_DIR"
            curl -L -o "$TEMP_DIR/arm64.zip" \
              "https://ffmpeg.martin-riedl.de/redirect/latest/macos/arm64/release/ffmpeg.zip"
            unzip -q -o "$TEMP_DIR/arm64.zip" -d "$TEMP_DIR/arm64/"
            curl -L -o "$TEMP_DIR/x86_64.zip" \
              "https://ffmpeg.martin-riedl.de/redirect/latest/macos/amd64/release/ffmpeg.zip"
            unzip -q -o "$TEMP_DIR/x86_64.zip" -d "$TEMP_DIR/x86_64/"
            ARM64=$(find "$TEMP_DIR/arm64" -name "ffmpeg" -type f | head -1)
            X86=$(find "$TEMP_DIR/x86_64" -name "ffmpeg" -type f | head -1)
            lipo -create "$ARM64" "$X86" -output "$FFMPEG_RESOURCE"
            chmod +x "$FFMPEG_RESOURCE"
            xattr -cr "$FFMPEG_RESOURCE"
            codesign -f -s - "$FFMPEG_RESOURCE"
            rm -rf "$TEMP_DIR"
          fi
          echo "ffmpeg: $(file "$FFMPEG_RESOURCE" | sed 's/.*: //')"

      - name: Prepare universal Node.js (arm64 + x86_64)
        script: |
          NODE_RESOURCE="Desktop/Sources/Resources/node"
          NODE_VERSION="v22.14.0"
          if file "$NODE_RESOURCE" 2>/dev/null | grep -q "universal binary"; then
            echo "Node.js already universal, skipping download"
          else
            echo "Creating universal Node.js $NODE_VERSION..."
            TEMP_DIR="/tmp/node-universal-$$"
            mkdir -p "$TEMP_DIR"
            curl -L -o "$TEMP_DIR/arm64.tar.gz" \
              "https://nodejs.org/dist/$NODE_VERSION/node-$NODE_VERSION-darwin-arm64.tar.gz"
            tar -xzf "$TEMP_DIR/arm64.tar.gz" -C "$TEMP_DIR"
            ARM64=$(find "$TEMP_DIR" -name "node" -type f | head -1)
            mv "$ARM64" "$TEMP_DIR/node-arm64"
            curl -L -o "$TEMP_DIR/x86_64.tar.gz" \
              "https://nodejs.org/dist/$NODE_VERSION/node-$NODE_VERSION-darwin-x64.tar.gz"
            tar -xzf "$TEMP_DIR/x86_64.tar.gz" -C "$TEMP_DIR"
            X86=$(find "$TEMP_DIR" -name "node" -type f ! -name "node-arm64" | head -1)
            lipo -create "$TEMP_DIR/node-arm64" "$X86" -output "$NODE_RESOURCE"
            chmod +x "$NODE_RESOURCE"
            xattr -cr "$NODE_RESOURCE"
            codesign -f -s - "$NODE_RESOURCE"
            rm -rf "$TEMP_DIR"
          fi
          echo "node: $(file "$NODE_RESOURCE" | sed 's/.*: //')"

      - name: Build Swift app (arm64 + x86_64)
        script: |
          mkdir -p "$BUILD_DIR"
          # Unset TOOLCHAINS to use Xcode's default toolchain (avoids Swift version conflicts)
          unset TOOLCHAINS
          echo "Building arm64..."
          xcrun swift build -c release --package-path Desktop --triple arm64-apple-macosx
          echo "Building x86_64..."
          xcrun swift build -c release --package-path Desktop --triple x86_64-apple-macosx

      - name: Create universal app bundle
        script: |
          ARM64_BINARY="Desktop/.build/arm64-apple-macosx/release/$BINARY_NAME"
          X86_64_BINARY="Desktop/.build/x86_64-apple-macosx/release/$BINARY_NAME"

          if [ ! -f "$ARM64_BINARY" ] || [ ! -f "$X86_64_BINARY" ]; then
            echo "ERROR: Missing built binaries"
            ls "Desktop/.build/" 2>/dev/null
            exit 1
          fi

          mkdir -p "$APP_BUNDLE/Contents/MacOS"
          mkdir -p "$APP_BUNDLE/Contents/Resources"
          mkdir -p "$APP_BUNDLE/Contents/Frameworks"

