# Copyright 2015 - 2025, GIBIS-Unifesp and the wiRedPanda contributors
# SPDX-License-Identifier: GPL-3.0-or-later

name: Deploy

on:
  release:
    types: [published]

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        qt: [5.15.2, 6.9.0]

# =================================

    runs-on: ${{ matrix.os }}
    container: ${{ matrix.os == 'ubuntu-latest' && 'ubuntu:20.04' || '' }}

    steps:
    - name: Install Ubuntu dependencies
      if: runner.os == 'Linux'
      run: |
        export DEBIAN_FRONTEND=noninteractive
        apt-get update
        apt-get install -y software-properties-common
        add-apt-repository ppa:ubuntu-toolchain-r/test -y
        apt-get update
        apt-get install -y \
          build-essential \
          gcc-11 \
          g++-11 \
          git \
          jq \
          libasound2 \
          libcups2 \
          libcurl4-openssl-dev \
          libfontconfig1-dev \
          libfreetype6-dev \
          libfuse2 \
          libgstreamer-gl1.0-0 \
          libx11-dev \
          libx11-xcb-dev \
          libxcb-cursor0 \
          libxcb-glx0-dev \
          libxcb-icccm4-dev \
          libxcb-image0-dev \
          libxcb-keysyms1-dev \
          libxcb-randr0-dev \
          libxcb-render-util0-dev \
          libxcb-shape0-dev \
          libxcb-shm0-dev \
          libxcb-sync0-dev \
          libxcb-xfixes0-dev \
          libxcb1-dev \
          libxext-dev \
          libxfixes-dev \
          libxi-dev \
          libxkbcommon-dev \
          libxkbcommon-x11-dev \
          libxrandr2 \
          libxrender-dev \
          ninja-build \
          sudo \
          wget
        update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-11 110 --slave /usr/bin/g++ g++ /usr/bin/g++-11

    - name: Install Modern CMake
      if: runner.os == 'Linux'
      run: |
        # Install CMake 3.25+ from Kitware's APT repository
        wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | gpg --dearmor - | tee /etc/apt/trusted.gpg.d/kitware.gpg >/dev/null
        echo 'deb https://apt.kitware.com/ubuntu/ focal main' | tee /etc/apt/sources.list.d/kitware.list >/dev/null
        apt-get update
        apt-get install -y cmake

    - name: Install Ubuntu Python
      if: runner.os == 'Linux'
      run: |
        apt-get install -y software-properties-common
        add-apt-repository ppa:deadsnakes/ppa
        apt-get update
        apt-get install -y curl python3.10
        ln -sf /usr/bin/python3.10 /usr/bin/python3
        curl -sS https://bootstrap.pypa.io/get-pip.py -o get-pip.py
        python3 get-pip.py
        python3 -m pip install --no-cache-dir --upgrade pip setuptools wheel

    - uses: actions/checkout@v4
      with:
        submodules: recursive
        fetch-depth: 0

    - name: Extract Version
      run: echo "VERSION=$(echo $GITHUB_REF | sed 's|refs/tags/||')" >> $GITHUB_ENV
      shell: bash

    - name: Install Sentry CLI
      run: |
        if [ "$RUNNER_OS" == "Windows" ]; then
          LATEST_VERSION=$(curl -s https://api.github.com/repos/getsentry/sentry-cli/releases/latest | jq -r .tag_name)
          curl -LO "https://github.com/getsentry/sentry-cli/releases/download/$LATEST_VERSION/sentry-cli-Windows-x86_64.exe"
          mv sentry-cli-Windows-x86_64.exe sentry-cli.exe

          ACTUAL_VERSION=$(./sentry-cli.exe -V 2>&1 | tr -d '\r')

          if [[ ! "$ACTUAL_VERSION" =~ ^sentry-cli ]]; then
            echo "Downloaded Sentry CLI binary is invalid!" >&2
            exit 1
          fi
        else
          curl -sL https://sentry.io/get-cli/ | bash
        fi
      shell: bash

    - name: Install Qt
      uses: jurplel/install-qt-action@v4
      with:
        version: ${{ matrix.qt }}
        arch: ${{ matrix.os == 'windows-latest' && matrix.qt == '5.15.2' && 'win32_msvc2019' || '' }}
        cache: true
        aqtversion: ==3.2.*
        modules: ${{ startsWith(matrix.qt, '6') && 'qtmultimedia qtimageformats debug_info' || 'debug_info' }}
        setup-python: ${{ matrix.os == 'ubuntu-latest' && 'false' || 'true' }}

