From 5bfc8a636a786adfeb0a0485416a124d835abc41 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 18:24:16 -0400
Subject: [PATCH 01/57] [Infra] Common cocoapods pod lib lint job

---
 .github/workflows/abtesting.yml        | 41 ++-------------
 .github/workflows/common_cocoapods.yml | 72 ++++++++++++++++++++++++++
 2 files changed, 77 insertions(+), 36 deletions(-)
 create mode 100644 .github/workflows/common_cocoapods.yml

diff --git a/.github/workflows/abtesting.yml b/.github/workflows/abtesting.yml
index bdf390a761a..77cb2317861 100644
--- a/.github/workflows/abtesting.yml
+++ b/.github/workflows/abtesting.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseABTesting**'
     - 'Interop/Analytics/Public/*.h'
     - '.github/workflows/abtesting.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 1am(PST) - cron uses UTC times
@@ -29,42 +31,9 @@ jobs:
       target: FirebaseABTesting-Unit-unit
 
   pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-            target: ios
-          - os: macos-15
-            xcode: Xcode_16.2
-            target: ios
-          - os: macos-15
-            xcode: Xcode_16.2
-            target: tvos
-          - os: macos-15
-            xcode: Xcode_16.2
-            target: macos
-          - os: macos-15
-            xcode: Xcode_16.2
-            target: watchos
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      with:
-        timeout_minutes: 120
-        max_attempts: 3
-        retry_on: error
-        retry_wait_seconds: 120
-        command: scripts/pod_lib_lint.rb FirebaseABTesting.podspec --platforms=${{ matrix.target }}
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseABTesting
 
   quickstart:
     # Don't run on private repo unless it is a PR.
diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
new file mode 100644
index 00000000000..0f91417d889
--- /dev/null
+++ b/.github/workflows/common_cocoapods.yml
@@ -0,0 +1,72 @@
+name: common_cocoapods
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      # The product to test be tested (e.g. `FirebaseABTesting`).
+      product:
+        type: string
+        required: true
+
+//      # The platforms to build on. Defaults to all.
+//      # To target specific platforms, pass a comma or space separated string of
+//      # platforms.
+//      #
+//      # Examples:
+//      # - build/test only for macOS: `macOS`
+//      # - build/test only for macOS and tvOS: `macOS, tvOS`
+//      platforms:
+//        type: string
+//        required: false
+//        default: "iOS, tvOS, macOS, watchOS, catalyst, visionOS"
+
+//      # By default, all platforms will be tested (see matrix in `spm` job).
+//      # To build instead of test, pass a comma or space separated string of
+//      # platforms.
+//      #
+//      # Platform options: [iOS, tvOS, macOS, watchOS, catalyst, visionOS]
+//      #
+//      # Note: Build-only platforms must be represented in the `platforms` input
+//      # (which defaults to all platforms) in order to take effect.
+//      #
+//      # Examples:
+//      # - build only for macOS: `macOS`
+//      # - build only for macOS and tvOS: `macOS, tvOS`
+//      # - build only for all platforms: `all`
+//      buildonly_platforms:
+//       type: string
+//       required: false
+//       default: ""
+
+jobs:
+  pod-lib-lint:
+    # Run on the main repo's scheduled jobs or pull requests and manual workflow invocations.
+    if: (github.repository == 'firebase/firebase-ios-sdk' && github.event_name == 'schedule') || contains(fromJSON('["pull_request", "workflow_dispatch"]'), github.event_name)
+    strategy:
+      matrix:
+        os: macos-15
+        xcode: Xcode_16.3
+        platform: [iOS, tvOS, macOS, watchOS]
+        include:
+          - os: macos-14
+            xcode: Xcode_16.2
+            platform: iOS
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+    - name: Setup Bundler
+      run: scripts/setup_bundler.sh
+    - name: Xcode
+      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
+    - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
+      if: contains(join(inputs.platforms), matrix.platform) || matrix.os == 'macos-14'
+      with:
+        timeout_minutes: 120
+        max_attempts: 3
+        retry_on: error
+        retry_wait_seconds: 120
+            command: scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }}

From e552608621854404d40ede201e99152d6da9a0e9 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 18:24:34 -0400
Subject: [PATCH 02/57] tmp disable

---
 .github/workflows/abtesting.yml | 186 ++++++++++++++++----------------
 1 file changed, 93 insertions(+), 93 deletions(-)

diff --git a/.github/workflows/abtesting.yml b/.github/workflows/abtesting.yml
index 77cb2317861..f6dbc4a737e 100644
--- a/.github/workflows/abtesting.yml
+++ b/.github/workflows/abtesting.yml
@@ -24,96 +24,96 @@ jobs:
     with:
       target: ABTestingUnit
 
-  catalyst:
-    uses: ./.github/workflows/common_catalyst.yml
-    with:
-      product: FirebaseABTesting
-      target: FirebaseABTesting-Unit-unit
-
-  pod-lib-lint:
-    uses: ./.github/workflows/common_cocoapods.yml
-    with:
-      product: FirebaseABTesting
-
-  quickstart:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    env:
-      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-    runs-on: macos-15
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-    - name: Setup quickstart
-      env:
-        LEGACY: true
-      run: scripts/setup_quickstart.sh abtesting
-    - name: Install Secret GoogleService-Info.plist
-      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
-          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
-    - name: Test swift quickstart
-      env:
-        LEGACY: true
-      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart.sh ABTesting true)
-
-  quickstart-ftl-cron-only:
-    # Don't run on private repo.
-    if: github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule'
-
-    env:
-      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-    runs-on: macos-15
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.11'
-    - name: Setup quickstart
-      env:
-        LEGACY: true
-      run: scripts/setup_quickstart.sh abtesting
-    - name: Install Secret GoogleService-Info.plist
-      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
-          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-    - name: Build swift quickstart
-      env:
-        LEGACY: true
-      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart_ftl.sh ABTesting)
-    - id: ftl_test
-      uses: FirebaseExtended/github-actions/firebase-test-lab@v1.4
-      with:
-        credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
-        testapp_dir: quickstart-ios/build-for-testing
-        test_type: "xctest"
-
-  abtesting-cron-only:
-    # Don't run on private repo.
-    if: github.event_name == 'schedule' && github.repository == 'Firebase/firebase-ios-sdk'
-
-    runs-on: macos-15
-    strategy:
-      matrix:
-        target: [ios, tvos, macos]
-        flags: [
-          '--use-static-frameworks'
-        ]
-    needs: pod-lib-lint
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-    - name: PodLibLint ABTesting Cron
-      run: |
-        scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb \
-          FirebaseABTesting.podspec --platforms=${{ matrix.target }} ${{ matrix.flags }}
+#  catalyst:
+#    uses: ./.github/workflows/common_catalyst.yml
+#    with:
+#      product: FirebaseABTesting
+#      target: FirebaseABTesting-Unit-unit
+#
+#  pod-lib-lint:
+#    uses: ./.github/workflows/common_cocoapods.yml
+#    with:
+#      product: FirebaseABTesting
+#
+#  quickstart:
+#    # Don't run on private repo unless it is a PR.
+#    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
+#
+#    env:
+#      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+#      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+#    runs-on: macos-15
+#    steps:
+#    - uses: actions/checkout@v4
+#    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+#    - name: Xcode
+#      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+#    - name: Setup quickstart
+#      env:
+#        LEGACY: true
+#      run: scripts/setup_quickstart.sh abtesting
+#    - name: Install Secret GoogleService-Info.plist
+#      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
+#          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
+#    - name: Test swift quickstart
+#      env:
+#        LEGACY: true
+#      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart.sh ABTesting true)
+#
+#  quickstart-ftl-cron-only:
+#    # Don't run on private repo.
+#    if: github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule'
+#
+#    env:
+#      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+#      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+#    runs-on: macos-15
+#    steps:
+#    - uses: actions/checkout@v4
+#    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+#    - uses: actions/setup-python@v5
+#      with:
+#        python-version: '3.11'
+#    - name: Setup quickstart
+#      env:
+#        LEGACY: true
+#      run: scripts/setup_quickstart.sh abtesting
+#    - name: Install Secret GoogleService-Info.plist
+#      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
+#          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
+#    - name: Xcode
+#      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+#    - name: Build swift quickstart
+#      env:
+#        LEGACY: true
+#      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart_ftl.sh ABTesting)
+#    - id: ftl_test
+#      uses: FirebaseExtended/github-actions/firebase-test-lab@v1.4
+#      with:
+#        credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
+#        testapp_dir: quickstart-ios/build-for-testing
+#        test_type: "xctest"
+#
+#  abtesting-cron-only:
+#    # Don't run on private repo.
+#    if: github.event_name == 'schedule' && github.repository == 'Firebase/firebase-ios-sdk'
+#
+#    runs-on: macos-15
+#    strategy:
+#      matrix:
+#        target: [ios, tvos, macos]
+#        flags: [
+#          '--use-static-frameworks'
+#        ]
+#    needs: pod-lib-lint
+#    steps:
+#    - uses: actions/checkout@v4
+#    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+#    - name: Setup Bundler
+#      run: scripts/setup_bundler.sh
+#    - name: Xcode
+#      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+#    - name: PodLibLint ABTesting Cron
+#      run: |
+#        scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb \
+#          FirebaseABTesting.podspec --platforms=${{ matrix.target }} ${{ matrix.flags }}