          # Merge architectures into universal binary
          lipo -create "$ARM64_BINARY" "$X86_64_BINARY" -output "$APP_BUNDLE/Contents/MacOS/$BINARY_NAME"
          file "$APP_BUNDLE/Contents/MacOS/$BINARY_NAME" | grep -q "universal binary" || {
            echo "ERROR: lipo failed to create universal binary"
            exit 1
          }

          cp Desktop/Info.plist "$APP_BUNDLE/Contents/Info.plist"

          # Copy Sparkle framework
          SPARKLE_FW="Desktop/.build/arm64-apple-macosx/release/Sparkle.framework"
          if [ ! -d "$SPARKLE_FW" ]; then
            echo "ERROR: Sparkle.framework not found at $SPARKLE_FW"
            exit 1
          fi
          cp -R "$SPARKLE_FW" "$APP_BUNDLE/Contents/Frameworks/"

          # Add rpath so Sparkle can be found at runtime
          install_name_tool -add_rpath "@executable_path/../Frameworks" \
            "$APP_BUNDLE/Contents/MacOS/$BINARY_NAME"

          # Copy app icon
          [ -f "omi_icon.icns" ] && cp omi_icon.icns "$APP_BUNDLE/Contents/Resources/OmiIcon.icns"

          # Copy Firebase config
          cp Desktop/Sources/GoogleService-Info.plist "$APP_BUNDLE/Contents/Resources/"

          # Copy SPM resource bundle (app assets: permissions.gif, herologo.png, etc.)
          SWIFT_BUILD_DIR="Desktop/.build/arm64-apple-macosx/release"
          RESOURCE_BUNDLE="$SWIFT_BUILD_DIR/Omi Computer_Omi Computer.bundle"
          if [ -d "$RESOURCE_BUNDLE" ]; then
            cp -R "$RESOURCE_BUNDLE" "$APP_BUNDLE/Contents/Resources/"
          else
            echo "WARNING: SPM resource bundle not found (non-fatal)"
          fi

          # Copy acp-bridge (Claude Code integration)
          if [ -d "acp-bridge/dist" ]; then
            mkdir -p "$APP_BUNDLE/Contents/Resources/acp-bridge"
            cp -Rf acp-bridge/dist        "$APP_BUNDLE/Contents/Resources/acp-bridge/"
            cp -f  acp-bridge/package.json "$APP_BUNDLE/Contents/Resources/acp-bridge/"
            cp -Rf acp-bridge/node_modules "$APP_BUNDLE/Contents/Resources/acp-bridge/"
          else
            echo "ERROR: acp-bridge/dist not found"
            exit 1
          fi

          # Update Info.plist metadata
          /usr/libexec/PlistBuddy -c "Set :CFBundleExecutable   $BINARY_NAME"  "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier   $BUNDLE_ID"    "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Set :CFBundleName         $APP_NAME"     "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Set :CFBundleDisplayName  $APP_NAME"     "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Set :LSMinimumSystemVersion 14.0"        "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" \
            "$APP_BUNDLE/Contents/Info.plist" 2>/dev/null || \
          /usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string $VERSION" \
            "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD_NUMBER" \
            "$APP_BUNDLE/Contents/Info.plist" 2>/dev/null || \
          /usr/libexec/PlistBuddy -c "Add :CFBundleVersion string $BUILD_NUMBER" \
            "$APP_BUNDLE/Contents/Info.plist"

          printf "APPL????" > "$APP_BUNDLE/Contents/PkgInfo"

          # Embed provisioning profile
          [ -f "Desktop/embedded.provisionprofile" ] && \
            cp Desktop/embedded.provisionprofile "$APP_BUNDLE/Contents/embedded.provisionprofile"

          # Write runtime .env from OMI_DESKTOP_APP_ENV secret (base64-encoded .env.app contents)
          echo "$OMI_DESKTOP_APP_ENV" | base64 --decode > "$APP_BUNDLE/Contents/Resources/.env"
          echo "App bundle created: $APP_BUNDLE"