    - name: ccache
      uses: hendrikmuhs/ccache-action@v1.2
      with:
        key: ${{ matrix.os }}-${{ matrix.qt }}

# =================================

    - name: Compile Ubuntu Sentry SDK
      if: runner.os == 'Linux'
      run: |
        git clone --recursive https://github.com/getsentry/sentry-native.git
        mkdir -p sentry-native/build
        cd sentry-native/build
        cmake .. -B build -D SENTRY_BACKEND=crashpad -D CMAKE_BUILD_TYPE=RelWithDebInfo -G Ninja
        cmake --build build
        cmake --install build --prefix ../../thirdparty/sentry

    - name: Build Ubuntu
      if: runner.os == 'Linux'
      run: |
        cmake -B build -G Ninja
        cmake --build build --config Release
        mkdir -p build/lib
        cp thirdparty/sentry/bin/crashpad_handler build/
        cp thirdparty/sentry/lib/libsentry.so build/lib/
        # Ensure crashpad_handler is executable
        chmod +x build/crashpad_handler

    - name: Test Ubuntu
      if: runner.os == 'Linux'
      run: |
        QT_QPA_PLATFORM=offscreen ./build/wiredpanda-test

    - name: linuxdeployqt
      if: runner.os == 'Linux'
      run: |
        mkdir -p appimage appimage/lib
        cp app/resources/wpanda.desktop appimage/wpanda.desktop
        cp app/resources/wpanda.svg appimage/wpanda_icon.svg
        cp build/wiredpanda appimage
        cp build/crashpad_handler appimage/
        cp thirdparty/sentry/lib/libsentry.so appimage/lib/
        wget https://github.com/probonopd/linuxdeployqt/releases/download/continuous/linuxdeployqt-continuous-x86_64.AppImage
        chmod +x ./linuxdeployqt-continuous-x86_64.AppImage
        ./linuxdeployqt-continuous-x86_64.AppImage --appimage-extract
        VERSION=$VERSION ./squashfs-root/usr/bin/linuxdeployqt ./appimage/wiredpanda -appimage
        rm ./linuxdeployqt-continuous-x86_64.AppImage
        mv wiRedPanda-$VERSION-x86_64.AppImage wiRedPanda-$VERSION-Ubuntu-Qt${{ matrix.qt }}.AppImage

    - name: Validate Ubuntu Release Artifacts
      if: runner.os == 'Linux'
      run: |
        # Verify AppImage exists and is executable
        if [ ! -f "wiRedPanda-$VERSION-Ubuntu-Qt${{ matrix.qt }}.AppImage" ]; then
          echo "Error: AppImage not found"
          exit 1
        fi

        # Verify AppImage build quality and structure
        chmod +x "wiRedPanda-$VERSION-Ubuntu-Qt${{ matrix.qt }}.AppImage"
        echo "Validating AppImage build quality..."

        # Check AppImage file properties
        APPIMAGE_FILE="wiRedPanda-$VERSION-Ubuntu-Qt${{ matrix.qt }}.AppImage"
        echo "AppImage file info:"
        ls -lh "$APPIMAGE_FILE"
        file "$APPIMAGE_FILE"

        # Extract AppImage to verify internal structure
        echo "Extracting AppImage to verify contents..."
        "./$APPIMAGE_FILE" --appimage-extract >/dev/null 2>&1
        if [ ! -d "squashfs-root" ]; then
          echo "Error: AppImage extraction failed - corrupt AppImage"
          exit 1
        fi

        echo "AppImage structure validation:"

        # Verify main executable exists and is properly linked
        if [ ! -f "squashfs-root/wiredpanda" ]; then
          echo "Error: Main executable missing from AppImage"
          exit 1
        fi

        echo "✓ Main executable: $(ls -lh squashfs-root/wiredpanda)"
        echo "✓ Executable type: $(file squashfs-root/wiredpanda)"