From a86fed318100fcf310a24ed00bcfb469ae70225a Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:11:08 -0400
Subject: [PATCH 03/57] fix debug approach

---
 .github/workflows/abtesting.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/abtesting.yml b/.github/workflows/abtesting.yml
index f6dbc4a737e..f999352d7a7 100644
--- a/.github/workflows/abtesting.yml
+++ b/.github/workflows/abtesting.yml
@@ -19,21 +19,21 @@ concurrency:
     cancel-in-progress: true
 
 jobs:
-  spm:
-    uses: ./.github/workflows/common.yml
-    with:
-      target: ABTestingUnit
-
+#  spm:
+#    uses: ./.github/workflows/common.yml
+#    with:
+#      target: ABTestingUnit
+#
 #  catalyst:
 #    uses: ./.github/workflows/common_catalyst.yml
 #    with:
 #      product: FirebaseABTesting
 #      target: FirebaseABTesting-Unit-unit
 #
-#  pod-lib-lint:
-#    uses: ./.github/workflows/common_cocoapods.yml
-#    with:
-#      product: FirebaseABTesting
+  pod-lib-lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseABTesting
 #
 #  quickstart:
 #    # Don't run on private repo unless it is a PR.

From 25183fd3cd04b5a4364d45eca9d7c4af79c3e240 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:37:28 -0400
Subject: [PATCH 04/57] fix?

---
 .github/workflows/common_cocoapods.yml | 56 +++++++++++++-------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 0f91417d889..b61dbdcbae0 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -11,35 +11,35 @@ on:
         type: string
         required: true
 
-//      # The platforms to build on. Defaults to all.
-//      # To target specific platforms, pass a comma or space separated string of
-//      # platforms.
-//      #
-//      # Examples:
-//      # - build/test only for macOS: `macOS`
-//      # - build/test only for macOS and tvOS: `macOS, tvOS`
-//      platforms:
-//        type: string
-//        required: false
-//        default: "iOS, tvOS, macOS, watchOS, catalyst, visionOS"
+      # The platforms to build on. Defaults to all.
+      # To target specific platforms, pass a comma or space separated string of
+      # platforms.
+      #
+      # Examples:
+      # - build/test only for macOS: `macOS`
+      # - build/test only for macOS and tvOS: `macOS, tvOS`
+      platforms:
+        type: string
+        required: false
+        default: "iOS, tvOS, macOS, watchOS, catalyst, visionOS"
 
-//      # By default, all platforms will be tested (see matrix in `spm` job).
-//      # To build instead of test, pass a comma or space separated string of
-//      # platforms.
-//      #
-//      # Platform options: [iOS, tvOS, macOS, watchOS, catalyst, visionOS]
-//      #
-//      # Note: Build-only platforms must be represented in the `platforms` input
-//      # (which defaults to all platforms) in order to take effect.
-//      #
-//      # Examples:
-//      # - build only for macOS: `macOS`
-//      # - build only for macOS and tvOS: `macOS, tvOS`
-//      # - build only for all platforms: `all`
-//      buildonly_platforms:
-//       type: string
-//       required: false
-//       default: ""
+      # By default, all platforms will be tested (see matrix in `spm` job).
+      # To build instead of test, pass a comma or space separated string of
+      # platforms.
+      #
+      # Platform options: [iOS, tvOS, macOS, watchOS, catalyst, visionOS]
+      #
+      # Note: Build-only platforms must be represented in the `platforms` input
+      # (which defaults to all platforms) in order to take effect.
+      #
+      # Examples:
+      # - build only for macOS: `macOS`
+      # - build only for macOS and tvOS: `macOS, tvOS`
+      # - build only for all platforms: `all`
+      buildonly_platforms:
+       type: string
+       required: false
+       default: ""
 
 jobs:
   pod-lib-lint:

From 8012322ac90bc1945db03602356a782212371898 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:43:36 -0400
Subject: [PATCH 05/57] debug

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index b61dbdcbae0..3f280c8334c 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -69,4 +69,4 @@ jobs:
         max_attempts: 3
         retry_on: error
         retry_wait_seconds: 120
-            command: scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }}
+            command: echo "${{ inputs.product }}.podspec"; echo ${{ inputs.product }}; scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }}

From 5ed93823db870c28f1b4a894ece50b4b8fd54e89 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:46:07 -0400
Subject: [PATCH 06/57] fix?

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 3f280c8334c..f11391edbde 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -69,4 +69,4 @@ jobs:
         max_attempts: 3
         retry_on: error
         retry_wait_seconds: 120
-            command: echo "${{ inputs.product }}.podspec"; echo ${{ inputs.product }}; scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }}
+            command: scripts/pod_lib_lint.rb "${{ inputs.product }}.podspec" --platforms=${{ matrix.platform }}

From 8ba29f083d2c6540b1a5f10e3f70b65973902740 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:48:09 -0400
Subject: [PATCH 07/57] fix?

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index f11391edbde..0ea0ba5bf0e 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -69,4 +69,4 @@ jobs:
         max_attempts: 3
         retry_on: error
         retry_wait_seconds: 120
-            command: scripts/pod_lib_lint.rb "${{ inputs.product }}.podspec" --platforms=${{ matrix.platform }}
+        command: scripts/pod_lib_lint.rb "${{ inputs.product }}.podspec" --platforms=${{ matrix.platform }}

From eef376da95b13aa274191aaea05527e7241acf75 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:51:09 -0400
Subject: [PATCH 08/57] fix?