      - name: Sign app
        script: |
          xattr -cr "$APP_BUNDLE"

          # Sign ffmpeg (inside SPM resource bundle)
          FFMPEG_PATH="$APP_BUNDLE/Contents/Resources/Omi Computer_Omi Computer.bundle/ffmpeg"
          if [ -f "$FFMPEG_PATH" ]; then
            codesign --force --options runtime --timestamp \
              --sign "$SIGN_IDENTITY" "$FFMPEG_PATH"
          fi

          # Sign node with JIT entitlements (V8 requires MAP_JIT under Hardened Runtime)
          NODE_BUNDLE_PATH="$APP_BUNDLE/Contents/Resources/Omi Computer_Omi Computer.bundle/node"
          if [ -f "$NODE_BUNDLE_PATH" ]; then
            codesign --force --options runtime --timestamp \
              --sign "$SIGN_IDENTITY" \
              --entitlements Desktop/Node.entitlements \
              "$NODE_BUNDLE_PATH"
          fi

          # Sign acp-bridge native binaries
          ACP_BRIDGE_BUNDLE="$APP_BUNDLE/Contents/Resources/acp-bridge"
          if [ -d "$ACP_BRIDGE_BUNDLE/node_modules" ]; then
            # Remove JetBrains plugin — its JARs contain .jnilib files Apple rejects during notarization
            rm -rf "$ACP_BRIDGE_BUNDLE/node_modules/@anthropic-ai/claude-code/vendor/claude-code-jetbrains-plugin" \
              2>/dev/null || true

            # Primary pass: sign known native binary extensions
            find "$ACP_BRIDGE_BUNDLE/node_modules" -type f \
              \( -name "*.node" -o -name "*.dylib" -o -name "*.jnilib" -o -name "*.so" -o -name "rg" \) \
              2>/dev/null | while read native_bin; do
              file "$native_bin" 2>/dev/null | grep -q "Mach-O" && \
                codesign --force --options runtime --timestamp \
                  --sign "$SIGN_IDENTITY" "$native_bin"
            done

            # Catch-all pass: any remaining unsigned Mach-O binaries
            find "$ACP_BRIDGE_BUNDLE/node_modules" -type f \
              ! -name "*.js"   ! -name "*.json" ! -name "*.ts"   ! -name "*.map" \
              ! -name "*.md"   ! -name "*.txt"  ! -name "*.yml"  ! -name "*.yaml" \
              ! -name "*.css"  ! -name "*.html" ! -name "*.jar"  ! -name "*.d.ts" \
              ! -name "*.node" ! -name "*.dylib" ! -name "*.jnilib" ! -name "*.so" ! -name "rg" \
              2>/dev/null | while read candidate; do
              file "$candidate" 2>/dev/null | grep -q "Mach-O" && \
                codesign --force --options runtime --timestamp \
                  --sign "$SIGN_IDENTITY" "$candidate"
            done
          fi

          # Sign Sparkle components — innermost first (required order)
          SPARKLE_FW="$APP_BUNDLE/Contents/Frameworks/Sparkle.framework"
          codesign --force --options runtime --timestamp --sign "$SIGN_IDENTITY" \
            "$SPARKLE_FW/Versions/B/XPCServices/Downloader.xpc"
          codesign --force --options runtime --timestamp --sign "$SIGN_IDENTITY" \
            "$SPARKLE_FW/Versions/B/XPCServices/Installer.xpc"
          codesign --force --options runtime --timestamp --sign "$SIGN_IDENTITY" \
            "$SPARKLE_FW/Versions/B/Autoupdate"
          codesign --force --options runtime --timestamp --sign "$SIGN_IDENTITY" \
            "$SPARKLE_FW/Versions/B/Updater.app"
          codesign --force --options runtime --timestamp --sign "$SIGN_IDENTITY" \
            "$SPARKLE_FW"

          # Sign the main app bundle with release entitlements
          codesign --force --options runtime --timestamp \
            --sign "$SIGN_IDENTITY" \
            --entitlements Desktop/Omi-Release.entitlements \
            "$APP_BUNDLE"

          codesign --verify --verbose=2 "$APP_BUNDLE" 2>&1 | head -3
          echo "App signed successfully"