        # Check Qt libraries are bundled
        QT_LIBS_COUNT=$(find squashfs-root -name "libQt*.so*" | wc -l)
        echo "✓ Qt libraries found: $QT_LIBS_COUNT"
        if [ "$QT_LIBS_COUNT" -lt 3 ]; then
          echo "Warning: Few Qt libraries found, may cause runtime issues"
          find squashfs-root -name "libQt*.so*" | head -10
        fi

        # Verify desktop integration files
        if [ -f "squashfs-root/wpanda.desktop" ]; then
          echo "✓ Desktop integration file present"
        else
          echo "Warning: Desktop integration file missing"
        fi

        # Check dependencies are reasonable
        echo "✓ Executable dependencies (sample):"
        ldd squashfs-root/wiredpanda | head -10 | grep -v "not found" || echo "Some dependencies missing (may be normal)"

        echo "AppImage build quality validation completed successfully"

        # Verify required Sentry files are included
        if [ ! -f "appimage/lib/libsentry.so" ]; then
          echo "Error: Sentry library missing from AppImage"
          exit 1
        fi

        if [ ! -f "appimage/crashpad_handler" ]; then
          echo "Error: Crashpad handler missing from AppImage"
          exit 1
        fi

        # Log Sentry configuration for debugging
        echo "Sentry configuration check:"
        echo "  - libsentry.so: $(ls -la appimage/lib/libsentry.so)"
        echo "  - crashpad_handler: $(ls -la appimage/crashpad_handler)"
        echo "  - RPATH settings: $(objdump -p appimage/wiredpanda | grep RPATH || echo 'No RPATH found')"

        echo "Ubuntu release artifacts validated successfully"

    - name: Upload Ubuntu Debug Symbols to Sentry
      if: runner.os == 'Linux'
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      run: |
        git config --global --add safe.directory '*'
        sentry-cli login --auth-token "$SENTRY_AUTH_TOKEN"
        sentry-cli releases new "wiredpanda@$VERSION" -p wiredpanda
        sentry-cli debug-files upload --include-sources -p wiredpanda build/
        sentry-cli debug-files upload --include-sources -p wiredpanda $QT_ROOT_DIR
        sentry-cli releases set-commits --auto "wiredpanda@$VERSION" --log-level=debug

    - name: Publish Ubuntu
      uses: softprops/action-gh-release@v2
      if: runner.os == 'Linux'
      with:
        fail_on_unmatched_files: true
        files: '*.AppImage'

# =================================

    - name: Setup Windows MSVC Toolchain
      if: runner.os == 'Windows'
      uses: pbeast/gha-setup-vsdevenv@master
      with:
        arch: ${{ startsWith(matrix.qt, '5') && 'x86' || 'x64' }}

    - name: Compile Windows Sentry SDK
      if: runner.os == 'Windows'
      run: |
        git clone --recursive https://github.com/getsentry/sentry-native.git
        mkdir -p sentry-native/build
        cd sentry-native/build
        cmake .. -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo -G Ninja
        cmake --build build
        cmake --install build --prefix ../../thirdparty/sentry

    - name: Build Windows
      if: runner.os == 'Windows'
      run: |
        cmake -B build -G "Visual Studio 17 2022" -A ${{ startsWith(matrix.qt, '5') && 'Win32' || 'x64' }}
        cmake --build build --config Release
        cp thirdparty/sentry/bin/crashpad_handler.exe build/Release/
        cp thirdparty/sentry/bin/sentry.dll build/Release/
        cp thirdparty/sentry/bin/crashpad_wer.dll build/Release/

    - name: Test Windows
      if: runner.os == 'Windows'
      run: |
        cd build/Release
        powershell -Command "Start-Process -FilePath 'wiredpanda-test.exe' -Wait -NoNewWindow"

    - name: windeployqt
      if: runner.os == 'Windows'
      run : |
        # Create clean distribution directory
        cd build
        mkdir wiredpanda-$env:VERSION

        # Copy only essential files to clean directory
        cp Release/wiredpanda.exe wiredpanda-$env:VERSION/
        cp Release/crashpad_handler.exe wiredpanda-$env:VERSION/
        cp Release/sentry.dll wiredpanda-$env:VERSION/
        cp Release/crashpad_wer.dll wiredpanda-$env:VERSION/
        cp -r ../examples wiredpanda-$env:VERSION/

        # Run windeployqt in the clean directory
        cd wiredpanda-$env:VERSION
        windeployqt --compiler-runtime wiredpanda.exe

