name: macOS signing setup
description: >
  Import the Developer ID certificate into a keychain and stage App Store Connect
  API-key notarization credentials for a subsequent electron-forge publish.
inputs:
  csc-link:
    description: Base64 of the Developer ID Application .p12
    required: true
  csc-key-password:
    description: Password for the .p12
    required: true
  apple-api-key-base64:
    description: Base64 of the App Store Connect API key (.p8)
    required: true
  apple-api-key-id:
    description: App Store Connect API key id
    required: true
  apple-api-issuer:
    description: App Store Connect issuer uuid
    required: true
  apple-signing-identity:
    description: "Developer ID Application: <Holder> (<TEAMID>)"
    required: true
runs:
  using: composite
  steps:
    # Imports the .p12 into a temporary keychain so @electron/osx-sign can find
    # the identity (forge, unlike electron-builder, does not decode CSC_LINK).
    - uses: apple-actions/import-codesign-certs@v3
      with:
        p12-file-base64: ${{ inputs.csc-link }}
        p12-password: ${{ inputs.csc-key-password }}
    # Decode the .p8 to a file and export notarization env for the Publish step.
    # @electron/notarize's appleApiKey is a FILE PATH, so we must materialize it.
    # Inputs are passed via env (never interpolated into the script body) so a
    # value's special characters cannot break or inject into the shell. Decoding
    # is done with node (portable; avoids BSD-vs-GNU base64 flag differences on
    # the macOS runner).
    - shell: bash
      env:
        APPLE_API_KEY_BASE64: ${{ inputs.apple-api-key-base64 }}
        APPLE_API_KEY_ID: ${{ inputs.apple-api-key-id }}
        APPLE_API_ISSUER: ${{ inputs.apple-api-issuer }}
        APPLE_SIGNING_IDENTITY: ${{ inputs.apple-signing-identity }}
      run: |
        key_path="$RUNNER_TEMP/AuthKey.p8"
        node -e "require('fs').writeFileSync('$key_path', Buffer.from(process.env.APPLE_API_KEY_BASE64, 'base64'))"
        {
          echo "APPLE_API_KEY=$key_path"
          echo "APPLE_API_KEY_ID=$APPLE_API_KEY_ID"
          echo "APPLE_API_ISSUER=$APPLE_API_ISSUER"
          echo "APPLE_SIGNING_IDENTITY=$APPLE_SIGNING_IDENTITY"
        } >> "$GITHUB_ENV"