      - name: Notarize app
        script: |
          set -e
          TEMP_ZIP="$BUILD_DIR/notarize-temp.zip"
          ditto -c -k --keepParent "$APP_BUNDLE" "$TEMP_ZIP"

          mkdir -p ~/private_keys
          PRIVATE_KEY_PATH=~/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_IDENTIFIER}.p8
          echo -e "$APP_STORE_CONNECT_PRIVATE_KEY" > "$PRIVATE_KEY_PATH"

          RESULT=$(xcrun notarytool submit "$TEMP_ZIP" \
            --key "$PRIVATE_KEY_PATH" \
            --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
            --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
            --wait \
            --output-format json)

          STATUS=$(echo "$RESULT" | python3 -c \
            "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null || echo "")
          SUBMISSION_ID=$(echo "$RESULT" | python3 -c \
            "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || echo "")

          if [ "$STATUS" != "Accepted" ]; then
            echo "Notarization failed: $STATUS"
            [ -n "$SUBMISSION_ID" ] && xcrun notarytool log "$SUBMISSION_ID" \
              --key "$PRIVATE_KEY_PATH" \
              --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
              --issuer "$APP_STORE_CONNECT_ISSUER_ID"
            exit 1
          fi
          rm -f "$TEMP_ZIP"
          echo "App notarized"

      - name: Staple app
        script: |
          xcrun stapler staple "$APP_BUNDLE"
          echo "App stapled"

      - name: Install create-dmg
        script: |
          brew install create-dmg || true

      - name: Create DMG installer
        script: |
          set -e
          STAGING_DIR="/tmp/omi-dmg-staging-$$"
          mkdir -p "$STAGING_DIR"
          # Use ditto to preserve the notarization staple ticket (cp -R drops it)
          ditto "$APP_BUNDLE" "$STAGING_DIR/$APP_NAME.app"
          # Re-staple in staging dir if needed
          xcrun stapler validate "$STAGING_DIR/$APP_NAME.app" 2>/dev/null || \
            xcrun stapler staple "$STAGING_DIR/$APP_NAME.app"

          BG_ARGS=""
          [ -f "dmg-assets/background.png" ] && BG_ARGS="--background dmg-assets/background.png"

          create-dmg \
            --volname "$APP_NAME" \
            --volicon "$STAGING_DIR/$APP_NAME.app/Contents/Resources/OmiIcon.icns" \
            --window-pos 200 120 \
            --window-size 610 365 \
            --icon-size 80 \
            --icon "$APP_NAME.app" 155 175 \
            --hide-extension "$APP_NAME.app" \
            --app-drop-link 455 175 \
            --no-internet-enable \
            --skip-jenkins \
            $BG_ARGS \
            "$DMG_PATH" \
            "$STAGING_DIR/$APP_NAME.app"

          rm -rf "$STAGING_DIR"
          echo "DMG created"

      - name: Sign, notarize, and staple DMG
        script: |
          set -e
          codesign --force --sign "$SIGN_IDENTITY" "$DMG_PATH"

          mkdir -p ~/private_keys
          PRIVATE_KEY_PATH=~/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_IDENTIFIER}.p8
          echo -e "$APP_STORE_CONNECT_PRIVATE_KEY" > "$PRIVATE_KEY_PATH"

          RESULT=$(xcrun notarytool submit "$DMG_PATH" \
            --key "$PRIVATE_KEY_PATH" \
            --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
            --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
            --wait \
            --output-format json)

          STATUS=$(echo "$RESULT" | python3 -c \
            "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null || echo "")
          SUBMISSION_ID=$(echo "$RESULT" | python3 -c \
            "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || echo "")

          if [ "$STATUS" != "Accepted" ]; then
            echo "DMG notarization failed: $STATUS"
            [ -n "$SUBMISSION_ID" ] && xcrun notarytool log "$SUBMISSION_ID" \
              --key "$PRIVATE_KEY_PATH" \
              --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
              --issuer "$APP_STORE_CONNECT_ISSUER_ID"
            exit 1
          fi

          xcrun stapler staple "$DMG_PATH"
          echo "DMG signed, notarized, and stapled"