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 0ea0ba5bf0e..8ed2939a97b 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -69,4 +69,4 @@ jobs:
         max_attempts: 3
         retry_on: error
         retry_wait_seconds: 120
-        command: scripts/pod_lib_lint.rb "${{ inputs.product }}.podspec" --platforms=${{ matrix.platform }}
+        command: scripts/pod_lib_lint.rb ${{ inputs.product }}\".podspec" --platforms=${{ matrix.platform }}

From 9555ece62cfa92730efa23bf06c518b855d51cdf Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:52:13 -0400
Subject: [PATCH 09/57] i

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 8ed2939a97b..4150bd59b5d 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -69,4 +69,4 @@ jobs:
         max_attempts: 3
         retry_on: error
         retry_wait_seconds: 120
-        command: scripts/pod_lib_lint.rb ${{ inputs.product }}\".podspec" --platforms=${{ matrix.platform }}
+        command: echo "${{ inputs.product }}"

From b413c54b085eae606acf7bd4b2a570bc9f5c43f8 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 20:53:51 -0400
Subject: [PATCH 10/57] gotcha

---
 .github/workflows/common_cocoapods.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 4150bd59b5d..5985ea1248a 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -47,8 +47,8 @@ jobs:
     if: (github.repository == 'firebase/firebase-ios-sdk' && github.event_name == 'schedule') || contains(fromJSON('["pull_request", "workflow_dispatch"]'), github.event_name)
     strategy:
       matrix:
-        os: macos-15
-        xcode: Xcode_16.3
+        os: [macos-15]
+        xcode: [Xcode_16.3]
         platform: [iOS, tvOS, macOS, watchOS]
         include:
           - os: macos-14
@@ -69,4 +69,4 @@ jobs:
         max_attempts: 3
         retry_on: error
         retry_wait_seconds: 120
-        command: echo "${{ inputs.product }}"
+        command: scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }}

From 5b98f529019025cbee5cd4e9eb5c787f343b70ad Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 21:06:25 -0400
Subject: [PATCH 11/57] more

---
 .github/workflows/abtesting.yml          | 190 +++++++++++------------
 .github/workflows/common_cocoapods.yml   |   6 +-
 .github/workflows/dynamiclinks.yml       |  25 +--
 .github/workflows/firebase_app_check.yml |  25 +--
 4 files changed, 111 insertions(+), 135 deletions(-)

diff --git a/.github/workflows/abtesting.yml b/.github/workflows/abtesting.yml
index f999352d7a7..72777d6304c 100644
--- a/.github/workflows/abtesting.yml
+++ b/.github/workflows/abtesting.yml
@@ -19,101 +19,101 @@ concurrency:
     cancel-in-progress: true
 
 jobs:
-#  spm:
-#    uses: ./.github/workflows/common.yml
-#    with:
-#      target: ABTestingUnit
-#
-#  catalyst:
-#    uses: ./.github/workflows/common_catalyst.yml
-#    with:
-#      product: FirebaseABTesting
-#      target: FirebaseABTesting-Unit-unit
-#
-  pod-lib-lint:
+  spm:
+    uses: ./.github/workflows/common.yml
+    with:
+      target: ABTestingUnit
+
+  catalyst:
+    uses: ./.github/workflows/common_catalyst.yml
+    with:
+      product: FirebaseABTesting
+      target: FirebaseABTesting-Unit-unit
+
+  pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseABTesting
-#
-#  quickstart:
-#    # Don't run on private repo unless it is a PR.
-#    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-#
-#    env:
-#      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-#      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-#    runs-on: macos-15
-#    steps:
-#    - uses: actions/checkout@v4
-#    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-#    - name: Xcode
-#      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-#    - name: Setup quickstart
-#      env:
-#        LEGACY: true
-#      run: scripts/setup_quickstart.sh abtesting
-#    - name: Install Secret GoogleService-Info.plist
-#      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
-#          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
-#    - name: Test swift quickstart
-#      env:
-#        LEGACY: true
-#      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart.sh ABTesting true)
-#
-#  quickstart-ftl-cron-only:
-#    # Don't run on private repo.
-#    if: github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule'
-#
-#    env:
-#      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-#      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-#    runs-on: macos-15
-#    steps:
-#    - uses: actions/checkout@v4
-#    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-#    - uses: actions/setup-python@v5
-#      with:
-#        python-version: '3.11'
-#    - name: Setup quickstart
-#      env:
-#        LEGACY: true
-#      run: scripts/setup_quickstart.sh abtesting
-#    - name: Install Secret GoogleService-Info.plist
-#      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
-#          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
-#    - name: Xcode
-#      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-#    - name: Build swift quickstart
-#      env:
-#        LEGACY: true
-#      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart_ftl.sh ABTesting)
-#    - id: ftl_test
-#      uses: FirebaseExtended/github-actions/firebase-test-lab@v1.4
-#      with:
-#        credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
-#        testapp_dir: quickstart-ios/build-for-testing
-#        test_type: "xctest"
-#
-#  abtesting-cron-only:
-#    # Don't run on private repo.
-#    if: github.event_name == 'schedule' && github.repository == 'Firebase/firebase-ios-sdk'
-#
-#    runs-on: macos-15
-#    strategy:
-#      matrix:
-#        target: [ios, tvos, macos]
-#        flags: [
-#          '--use-static-frameworks'
-#        ]
-#    needs: pod-lib-lint
-#    steps:
-#    - uses: actions/checkout@v4
-#    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-#    - name: Setup Bundler
-#      run: scripts/setup_bundler.sh
-#    - name: Xcode
-#      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-#    - name: PodLibLint ABTesting Cron
-#      run: |
-#        scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb \
-#          FirebaseABTesting.podspec --platforms=${{ matrix.target }} ${{ matrix.flags }}
+
+  quickstart:
+    # Don't run on private repo unless it is a PR.
+    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
+
+    env:
+      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+    runs-on: macos-15
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+    - name: Xcode
+      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+    - name: Setup quickstart
+      env:
+        LEGACY: true
+      run: scripts/setup_quickstart.sh abtesting
+    - name: Install Secret GoogleService-Info.plist
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
+          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
+    - name: Test swift quickstart
+      env:
+        LEGACY: true
+      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart.sh ABTesting true)
+
+  quickstart-ftl-cron-only:
+    # Don't run on private repo.
+    if: github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule'
+
+    env:
+      plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+      signin_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
+    runs-on: macos-15
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+    - name: Setup quickstart
+      env:
+        LEGACY: true
+      run: scripts/setup_quickstart.sh abtesting
+    - name: Install Secret GoogleService-Info.plist
+      run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-abtesting.plist.gpg \
+          quickstart-ios/abtesting/GoogleService-Info.plist "$plist_secret"
+    - name: Xcode
+      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+    - name: Build swift quickstart
+      env:
+        LEGACY: true
+      run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart_ftl.sh ABTesting)
+    - id: ftl_test
+      uses: FirebaseExtended/github-actions/firebase-test-lab@v1.4
+      with:
+        credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
+        testapp_dir: quickstart-ios/build-for-testing
+        test_type: "xctest"
+
+  abtesting-cron-only:
+    # Don't run on private repo.
+    if: github.event_name == 'schedule' && github.repository == 'Firebase/firebase-ios-sdk'
+
+    runs-on: macos-15
+    strategy:
+      matrix:
+        target: [ios, tvos, macos]
+        flags: [
+          '--use-static-frameworks'
+        ]
+    needs: pod-lib-lint
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+    - name: Setup Bundler
+      run: scripts/setup_bundler.sh
+    - name: Xcode
+      run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
+    - name: PodLibLint ABTesting Cron
+      run: |
+        scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb \
+          FirebaseABTesting.podspec --platforms=${{ matrix.target }} ${{ matrix.flags }}
diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 5985ea1248a..d695e76695b 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -21,7 +21,7 @@ on:
       platforms:
         type: string
         required: false
-        default: "iOS, tvOS, macOS, watchOS, catalyst, visionOS"
+        default: "iOS, tvOS, macOS, watchOS"
 
