#!/usr/bin/env bash
# Print the GitHub Actions secrets needed by .github/workflows/testflight.yml,
# read from your local signing assets. Paste each into:
#   GitHub -> repo -> Settings -> Secrets and variables -> Actions -> New secret
#
# (Or, with the `gh` CLI:  ./github-secrets.sh | gh secret set ... )
#
# These are SECRETS — this only prints to your terminal; nothing is committed.
set -euo pipefail
cd "$(git rev-parse --show-toplevel)"
HERE="scripts/testflight"
source "$HERE/config.env"

: "${ASC_KEY_ID:?}"; : "${ASC_ISSUER_ID:?}"; : "${ASC_P8:?}"
: "${DIST_P12:?}"; : "${P12_PASSWORD:?}"; : "${APPSTORE_PROFILE:?}"

b64() { base64 -w0 "$1" 2>/dev/null || base64 "$1"; }  # -w0 = GNU, plain = BSD/mac

echo "== Add these 6 repository secrets =="
echo
echo "ASC_KEY_ID"
echo "  $ASC_KEY_ID"
echo
echo "ASC_ISSUER_ID"
echo "  $ASC_ISSUER_ID"
echo
echo "P12_PASSWORD"
echo "  $P12_PASSWORD"
echo
echo "ASC_API_KEY_P8   (paste the whole PEM, including BEGIN/END lines)"
echo "-----"
cat "$ASC_P8"
echo "-----"
echo
echo "DIST_P12_BASE64  (single line)"
echo "-----"
b64 "$DIST_P12"
echo "-----"
echo
echo "APPSTORE_PROFILE_BASE64  (single line)"
echo "-----"
b64 "$APPSTORE_PROFILE"
echo "-----"