        # Create the ZIP from the clean directory
        cd ..
        Compress-Archive -Path wiredpanda-$env:VERSION -DestinationPath wiRedPanda-$env:VERSION-Windows-Qt${{ matrix.qt }}-Portable.zip

    - name: Validate Windows Release Artifacts
      if: runner.os == 'Windows'
      run: |
        # Verify ZIP file exists
        if (!(Test-Path "build/wiRedPanda-$env:VERSION-Windows-Qt${{ matrix.qt }}-Portable.zip")) {
          Write-Error "Error: Windows ZIP file not found"
          exit 1
        }

        # Verify executable exists in the extracted folder
        if (!(Test-Path "build/wiredpanda-$env:VERSION/wiredpanda.exe")) {
          Write-Error "Error: wiredpanda.exe not found in package"
          exit 1
        }

        # Verify required Sentry files are included
        if (!(Test-Path "build/wiredpanda-$env:VERSION/sentry.dll")) {
          Write-Error "Error: Sentry DLL missing from package"
          exit 1
        }

        if (!(Test-Path "build/wiredpanda-$env:VERSION/crashpad_handler.exe")) {
          Write-Error "Error: Crashpad handler missing from package"
          exit 1
        }

        # Validate Windows executable build quality
        Write-Output "Validating Windows executable build quality..."

        $executablePath = "build/wiredpanda-$env:VERSION/wiredpanda.exe"

        # Check executable file properties
        if (Test-Path $executablePath) {
          $fileInfo = Get-Item $executablePath
          Write-Output "✓ Executable file info:"
          Write-Output "  Size: $([math]::Round($fileInfo.Length / 1MB, 2)) MB"
          Write-Output "  Created: $($fileInfo.CreationTime)"
          Write-Output "  Modified: $($fileInfo.LastWriteTime)"
        } else {
          Write-Error "Error: Main executable not found"
          exit 1
        }

        # Check if executable is a valid PE file
        try {
          $peHeader = [System.IO.File]::ReadAllBytes($executablePath)[0..1]
          $peSignature = [System.Text.Encoding]::ASCII.GetString($peHeader)
          if ($peSignature -eq "MZ") {
            Write-Output "✓ Valid PE executable format"
          } else {
            Write-Output "Warning: Unexpected executable format"
          }
        } catch {
          Write-Output "Warning: Could not verify PE format"
        }

        # Check Qt DLLs are present
        $qtDlls = Get-ChildItem "build/wiredpanda-$env:VERSION" -Filter "Qt*.dll" | Measure-Object
        Write-Output "✓ Qt DLLs found: $($qtDlls.Count)"
        if ($qtDlls.Count -lt 3) {
          Write-Output "Warning: Few Qt DLLs found, may cause runtime issues"
          Get-ChildItem "build/wiredpanda-$env:VERSION" -Filter "Qt*.dll" | Select-Object Name, Length
        }

        # Check for required runtime libraries
        $requiredDlls = @("vcruntime*.dll", "msvcp*.dll")
        foreach ($pattern in $requiredDlls) {
          $found = Get-ChildItem "build/wiredpanda-$env:VERSION" -Filter $pattern | Measure-Object
          if ($found.Count -gt 0) {
            Write-Output "✓ Runtime libraries found: $pattern"
          } else {
            Write-Output "Warning: Runtime libraries not found: $pattern (may be system-provided)"
          }
        }

        # Verify examples directory
        if (Test-Path "build/wiredpanda-$env:VERSION/examples") {
          $exampleCount = (Get-ChildItem "build/wiredpanda-$env:VERSION/examples" -Recurse -File | Measure-Object).Count
          Write-Output "✓ Examples directory present with $exampleCount files"
        } else {
          Write-Output "Warning: Examples directory missing"
        }

        Write-Output "Windows build quality validation completed successfully"

        Write-Output "Windows release artifacts validated successfully"

    - name: Upload Windows Debug Symbols to Sentry
      if: runner.os == 'Windows'
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      run: |
        ./sentry-cli.exe login --auth-token $env:SENTRY_AUTH_TOKEN
        ./sentry-cli.exe releases new wiredpanda@$env:VERSION -p wiredpanda
        ./sentry-cli.exe debug-files upload --include-sources -p wiredpanda build/
        ./sentry-cli.exe debug-files upload --include-sources -p wiredpanda D:/a/wiRedPanda/Qt/
        ./sentry-cli.exe releases set-commits --auto wiredpanda@$env:VERSION --log-level=debug