       # By default, all platforms will be tested (see matrix in `spm` job).
       # To build instead of test, pass a comma or space separated string of
@@ -69,4 +69,6 @@ jobs:
         max_attempts: 3
         retry_on: error
         retry_wait_seconds: 120
-        command: scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }}
+        command: |
+          scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }} \
+            ${{ (contains(inputs.buildonly_platforms, matrix.platform) || contains(inputs.buildonly_platforms, 'all')) && '--skip-tests' || '' }}
diff --git a/.github/workflows/dynamiclinks.yml b/.github/workflows/dynamiclinks.yml
index f13dacfd968..06de8df0425 100644
--- a/.github/workflows/dynamiclinks.yml
+++ b/.github/workflows/dynamiclinks.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseDynamicLinks**'
     - '.github/workflows/dynamiclinks.yml'
     - 'Interop/Analytics/Public/*.h'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 1am (PST) - cron uses UTC times
@@ -28,26 +30,9 @@ jobs:
       platforms: iOS
 
   pod_lib_lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.2
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - name: FirebaseDynamicLinks
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseDynamicLinks.podspec --allow-warnings
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: '--allow-warnings FirebaseDynamicLinks'
 
   dynamiclinks-cron-only:
     # Don't run on private repo.
diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index aca14b2671b..85996f339b3 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -6,6 +6,8 @@ on:
     paths:
     - 'FirebaseAppCheck**'
     - '.github/workflows/firebase_app_check.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 11pm (PST) - cron uses UTC times
@@ -31,29 +33,16 @@ jobs:
       target: FirebaseAppCheck-Unit-unit
 
   pod_lib_lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
     strategy:
       matrix:
-        podspec: [FirebaseAppCheckInterop.podspec, FirebaseAppCheck.podspec]
-        target: [ios, tvos, macos --skip-tests, watchos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.2
-    runs-on: ${{ matrix.build-env.os }}
+        product: [FirebaseAppCheckInterop, FirebaseAppCheck]
     steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
     - name: Configure test keychain
       run: scripts/configure_test_keychain.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: FirebaseAppCheck
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec }} --platforms=${{ matrix.target }}
+    - uses: ./.github/workflows/common_cocoapods.yml
+      with:
+        product: ${{  matrix.product }}
+        buildonly_platforms: macOS
 
   diagnostics:
     # Don't run on private repo unless it is a PR.

From 8c8e3cbefc80b2b9e192b0625434903d489a6a34 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 21:07:58 -0400
Subject: [PATCH 12/57] t

---
 .github/workflows/firebase_app_check.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index 85996f339b3..3551f973481 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -36,6 +36,7 @@ jobs:
     strategy:
       matrix:
         product: [FirebaseAppCheckInterop, FirebaseAppCheck]
+    runs-on: macos-15
     steps:
     - name: Configure test keychain
       run: scripts/configure_test_keychain.sh

From 6ec836c87d3a63444c132ef38164d97af60674cf Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 20 May 2025 21:09:22 -0400
Subject: [PATCH 13/57] t

---
 .github/workflows/firebase_app_check.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index 3551f973481..5cedf02f914 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -38,6 +38,7 @@ jobs:
         product: [FirebaseAppCheckInterop, FirebaseAppCheck]
     runs-on: macos-15
     steps:
+    - uses: actions/checkout@v4
     - name: Configure test keychain
       run: scripts/configure_test_keychain.sh
     - uses: ./.github/workflows/common_cocoapods.yml

From 6d6512e7376004fc9f3ac5be31357fa8c697a7f4 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 10:01:35 -0400
Subject: [PATCH 14/57] try again

---
 .github/workflows/firebase_app_check.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index 5cedf02f914..4f8a49de97b 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -36,12 +36,11 @@ jobs:
     strategy:
       matrix:
         product: [FirebaseAppCheckInterop, FirebaseAppCheck]
-    runs-on: macos-15
-    steps:
-    - uses: actions/checkout@v4
-    - name: Configure test keychain
-      run: scripts/configure_test_keychain.sh
-    - uses: ./.github/workflows/common_cocoapods.yml
+#    steps:
+#    - uses: actions/checkout@v4
+#    - name: Configure test keychain
+#      run: scripts/configure_test_keychain.sh
+    uses: ./.github/workflows/common_cocoapods.yml
       with:
         product: ${{  matrix.product }}
         buildonly_platforms: macOS

From 305ac97457159c5a14ce5b1aa01b4ff528b7a8f0 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 10:05:57 -0400
Subject: [PATCH 15/57] more

---
 .github/workflows/abtesting.yml          | 2 +-
 .github/workflows/firebase_app_check.yml | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/abtesting.yml b/.github/workflows/abtesting.yml
index 72777d6304c..fbfcf95a662 100644
--- a/.github/workflows/abtesting.yml
+++ b/.github/workflows/abtesting.yml
@@ -105,7 +105,7 @@ jobs:
         flags: [
           '--use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index 4f8a49de97b..36cb2717478 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -41,9 +41,9 @@ jobs:
 #    - name: Configure test keychain
 #      run: scripts/configure_test_keychain.sh
     uses: ./.github/workflows/common_cocoapods.yml
-      with:
-        product: ${{  matrix.product }}
-        buildonly_platforms: macOS
+    with:
+      product: ${{  matrix.product }}
+      buildonly_platforms: macOS
 
   diagnostics:
     # Don't run on private repo unless it is a PR.

From 3a89fde2957cdf1e01ed1b07204d2642c2fab6cf Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 10:16:24 -0400
Subject: [PATCH 16/57] more progress

---
 .github/workflows/auth.yml           | 39 ++++++++++------------------
 .github/workflows/inappmessaging.yml | 29 ++++++---------------
 2 files changed, 21 insertions(+), 47 deletions(-)

diff --git a/.github/workflows/auth.yml b/.github/workflows/auth.yml
index 1f2055c1499..28035ae6e0f 100644
--- a/.github/workflows/auth.yml
+++ b/.github/workflows/auth.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseAuth**'
     - 'FirebaseAuth/Interop/*.h'
     - '.github/workflows/auth.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'scripts/gha-encrypted/AuthSample/SwiftApplication.plist.gpg'
     - 'Gemfile*'
   schedule:
@@ -33,34 +35,19 @@ jobs:
       product: FirebaseAuth
       target: FirebaseAuth-Unit-unit
       buildonly: true
-
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
+        
+  pod_lib_lint:
     strategy:
       matrix:
-        podspec: [FirebaseAuthInterop.podspec, FirebaseAuth.podspec]
-        target: [ios, tvos, macos --skip-tests, watchos]
-        os: [macos-15]
-        xcode: [Xcode_16.3]
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Configure test keychain
-      run: scripts/configure_test_keychain.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      with:
-        timeout_minutes: 120
-        max_attempts: 3
-        retry_on: error
-        retry_wait_seconds: 120
-        command: scripts/pod_lib_lint.rb ${{ matrix.podspec }} --platforms=${{ matrix.target }} ${{ matrix.tests }}
+        product: [FirebaseAuthInterop, FirebaseAuth]
+#    steps:
+#    - uses: actions/checkout@v4
+#    - name: Configure test keychain
+#      run: scripts/configure_test_keychain.sh
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: ${{  matrix.product }}
+      buildonly_platforms: macOS
 
   spm-package-resolved:
     env:
diff --git a/.github/workflows/inappmessaging.yml b/.github/workflows/inappmessaging.yml
index 363b0f16ba6..3d38b4f290e 100644
--- a/.github/workflows/inappmessaging.yml
+++ b/.github/workflows/inappmessaging.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseInAppMessaging**'
     - 'Interop/Analytics/Public/*.h'
     - '.github/workflows/inappmessaging.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 10pm (PST) - cron uses UTC times
@@ -25,27 +27,12 @@ jobs:
       buildonly_platforms: iOS
 
   pod_lib_lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        podspec: [FirebaseInAppMessaging.podspec]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.2
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: FirebaseInAppMessaging
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec}}
+#    - name: FirebaseInAppMessaging
+#      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec}}
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseInAppMessaging
+      buildonly_platforms: macOS
 
   tests:
     # Don't run on private repo unless it is a PR.