      - name: Create Sparkle ZIP and sign
        script: |
          # Sparkle expects a ZIP of .app — not a DMG
          ditto -c -k --keepParent "$APP_BUNDLE" "$SPARKLE_ZIP_PATH"

          SPARKLE_BIN="Desktop/.build/artifacts/sparkle/Sparkle/bin"
          ED_SIGNATURE=""
          if [ -d "$SPARKLE_BIN" ] && [ -f "$SPARKLE_BIN/sign_update" ]; then
            if [ -n "$SPARKLE_PRIVATE_KEY" ]; then
              ED_SIGNATURE=$(echo "$SPARKLE_PRIVATE_KEY" | \
                "$SPARKLE_BIN/sign_update" "$SPARKLE_ZIP_PATH" --ed-key-file - 2>/dev/null | \
                grep "sparkle:edSignature" | \
                sed 's/.*edSignature="\([^"]*\)".*/\1/')
            fi
          fi

          if [ -n "$ED_SIGNATURE" ]; then
            echo "EdDSA signature: $ED_SIGNATURE"
          else
            echo "WARNING: Could not generate EdDSA signature — Sparkle auto-update will not work"
          fi
          echo "ED_SIGNATURE=$ED_SIGNATURE" >> $CM_ENV

      - name: Create GitHub release
        script: |
          DOWNLOAD_URL="https://github.com/$GITHUB_REPO/releases/download/$CM_TAG/Omi.zip"

          CHANGELOG_MD=$(python3 -c "
          import json
          try:
            with open('CHANGELOG.json') as f:
              data = json.load(f)
            changes = data.get('releases', [{}])[0].get('changes', [])
            print('\n'.join('- ' + c for c in changes))
          except:
            print('- Bug fixes and improvements')
          ")

          CHANGELOG_JSON=$(python3 -c "
          import json
          try:
            with open('CHANGELOG.json') as f:
              data = json.load(f)
            print(json.dumps(data.get('releases', [{}])[0].get('changes', [])))
          except:
            print('[]')
          ")

          # Store for Firestore step (base64 to survive env var export)
          CHANGELOG_JSON_B64=$(echo "$CHANGELOG_JSON" | base64)
          echo "CHANGELOG_JSON_B64=$CHANGELOG_JSON_B64" >> $CM_ENV
          echo "DOWNLOAD_URL=$DOWNLOAD_URL" >> $CM_ENV

          RELEASE_NOTES="## OMI Desktop v${VERSION}

          ### What's New
          ${CHANGELOG_MD}

          ### Downloads
          - **DMG Installer**: For fresh installs, download the DMG below
          - **Auto-Update**: Existing users will receive this update automatically via Sparkle"

          # Safe re-run: delete existing release if it exists
          gh release view "$CM_TAG" --repo "$GITHUB_REPO" &>/dev/null && \
            gh release delete "$CM_TAG" --repo "$GITHUB_REPO" --yes 2>/dev/null || true

          gh release create "$CM_TAG" \
            --repo "$GITHUB_REPO" \
            --title "Omi Desktop v${VERSION}" \
            --notes "$RELEASE_NOTES" \
            "$SPARKLE_ZIP_PATH" \
            "$DMG_PATH"

          echo "GitHub release created: $CM_TAG"

      - name: Upload DMG to GCS
        script: |
          echo "$GCP_SERVICE_ACCOUNT_KEY" | base64 --decode > /tmp/gcp_key.json
          gcloud auth activate-service-account --key-file=/tmp/gcp_key.json --quiet
          gcloud config set project "$GCP_PROJECT" --quiet
          rm /tmp/gcp_key.json

          GCS_BUCKET="gs://omi_macos_updates"
          gsutil -h "Content-Disposition:attachment; filename=\"Omi Beta.dmg\"" \
            cp "$DMG_PATH" "$GCS_BUCKET/releases/v${VERSION}/Omi.Beta.dmg"
          echo "Uploaded: $GCS_BUCKET/releases/v${VERSION}/Omi.Beta.dmg"
          echo "(Run promote_release.sh to update the latest/ pointer when promoting to stable)"

      - name: Register release in Firestore
        script: |
          CHANGELOG_JSON=$(echo "$CHANGELOG_JSON_B64" | base64 --decode)