    - name: Publish Windows
      if: runner.os == 'Windows'
      uses: softprops/action-gh-release@v2
      with:
        fail_on_unmatched_files: true
        files: 'build/*.zip'

# =================================

    - name: Compile macOS Sentry SDK
      if: runner.os == 'macOS'
      run: |
        git clone --recursive https://github.com/getsentry/sentry-native.git
        mkdir -p sentry-native/build
        cd sentry-native/build
        cmake .. -B build -D SENTRY_BACKEND=breakpad -D CMAKE_BUILD_TYPE=RelWithDebInfo -D CMAKE_OSX_ARCHITECTURES="x86_64;arm64" -G Ninja
        cmake --build build
        cmake --install build --prefix ../../thirdparty/sentry

    - name: Build macOS
      if: runner.os == 'macOS'
      run: |
        cmake -B build
        cmake --build build --config Release
        mkdir -p build/wiredpanda.app/Contents/MacOS
        mkdir -p build/wiredpanda.app/Contents/Frameworks
        # Copy the main executable to the app bundle
        cp build/wiredpanda build/wiredpanda.app/Contents/MacOS/
        # Note: breakpad backend doesn't generate crashpad_handler (in-process crash handling)
        cp thirdparty/sentry/lib/libsentry.dylib build/wiredpanda.app/Contents/Frameworks/

    - name: Generate macOS dSYM Symbols
      if: runner.os == 'macOS'
      run: |
        cd build
        dsymutil wiredpanda.app/Contents/MacOS/wiredpanda -o wiredpanda.app.dSYM

    - name: Test macOS
      if: runner.os == 'macOS'
      run: |
        ./build/wiredpanda-test

    - name: macdeployqt
      if: runner.os == 'macOS'
      run: |
        cd build

        # Verify app bundle structure before deployment
        echo "Verifying app bundle structure..."
        if [ ! -d "wiredpanda.app/Contents/MacOS" ]; then
          echo "Error: App bundle MacOS directory missing"
          exit 1
        fi

        # Ensure executable has proper permissions and is linked correctly
        chmod +x wiredpanda.app/Contents/MacOS/wiredpanda

        # Create Info.plist if missing (helps macdeployqt identify the bundle)
        if [ ! -f "wiredpanda.app/Contents/Info.plist" ]; then
          echo "Creating missing Info.plist..."
          cat > wiredpanda.app/Contents/Info.plist << 'INFOPLIST'
        <?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
        <plist version="1.0">
        <dict>
            <key>CFBundleExecutable</key>
            <string>wiredpanda</string>
            <key>CFBundleIdentifier</key>
            <string>com.wiredpanda.wiRedPanda</string>
            <key>CFBundleName</key>
            <string>wiRedPanda</string>
            <key>CFBundleVersion</key>
            <string>1.0</string>
            <key>CFBundlePackageType</key>
            <string>APPL</string>
        </dict>
        </plist>
        INFOPLIST
        fi

        # Show Qt installation path and verify it's accessible
        echo "Qt installation path: $QT_ROOT_DIR"
        echo "Qt binary path: $(which macdeployqt)"

        # Check what frameworks the executable currently links to
        echo "Current framework dependencies:"
        otool -L wiredpanda.app/Contents/MacOS/wiredpanda | head -20

        # Run macdeployqt with verbose output and additional options
        echo "Running macdeployqt with verbose output..."
        macdeployqt wiredpanda.app -verbose=2 -always-overwrite -dmg || {
          echo "macdeployqt failed, attempting with force option..."
          # If macdeployqt fails, try to manually copy Qt frameworks and try again
          mkdir -p wiredpanda.app/Contents/Frameworks

          # Find and copy critical Qt libraries that might be missing
          for qtlib in QtCore QtGui QtWidgets; do
            if [ -f "$QT_ROOT_DIR/lib/lib${qtlib}.dylib" ]; then
              echo "Manually copying $qtlib..."
              cp "$QT_ROOT_DIR/lib/lib${qtlib}.dylib" wiredpanda.app/Contents/Frameworks/ || true
            elif [ -f "$QT_ROOT_DIR/lib/${qtlib}.framework/${qtlib}" ]; then
              echo "Manually copying $qtlib framework..."
              cp -R "$QT_ROOT_DIR/lib/${qtlib}.framework" wiredpanda.app/Contents/Frameworks/ || true
            fi
          done