From c788326348218a8655705e0f9b1f27ad2d788508 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 11:49:03 -0400
Subject: [PATCH 17/57] remove trailing space

---
 .github/workflows/auth.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/auth.yml b/.github/workflows/auth.yml
index 28035ae6e0f..943b7f34dbd 100644
--- a/.github/workflows/auth.yml
+++ b/.github/workflows/auth.yml
@@ -35,7 +35,7 @@ jobs:
       product: FirebaseAuth
       target: FirebaseAuth-Unit-unit
       buildonly: true
-        
+
   pod_lib_lint:
     strategy:
       matrix:

From ca431c2619163674f9401dc2856bac132d9953d9 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 11:59:44 -0400
Subject: [PATCH 18/57] add warnings support

---
 .github/workflows/common_cocoapods.yml | 7 +++++++
 .github/workflows/dynamiclinks.yml     | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index d695e76695b..fe442e0a1bc 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -41,6 +41,12 @@ on:
        required: false
        default: ""
 
+      # Whether to lint with `--allow-warnings`. Defaults to false.
+      allow_warnings:
+        type: boolean
+        required: false
+        default: false
+
 jobs:
   pod-lib-lint:
     # Run on the main repo's scheduled jobs or pull requests and manual workflow invocations.
@@ -71,4 +77,5 @@ jobs:
         retry_wait_seconds: 120
         command: |
           scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }} \
+            ${{ inputs.allow_warnings == true && '--allow-warnings' || '' }} \
             ${{ (contains(inputs.buildonly_platforms, matrix.platform) || contains(inputs.buildonly_platforms, 'all')) && '--skip-tests' || '' }}
diff --git a/.github/workflows/dynamiclinks.yml b/.github/workflows/dynamiclinks.yml
index 06de8df0425..657f7936946 100644
--- a/.github/workflows/dynamiclinks.yml
+++ b/.github/workflows/dynamiclinks.yml
@@ -32,7 +32,8 @@ jobs:
   pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
-      product: '--allow-warnings FirebaseDynamicLinks'
+      product: FirebaseDynamicLinks
+      allows_warnings: true
 
   dynamiclinks-cron-only:
     # Don't run on private repo.

From 6b38aa2bf2f5f6701cad21338c3cb75de0e9254a Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 12:30:35 -0400
Subject: [PATCH 19/57] functions and swift 6 support

---
 .github/workflows/appdistribution.yml  | 33 ++++++-----------------
 .github/workflows/auth.yml             |  2 +-
 .github/workflows/common_cocoapods.yml | 18 +++++++++++++
 .github/workflows/functions.yml        | 36 ++++++--------------------
 4 files changed, 35 insertions(+), 54 deletions(-)

diff --git a/.github/workflows/appdistribution.yml b/.github/workflows/appdistribution.yml
index 670f670e183..bb1db1ccabc 100644
--- a/.github/workflows/appdistribution.yml
+++ b/.github/workflows/appdistribution.yml
@@ -6,6 +6,8 @@ on:
     paths:
     - 'FirebaseAppDistribution**'
     - '.github/workflows/appdistribution.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 1am (PST) - cron uses UTC times
@@ -27,30 +29,11 @@ jobs:
     with:
       product: FirebaseAppDistribution
       target: FirebaseAppDistribution-Unit-unit
-
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.3
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - name: Build and test
-      run: |
-       scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseAppDistribution.podspec \
-         --platforms=ios
+         
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseAppDistribution # --platforms=ios
 
   appdistribution-cron-only:
     if: github.event_name == 'schedule' && github.repository == 'Firebase/firebase-ios-sdk'
@@ -62,7 +45,7 @@ jobs:
         flags: [
           '--use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/auth.yml b/.github/workflows/auth.yml
index 943b7f34dbd..256cd822827 100644
--- a/.github/workflows/auth.yml
+++ b/.github/workflows/auth.yml
@@ -177,7 +177,7 @@ jobs:
         flags: [
           '--use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index fe442e0a1bc..548de6814bc 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -47,6 +47,18 @@ on:
         required: false
         default: false
 
+      # Whether to additionally build with Swift 6. Defaults to false.
+      supports_swift6:
+        type: boolean
+        required: false
+        default: false
+                                
+      # TODO
+      prereq_command:
+        type: string
+        required: false
+        default: ""
+
 jobs:
   pod-lib-lint:
     # Run on the main repo's scheduled jobs or pull requests and manual workflow invocations.
@@ -68,6 +80,12 @@ jobs:
       run: scripts/setup_bundler.sh
     - name: Xcode
       run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
+    - name: Set podspec Swift version to 6.0, if supported.
+      if: inputs.supports_swift6 == true && matrix.os != 'macos-14'
+      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '${{ matrix.swift_version }}'/" ${{ inputs.product }}.podspec
+    - name: Run prereq command, if needed.
+      if: inputs.prereq_command != ""
+      run: ${{ inputs.prereq_command }}
     - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
       if: contains(join(inputs.platforms), matrix.platform) || matrix.os == 'macos-14'
       with:
diff --git a/.github/workflows/functions.yml b/.github/workflows/functions.yml
index ffb82914e53..ad84a10c310 100644
--- a/.github/workflows/functions.yml
+++ b/.github/workflows/functions.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseFunctions**'
     - 'FirebaseSharedSwift**'
     - '.github/workflows/functions.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'FirebaseAuth/Interop/*.h'
     - 'FirebaseMessaging/Interop/*.h'
     - 'FirebaseTestingSupport/Functions/**'
@@ -23,34 +25,12 @@ concurrency:
     cancel-in-progress: true
 
 jobs:
-
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        target: [ios, tvos, macos, watchos]
-        swift_version: [5.9, 6.0]
-        build-env:
-          - os: macos-15
-            xcode: Xcode_16.3
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Integration Test Server
-      run: FirebaseFunctions/Backend/start.sh synchronous
-    - name: Set Swift swift_version
-      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '${{ matrix.swift_version }}'/" FirebaseFunctions.podspec
-    - name: Build and test
-      run: |
-        scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseFunctions.podspec \
-          --platforms=${{ matrix.target }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseFunctions
+      supports_swift6: true
+      prereq_command: FirebaseFunctions/Backend/start.sh synchronous
 
   spm-package-resolved:
     runs-on: macos-14

From 265b4af7e4106bd446ab038acdccf2e21f9d12a1 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 15:27:19 -0400
Subject: [PATCH 20/57] check

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 548de6814bc..c7b1611de33 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -84,7 +84,7 @@ jobs:
       if: inputs.supports_swift6 == true && matrix.os != 'macos-14'
       run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '${{ matrix.swift_version }}'/" ${{ inputs.product }}.podspec
     - name: Run prereq command, if needed.
-      if: inputs.prereq_command != ""
+      if: inputs.prereq_command != ''
       run: ${{ inputs.prereq_command }}
     - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
       if: contains(join(inputs.platforms), matrix.platform) || matrix.os == 'macos-14'

From eeaf85cb7ffc42aab177b1dc1ea3226dc1b72fe7 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 15:28:11 -0400
Subject: [PATCH 21/57] fix cron dep

---
 .github/workflows/functions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/functions.yml b/.github/workflows/functions.yml
index ad84a10c310..6e1ce399d3f 100644
--- a/.github/workflows/functions.yml
+++ b/.github/workflows/functions.yml
@@ -207,7 +207,7 @@ jobs:
         flags: [
           '--use-static-frameworks',
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1