          RELEASE_JSON=$(python3 - <<PYEOF
          import json, os
          data = {
            'version':      os.environ['VERSION'],
            'build_number': int(os.environ['BUILD_NUMBER']),
            'download_url': os.environ.get('DOWNLOAD_URL', ''),
            'ed_signature': os.environ.get('ED_SIGNATURE', ''),
            'changelog':    json.loads(os.environ.get('CHANGELOG_JSON', '[]')),
            'is_live':      True,
            'is_critical':  False,
            'channel':      'staging',
          }
          print(json.dumps(data))
          PYEOF
          )

          HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" \
            -X POST \
            -H "Content-Type: application/json" \
            -H "X-Release-Secret: $RELEASE_SECRET" \
            -d "$RELEASE_JSON" \
            "$DESKTOP_BACKEND_URL/updates/releases")

          HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -n1)
          if [ "$HTTP_CODE" = "201" ]; then
            echo "Release registered in Firestore (channel: staging)"
          else
            echo "WARNING: Firestore registration returned HTTP $HTTP_CODE"
            echo "$(echo "$HTTP_RESPONSE" | head -n -1)"
            echo "Run local-scripts/add_release.py manually if needed"
          fi

      - name: Deploy Rust backend to Cloud Run
        script: |
          # Authenticate gcloud with service account
          echo "$GCP_SERVICE_ACCOUNT_KEY" | base64 --decode > /tmp/gcp_key.json
          gcloud auth activate-service-account --key-file=/tmp/gcp_key.json --quiet
          gcloud config set project "$GCP_PROJECT" --quiet
          gcloud auth configure-docker gcr.io --quiet
          rm /tmp/gcp_key.json

          # Build linux/amd64 image and push directly to GCR using BuildKit
          # (--push avoids loading the image locally on the arm64 runner)
          export DOCKER_BUILDKIT=1
          docker buildx build \
            --platform linux/amd64 \
            --push \
            -t "$BACKEND_IMAGE:$VERSION" \
            -t "$BACKEND_IMAGE:latest" \
            Backend-Rust/

          # Deploy to Cloud Run
          gcloud run deploy "$CLOUD_RUN_SERVICE" \
            --image "$BACKEND_IMAGE:$VERSION" \
            --project "$GCP_PROJECT" \
            --region "$GCP_REGION" \
            --platform managed \
            --allow-unauthenticated \
            --set-env-vars "FIREBASE_PROJECT_ID=$FIREBASE_PROJECT_ID,FIREBASE_API_KEY=$FIREBASE_API_KEY,GEMINI_API_KEY=$GEMINI_API_KEY,APPLE_CLIENT_ID=$APPLE_CLIENT_ID,APPLE_TEAM_ID=$APPLE_TEAM_ID,APPLE_KEY_ID=$APPLE_KEY_ID,GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET=$GOOGLE_CLIENT_SECRET,RUST_LOG=info,RELEASE_SECRET=$RELEASE_SECRET,RESEND_API_KEY=$RESEND_API_KEY,SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN,SENTRY_ADMIN_UID=$SENTRY_ADMIN_UID,SENTRY_WEBHOOK_SECRET=$SENTRY_WEBHOOK_SECRET,REDIS_DB_HOST=$REDIS_DB_HOST,REDIS_DB_PORT=$REDIS_DB_PORT,REDIS_DB_PASSWORD=$REDIS_DB_PASSWORD" \
            --quiet

          # Update APPLE_PRIVATE_KEY separately — it's multiline, so use ^@^ as the separator
          # to prevent gcloud from splitting on commas within the key value
          gcloud run services update "$CLOUD_RUN_SERVICE" \
            --project "$GCP_PROJECT" \
            --region "$GCP_REGION" \
            --update-env-vars "^@^APPLE_PRIVATE_KEY=$APPLE_PRIVATE_KEY" \
            --quiet

          echo "Backend deployed: $CLOUD_RUN_SERVICE @ $VERSION"

    artifacts:
      - build/*.app
      - build/*.dmg
      - build/*.zip
    publishing:
      email:
        recipients:
          - i@m13v.com
        notify:
          success: true
          failure: true