          # Try macdeployqt again after manual framework copying
          macdeployqt wiredpanda.app -verbose=2 -dmg
        }

        # Verify the DMG was created
        if [ ! -f "wiredpanda.dmg" ]; then
          echo "Error: DMG creation failed"
          ls -la
          exit 1
        fi

        mv wiredpanda.dmg wiRedPanda-$VERSION-macOS-Qt${{ matrix.qt }}.dmg

    - name: Validate macOS Release Artifacts
      if: runner.os == 'macOS'
      run: |
        # Verify DMG file exists
        if [ ! -f "build/wiRedPanda-$VERSION-macOS-Qt${{ matrix.qt }}.dmg" ]; then
          echo "Error: macOS DMG file not found"
          exit 1
        fi

        # Verify app bundle exists
        if [ ! -d "build/wiredpanda.app" ]; then
          echo "Error: wiredpanda.app bundle not found"
          exit 1
        fi

        # Verify executable exists in app bundle
        if [ ! -f "build/wiredpanda.app/Contents/MacOS/wiredpanda" ]; then
          echo "Error: wiredpanda executable not found in app bundle"
          exit 1
        fi

        # Verify required Sentry files are included (breakpad backend)
        if [ ! -f "build/wiredpanda.app/Contents/Frameworks/libsentry.dylib" ]; then
          echo "Error: Sentry library missing from app bundle"
          exit 1
        fi

        # CRITICAL: Verify Qt frameworks are properly deployed
        echo "Checking Qt framework deployment..."
        FRAMEWORKS_DIR="build/wiredpanda.app/Contents/Frameworks"
        MISSING_FRAMEWORKS=()

        # Check for essential Qt frameworks
        for framework in QtCore QtGui QtWidgets; do
          if [ ! -d "$FRAMEWORKS_DIR/${framework}.framework" ] && [ ! -f "$FRAMEWORKS_DIR/lib${framework}.dylib" ]; then
            MISSING_FRAMEWORKS+=("$framework")
          fi
        done

        if [ ${#MISSING_FRAMEWORKS[@]} -gt 0 ]; then
          echo "Error: Missing Qt frameworks: ${MISSING_FRAMEWORKS[*]}"
          echo "Contents of Frameworks directory:"
          ls -la "$FRAMEWORKS_DIR/" || echo "Frameworks directory not found"
          echo "Executable dependencies:"
          otool -L "build/wiredpanda.app/Contents/MacOS/wiredpanda" | grep -E "(Qt|@rpath)" || echo "No Qt dependencies found"
          exit 1
        fi

        # Verify frameworks are properly linked (no external Qt paths)
        echo "Verifying Qt framework linking..."
        EXTERNAL_QT_DEPS=$(otool -L "build/wiredpanda.app/Contents/MacOS/wiredpanda" | grep -E "/Users/.*/Qt|/usr/local.*/Qt" | wc -l)
        if [ "$EXTERNAL_QT_DEPS" -gt 0 ]; then
          echo "Warning: Found external Qt dependencies (may cause runtime issues):"
          otool -L "build/wiredpanda.app/Contents/MacOS/wiredpanda" | grep -E "/Users/.*/Qt|/usr/local.*/Qt"
        fi

        # Verify DMG contents by mounting it temporarily
        echo "Verifying DMG contents..."
        hdiutil attach "build/wiRedPanda-$VERSION-macOS-Qt${{ matrix.qt }}.dmg" -mountpoint /tmp/wiredpanda_dmg -readonly || {
          echo "Error: Failed to mount DMG for verification"
          exit 1
        }

        # Check if the app in DMG has Qt frameworks
        if [ ! -d "/tmp/wiredpanda_dmg/wiredpanda.app/Contents/Frameworks" ]; then
          echo "Error: DMG app bundle missing Frameworks directory"
          hdiutil detach /tmp/wiredpanda_dmg
          exit 1
        fi