From e9f3e54a2b19c99c1e3d4d42ead84090173e9001 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 15:45:53 -0400
Subject: [PATCH 22/57] more refactors

---
 .github/workflows/common.yml         |  12 ++-
 .github/workflows/core.yml           |  35 ++------
 .github/workflows/core_extension.yml |  35 ++------
 .github/workflows/database.yml       |  30 ++-----
 .github/workflows/firebaseai.yml     | 119 +++------------------------
 5 files changed, 48 insertions(+), 183 deletions(-)

diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index d9eac3c9a12..1a33baf672e 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -40,6 +40,12 @@ on:
        type: string
        required: false
        default: ""
+       
+      # TODO
+      prereq_command:
+        type: string
+        required: false
+        default: ""
 
 jobs:
   spm-package-resolved:
@@ -54,8 +60,7 @@ jobs:
         run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
       - name: Generate Swift Package.resolved
         id: swift_package_resolve
-        run: |
-          swift package resolve
+        run: swift package resolve
       - name: Generate cache key
         id: generate_cache_key
         run: |
@@ -92,6 +97,9 @@ jobs:
     - name: Install visionOS, if needed.
       if: matrix.platform == 'visionOS'
       run: xcodebuild -downloadPlatform visionOS
+    - name: Run prereq command, if needed.
+      if: inputs.prereq_command != ''
+      run: ${{ inputs.prereq_command }}
     - name: Initialize xcodebuild
       run: scripts/setup_spm_tests.sh
     - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index 5c827cdfabc..228d9479072 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -6,6 +6,8 @@ on:
     paths:
     - 'FirebaseCore**'
     - '.github/workflows/core.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 2am (PST) - cron uses UTC times
@@ -27,31 +29,12 @@ jobs:
       product: FirebaseCore
       target: FirebaseCore-Unit-unit
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
-        target: [ios, tvos, macos --skip-tests, watchos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.2
-          # TODO: Add Xcode matrix when Xcode 16 is ubiquitous on CI runners.
-#          - os: macos-15
-#            xcode: Xcode_16.3
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseCore.podspec --platforms=${{ matrix.target }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseCore
+      # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
+      buildonly_platforms: macOS
 
   spm-package-resolved:
     env:
@@ -89,7 +72,7 @@ jobs:
         flags: [
           '--use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/core_extension.yml b/.github/workflows/core_extension.yml
index 72189156eaf..b304a81582e 100644
--- a/.github/workflows/core_extension.yml
+++ b/.github/workflows/core_extension.yml
@@ -7,38 +7,19 @@ on:
     - 'FirebaseCoreExtension.podspec'
     - 'FirebaseCore/Extension/**'
     - '.github/workflows/core_extension.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 2am (PST) - cron uses UTC times
     - cron:  '0 10 * * *'
 
 jobs:
-  # Since `FirebaseCoreExtension` only contains headers, linting is sufficient for testing.
-
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        target: [ios, tvos, macos, watchos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.2
-          # TODO: Enable when Xcode 16 is ubiquitous on CI runners.
-#          - os: macos-15
-#            xcode: Xcode_16.3
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseCoreExtension.podspec --platforms=${{ matrix.target }}
+  # Since `FirebaseCoreExtension` only contains headers, linting is sufficient for testing.      
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseCoreExtension
 
   core-internal-cron-only:
     # Don't run on private repo.
@@ -50,7 +31,7 @@ jobs:
         flags: [
           '--use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/database.yml b/.github/workflows/database.yml
index daa245a17f6..776bfb8ccf4 100644
--- a/.github/workflows/database.yml
+++ b/.github/workflows/database.yml
@@ -10,6 +10,8 @@ on:
     - 'Example/Database/**'
     - 'FirebaseAuth/Interop/*.h'
     - '.github/workflows/database.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
     - 'scripts/run_database_emulator.sh'
   schedule:
@@ -35,27 +37,11 @@ jobs:
       product: FirebaseDatabase
       target: FirebaseDatabase-Unit-unit
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        target: [ios, tvos, macos --skip-tests, watchos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.2
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseDatabase.podspec --test-specs=unit --platforms=${{ matrix.target }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseDatabase # --test-specs=unit
+      buildonly_platforms: macOS
 
   integration:
     # Don't run on private repo unless it is a PR.
@@ -110,7 +96,7 @@ jobs:
         flags: [
           '--skip-tests --use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/firebaseai.yml b/.github/workflows/firebaseai.yml
index 0dd842615cc..6c5eb54ced9 100644
--- a/.github/workflows/firebaseai.yml
+++ b/.github/workflows/firebaseai.yml
@@ -5,6 +5,8 @@ on:
     paths:
     - 'FirebaseAI**'
     - '.github/workflows/firebaseai.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'scripts/quickstart_build_spm.sh'
     - 'scripts/quickstart_spm_xcodeproj.sh'
     - 'Gemfile*'
@@ -24,80 +26,11 @@ permissions:
   actions: write # Needed for actions/cache (save and restore)
 
 jobs:
-  spm-package-resolved:
-    runs-on: macos-14
-    outputs:
-      cache_key: ${{ steps.generate_cache_key.outputs.cache_key }}
-    env:
-      FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
-    steps:
-      - uses: actions/checkout@v4
-      - name: Generate Swift Package.resolved
-        id: swift_package_resolve
-        run: |
-          swift package resolve
-      - name: Generate cache key
-        id: generate_cache_key
-        run: |
-          cache_key="${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}"
-          echo "cache_key=${cache_key}" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/save@v4
-        id: cache
-        with:
-          path: .build
-          key: ${{ steps.generate_cache_key.outputs.cache_key }}
-
-  spm-unit:
-    strategy:
-      matrix:
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-            target: iOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: iOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: tvOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: macOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: watchOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: catalyst
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: visionOS
-    runs-on: ${{ matrix.os }}
-    needs: spm-package-resolved
-    env:
-      FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
-    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
-      with:
-        path: .build
-        key: ${{needs.spm-package-resolved.outputs.cache_key}}
-    - name: Clone mock responses
-      run: scripts/update_vertexai_responses.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - name: Install visionOS, if needed.
-      if: matrix.target == 'visionOS'
-      run: xcodebuild -downloadPlatform visionOS
-    - name: Initialize xcodebuild
-      run: scripts/setup_spm_tests.sh
-    - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      with:
-        timeout_minutes: 120
-        max_attempts: 3
-        retry_on: error
-        retry_wait_seconds: 120
-        command: scripts/build.sh FirebaseAIUnit ${{ matrix.target }} spm
+  spm:
+    uses: ./.github/workflows/common.yml
+    with:
+      target: FirebaseAIUnit
+      prereq_command: scripts/update_vertexai_responses.sh
 
   testapp-integration:
     strategy:
@@ -141,38 +74,12 @@ jobs:
         path: xcodebuild-*.log
         retention-days: 2
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-            swift_version: 5.9
-            warnings:
-          - os: macos-15
-            xcode: Xcode_16.3
-            swift_version: 5.9
-            warnings:
-          - os: macos-15
-            xcode: Xcode_16.3
-            swift_version: 6.0
-            warnings:
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - name: Clone mock responses
-      run: scripts/update_vertexai_responses.sh
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - name: Set Swift swift_version
-      run: sed -i "" "s#s.swift_version = '5.9'#s.swift_version = '${{ matrix.swift_version}}'#" FirebaseAI.podspec
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseAI.podspec --platforms=${{ matrix.target }} ${{ matrix.warnings }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseAI
+      supports_swift6: true
+      prereq_command: scripts/update_vertexai_responses.sh
 
   quickstart:
     # Verifies the quickstart builds with this PR. Only run on pulls where branch is available.

From f724cda7d0159ce862cbeefc4787097ac17469da Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 15:46:48 -0400
Subject: [PATCH 23/57] remove blank space

---
 .github/workflows/appdistribution.yml  | 2 +-
 .github/workflows/common_cocoapods.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/appdistribution.yml b/.github/workflows/appdistribution.yml
index bb1db1ccabc..d141b658f02 100644
--- a/.github/workflows/appdistribution.yml
+++ b/.github/workflows/appdistribution.yml
@@ -29,7 +29,7 @@ jobs:
     with:
       product: FirebaseAppDistribution
       target: FirebaseAppDistribution-Unit-unit
-         
+
   pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index c7b1611de33..e6689398bbc 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -52,7 +52,7 @@ on:
         type: boolean
         required: false
         default: false
-                                
+
       # TODO
       prereq_command:
         type: string

From 35a5032f8a4305aa756e86bb37877d396f4c97dd Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 15:54:02 -0400
Subject: [PATCH 24/57] more

---
 .github/workflows/common.yml         |  2 +-
 .github/workflows/core_extension.yml |  2 +-
 .github/workflows/core_internal.yml  | 37 +++++------------------
 .github/workflows/crashlytics.yml    | 45 +++++++---------------------
 4 files changed, 20 insertions(+), 66 deletions(-)

diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 1a33baf672e..a3de62739cf 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -40,7 +40,7 @@ on:
        type: string
        required: false
        default: ""
-       
+
       # TODO
       prereq_command:
         type: string
diff --git a/.github/workflows/core_extension.yml b/.github/workflows/core_extension.yml
index b304a81582e..baa52eb9f07 100644
--- a/.github/workflows/core_extension.yml
+++ b/.github/workflows/core_extension.yml
@@ -15,7 +15,7 @@ on:
     - cron:  '0 10 * * *'
 
 jobs:
-  # Since `FirebaseCoreExtension` only contains headers, linting is sufficient for testing.      
+  # Since `FirebaseCoreExtension` only contains headers, linting is sufficient for testing.
   pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
diff --git a/.github/workflows/core_internal.yml b/.github/workflows/core_internal.yml
index 19f5c4d9e29..20b7b50d5f8 100644
--- a/.github/workflows/core_internal.yml
+++ b/.github/workflows/core_internal.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseCoreInternal.podspec'
     - 'FirebaseCore/Internal/**'
     - '.github/workflows/core_internal.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 2am (PST) - cron uses UTC times
@@ -27,34 +29,11 @@ jobs:
       product: FirebaseCoreInternal
       target: ${{ matrix.target }}
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        target: [ios, tvos, macos, watchos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-            swift_version: 5.9
-          - os: macos-15
-            xcode: Xcode_16.2
-            swift_version: 5.9
-          - os: macos-15
-            xcode: Xcode_16.2
-            swift_version: 6.0
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Set Swift swift_version
-      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '${{ matrix.build-env.swift_version }}'/" FirebaseCoreInternal.podspec
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseCoreInternal.podspec --platforms=${{ matrix.target }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseCoreInternal
+      supports_swift6: true
 
   core-internal-cron-only:
     # Don't run on private repo.
@@ -66,7 +45,7 @@ jobs:
         flags: [
           '--use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/crashlytics.yml b/.github/workflows/crashlytics.yml
index 6c1489bc269..8f95d06828e 100644
--- a/.github/workflows/crashlytics.yml
+++ b/.github/workflows/crashlytics.yml
@@ -7,6 +7,8 @@ on:
     - 'Crashlytics**'
     - 'FirebaseCrashlytics.podspec'
     - '.github/workflows/crashlytics.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Interop/Analytics/Public/*.h'
     - 'Gemfile*'
   schedule:
@@ -29,39 +31,11 @@ jobs:
       product: FirebaseCrashlytics
       target: FirebaseCrashlytics-Unit-unit
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        target: [ios, tvos, macos, watchos --skip-tests]
-        flags: [
-          '--use-modular-headers --skip-tests',
-          ''
-        ]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-            tests:
-          - os: macos-15
-            xcode: Xcode_16.2
-            tests:
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      with:
-        timeout_minutes: 120
-        max_attempts: 3
-        retry_on: error
-        retry_wait_seconds: 120
-        command: scripts/pod_lib_lint.rb FirebaseCrashlytics.podspec --platforms=${{ matrix.target }} ${{ matrix.build-env.tests }} ${{ matrix.flags }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseCrashlytics
+      buildonly_platforms: watchOS
 
   quickstart:
     # Don't run on private repo unless it is a PR.
@@ -142,9 +116,10 @@ jobs:
         # Disable watchos because it does not support XCTest.
         target: [ios, tvos, macos, watchos --skip-tests]
         flags: [
-          '--use-static-frameworks'
+          '--use-static-frameworks',
+          '--use-modular-headers --skip-tests'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1

From 3896c018304fe9186384e19fa68bea1087bf4d7e Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 16:02:57 -0400
Subject: [PATCH 25/57] more

---
 .github/workflows/sessions.yml     | 46 +++++-------------------------
 .github/workflows/shared-swift.yml | 36 +++++------------------
 2 files changed, 14 insertions(+), 68 deletions(-)

diff --git a/.github/workflows/sessions.yml b/.github/workflows/sessions.yml
index 055f604457b..ee95b58ef3e 100644
--- a/.github/workflows/sessions.yml
+++ b/.github/workflows/sessions.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseSessions**'
     - 'FirebaseSessions.podspec'
     - '.github/workflows/sessions.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 9am (PST) - cron uses UTC times
@@ -28,42 +30,8 @@ jobs:
       product: FirebaseSessions
       target: FirebaseSessions-Unit-unit
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        target: [ios, tvos, macos, watchos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-            tests:
-            swift_version: 5.9
-          # Flaky tests on CI
-          - os: macos-15
-            xcode: Xcode_16.3
-            tests: --skip-tests
-            swift_version: 5.9
-          # Flaky tests on CI
-          - os: macos-15
-            xcode: Xcode_16.2
-            tests: --skip-tests
-            swift_version: 6.0
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Set Swift swift_version
-      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '${{ matrix.build-env.swift_version }}'/" FirebaseSessions.podspec
-    - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      with:
-        timeout_minutes: 120
-        max_attempts: 3
-        retry_on: error
-        retry_wait_seconds: 120
-        command: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseSessions.podspec --platforms=${{ matrix.target }} ${{ matrix.build-env.tests }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseSessions # --skip-tests was used on macos-15
+      supports_swift6: true
diff --git a/.github/workflows/shared-swift.yml b/.github/workflows/shared-swift.yml
index 2cba3d10649..290fe30d513 100644
--- a/.github/workflows/shared-swift.yml
+++ b/.github/workflows/shared-swift.yml
@@ -6,6 +6,8 @@ on:
     paths:
     - 'FirebaseSharedSwift**'
     - '.github/workflows/shared-swift.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
 
   schedule:
@@ -22,32 +24,8 @@ jobs:
     with:
       target: FirebaseSharedSwiftTests
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        target: [ios, tvos, macos, watchos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-            swift_version: 5.9
-          - os: macos-15
-            xcode: Xcode_16.2
-            swift_version: 5.9
-          - os: macos-15
-            xcode: Xcode_16.3
-            swift_version: 6.0
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Set Swift swift_version
-      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '${{ matrix.build-env.swift_version }}'/" FirebaseSharedSwift.podspec
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseSharedSwift.podspec --platforms=${{ matrix.target }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseSharedSwift
+      supports_swift6: true

From 9ec01fe0e277d4691768b475d68da460e971fa75 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 16:05:22 -0400
Subject: [PATCH 26/57] ss-permissions