        DMG_FRAMEWORKS_COUNT=$(find "/tmp/wiredpanda_dmg/wiredpanda.app/Contents/Frameworks" -name "*.framework" -o -name "*.dylib" | wc -l)
        echo "Found $DMG_FRAMEWORKS_COUNT frameworks/libraries in DMG"

        if [ "$DMG_FRAMEWORKS_COUNT" -lt 3 ]; then
          echo "Error: Insufficient frameworks in DMG (expected at least 3 Qt frameworks + Sentry)"
          echo "DMG Frameworks contents:"
          ls -la "/tmp/wiredpanda_dmg/wiredpanda.app/Contents/Frameworks/"
          hdiutil detach /tmp/wiredpanda_dmg
          exit 1
        fi

        hdiutil detach /tmp/wiredpanda_dmg

        # Verify dSYM symbols were generated
        if [ ! -d "build/wiredpanda.app.dSYM" ]; then
          echo "Error: dSYM symbols not found"
          exit 1
        fi

        # Validate macOS app bundle build quality
        echo "Validating macOS app bundle build quality..."

        # Check executable file properties
        EXECUTABLE_PATH="build/wiredpanda.app/Contents/MacOS/wiredpanda"
        if [ ! -f "$EXECUTABLE_PATH" ]; then
          echo "Error: Main executable missing from app bundle"
          exit 1
        fi

        echo "✓ Executable file info:"
        ls -lh "$EXECUTABLE_PATH"
        echo "✓ Executable type: $(file "$EXECUTABLE_PATH")"

        # Verify app bundle structure
        echo "✓ App bundle structure validation:"
        if [ -f "build/wiredpanda.app/Contents/Info.plist" ]; then
          echo "  ✓ Info.plist present"
        else
          echo "  Warning: Info.plist missing"
        fi

        if [ -d "build/wiredpanda.app/Contents/Resources" ]; then
          echo "  ✓ Resources directory present"
        else
          echo "  Warning: Resources directory missing"
        fi

        # Check framework dependencies and linking
        echo "✓ Framework dependencies (first 10):"
        otool -L "$EXECUTABLE_PATH" | head -10

        # Verify Qt frameworks are bundled (not external)
        EXTERNAL_QT=$(otool -L "$EXECUTABLE_PATH" | grep -E "/Users/.*/Qt|/usr/local.*/Qt" | wc -l)
        if [ "$EXTERNAL_QT" -eq 0 ]; then
          echo "✓ No external Qt dependencies found (properly bundled)"
        else
          echo "Warning: Found $EXTERNAL_QT external Qt dependencies:"
          otool -L "$EXECUTABLE_PATH" | grep -E "/Users/.*/Qt|/usr/local.*/Qt"
        fi

        # Check architecture
        ARCH_INFO=$(file "$EXECUTABLE_PATH" | grep -o "x86_64\|arm64\|universal")
        echo "✓ Architecture: $ARCH_INFO"

        # Verify code signing (basic check)
        CODESIGN_STATUS=$(codesign -dv "$EXECUTABLE_PATH" 2>&1 | grep -o "adhoc\|signed" || echo "unsigned")
        echo "✓ Code signing status: $CODESIGN_STATUS"

        echo "macOS build quality validation completed successfully"

        # Log Sentry configuration for debugging (breakpad backend)
        echo "Sentry configuration check:"
        echo "  - libsentry.dylib: $(ls -la build/wiredpanda.app/Contents/Frameworks/libsentry.dylib)"
        echo "  - Backend: breakpad (in-process, no separate handler required)"
        echo "  - dylib dependencies: $(otool -L build/wiredpanda.app/Contents/MacOS/wiredpanda | grep sentry || echo 'No sentry dylib dependency found')"

        echo "macOS release artifacts validated successfully"

    - name: Upload macOS Debug Symbols to Sentry
      if: runner.os == 'macOS'
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      run: |
        sentry-cli login --auth-token "$SENTRY_AUTH_TOKEN"
        sentry-cli releases new "wiredpanda@$VERSION" -p wiredpanda
        sentry-cli debug-files upload --include-sources -p wiredpanda build/
        sentry-cli debug-files upload --include-sources -p wiredpanda $QT_ROOT_DIR
        sentry-cli releases set-commits --auto "wiredpanda@$VERSION" --log-level=debug

    - name: Publish macOS
      if: runner.os == 'macOS'
      uses: softprops/action-gh-release@v2
      with:
        fail_on_unmatched_files: true
        files: 'build/*.dmg'