---
 .github/workflows/shared-swift.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/shared-swift.yml b/.github/workflows/shared-swift.yml
index 290fe30d513..b1292ebb253 100644
--- a/.github/workflows/shared-swift.yml
+++ b/.github/workflows/shared-swift.yml
@@ -1,5 +1,8 @@
 name: shared-swift
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

From fe6b030e4ddebb3698b3b5ffc0ab2c7fb8c17585 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 16:20:43 -0400
Subject: [PATCH 27/57] more work:

---
 .github/workflows/messaging.yml    |  37 +++-------
 .github/workflows/remoteconfig.yml |   2 +
 .github/workflows/storage.yml      |  35 ++-------
 .github/workflows/vertexai.yml     | 115 +++--------------------------
 4 files changed, 33 insertions(+), 156 deletions(-)

diff --git a/.github/workflows/messaging.yml b/.github/workflows/messaging.yml
index 22728cbfa03..7db9ef45f31 100644
--- a/.github/workflows/messaging.yml
+++ b/.github/workflows/messaging.yml
@@ -12,6 +12,9 @@ on:
     - 'FirebaseMessaging.podspec'
     # This file
     - '.github/workflows/messaging.yml'
+    # Re-usable workflows being used by this file.
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     # Rebuild on Ruby infrastructure changes
     - 'Gemfile*'
   schedule:
@@ -35,6 +38,15 @@ jobs:
       product: FirebaseMessaging
       target: FirebaseMessaging-Unit-unit
 
+  pod_lib_lint:
+    strategy:
+      matrix:
+        product: [FirebaseMessagingInterop, FirebaseMessaging]
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: ${{  matrix.product }}
+#      buildonly_platforms: macOS # skip tests on macos and watchos. only test unit spec
+
   # TODO(#12205) Update the build.sh script for this job from "test" instead of "build"
   messaging-integration-tests:
     # Don't run on private repo unless it is a PR.
@@ -64,31 +76,6 @@ jobs:
     - name: BuildAndTest
       run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/build.sh Messaging all)
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        podspec: [FirebaseMessagingInterop.podspec, FirebaseMessaging.podspec]
-        target: [ios, tvos, macos --skip-tests, watchos --skip-tests] # skipping tests on mac because of keychain access
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-            tests: --test-specs=unit
-          - os: macos-15
-            xcode: Xcode_16.3
-            tests: --skip-tests
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec }} ${{ matrix.build-env.tests }} --platforms=${{ matrix.target }}
-
   quickstart:
     # Don't run on private repo unless it is a PR.
     if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
diff --git a/.github/workflows/remoteconfig.yml b/.github/workflows/remoteconfig.yml
index d1b9bd1a9e5..d5e8a348b28 100644
--- a/.github/workflows/remoteconfig.yml
+++ b/.github/workflows/remoteconfig.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseRemoteConfig**'
     - 'Interop/Analytics/Public/*.h'
     - '.github/workflows/remoteconfig.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
     - 'scripts/generate_access_token.sh'
     - 'scripts/gha-encrypted/RemoteConfigSwiftAPI/**'
diff --git a/.github/workflows/storage.yml b/.github/workflows/storage.yml
index 14577436e56..fe3cb7ba87d 100644
--- a/.github/workflows/storage.yml
+++ b/.github/workflows/storage.yml
@@ -7,6 +7,8 @@ on:
     - 'FirebaseStorage**'
     - 'FirebaseAuth/Interop/*.h'
     - '.github/workflows/storage.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     # Rebuild on Ruby infrastructure changes.
     - 'Gemfile*'
   schedule:
@@ -131,33 +133,10 @@ jobs:
         testapp_dir: quickstart-ios/build-for-testing
         test_type: "xctest"
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        target: [ios, tvos, macos, watchos]
-        build-env:
-          - os: macos-15
-            xcode: Xcode_16.2
-            tests: --skip-tests
-          - os: macos-15
-            xcode: Xcode_16.2
-            tests: --test-specs=unit
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcodes
-      run: ls -l /Applications/Xcode*
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Build and test
-      run: |
-       scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseStorage.podspec ${{ matrix.build-env.tests }} \
-         --platforms=${{ matrix.target }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseStorage # Xcode_16.2 -> --skip-tests / Xcode_16.2 -> --test-specs=unit
 
   storage-cron-only:
     # Don't run on private repo.
@@ -171,7 +150,7 @@ jobs:
           - os: macos-15
             xcode: Xcode_16.2
     runs-on: ${{ matrix.build-env.os }}
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/vertexai.yml b/.github/workflows/vertexai.yml
index 32d25b6a2fd..de9be5c3bbb 100644
--- a/.github/workflows/vertexai.yml
+++ b/.github/workflows/vertexai.yml
@@ -6,6 +6,8 @@ on:
     - 'FirebaseAI**'
     - 'FirebaseVertexAI**'
     - '.github/workflows/vertexai.yml'
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     - 'Gemfile*'
   schedule:
     # Run every day at 11pm (PST) - cron uses UTC times
@@ -17,106 +19,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  spm-package-resolved:
-    runs-on: macos-14
-    outputs:
-      cache_key: ${{ steps.generate_cache_key.outputs.cache_key }}
-    env:
-      FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
-    steps:
-      - uses: actions/checkout@v4
-      - name: Generate Swift Package.resolved
-        id: swift_package_resolve
-        run: |
-          swift package resolve
-      - name: Generate cache key
-        id: generate_cache_key
-        run: |
-          cache_key="${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}"
-          echo "cache_key=${cache_key}" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/save@v4
-        id: cache
-        with:
-          path: .build
-          key: ${{ steps.generate_cache_key.outputs.cache_key }}
-
-  spm-unit:
-    strategy:
-      matrix:
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-            target: iOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: iOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: tvOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: macOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: watchOS
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: catalyst
-          - os: macos-15
-            xcode: Xcode_16.3
-            target: visionOS
-    runs-on: ${{ matrix.os }}
-    needs: spm-package-resolved
-    env:
-      FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
-    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
-      with:
-        path: .build
-        key: ${{needs.spm-package-resolved.outputs.cache_key}}
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - name: Install visionOS, if needed.
-      if: matrix.target == 'visionOS'
-      run: xcodebuild -downloadPlatform visionOS
-    - name: Initialize xcodebuild
-      run: scripts/setup_spm_tests.sh
-    - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      with:
-        timeout_minutes: 120
-        max_attempts: 3
-        retry_on: error
-        retry_wait_seconds: 120
-        command: scripts/build.sh FirebaseVertexAIUnit ${{ matrix.target }} spm
-
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-    strategy:
-      matrix:
-        include:
-          - os: macos-14
-            xcode: Xcode_16.2
-            swift_version: 5.9
-            warnings:
-          - os: macos-15
-            xcode: Xcode_16.3
-            swift_version: 5.9
-            warnings:
-          - os: macos-15
-            xcode: Xcode_16.3
-            swift_version: 6.0
-            warnings:
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
-    - name: Set Swift swift_version
-      run: sed -i "" "s#s.swift_version = '5.9'#s.swift_version = '${{ matrix.swift_version}}'#" FirebaseVertexAI.podspec
-    - name: Build and test
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseVertexAI.podspec --platforms=${{ matrix.target }} ${{ matrix.warnings }}
+  spm:
+    uses: ./.github/workflows/common.yml
+    with:
+      target: FirebaseVertexAIUnit
+      
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseVertexAI
+      supports_swift6: true

From 609eb4335e49c829d573d8355f670cd6ff55a067 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 21 May 2025 16:23:03 -0400
Subject: [PATCH 28/57] fixes

---
 .github/workflows/sessions.yml | 3 +++
 .github/workflows/vertexai.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/sessions.yml b/.github/workflows/sessions.yml
index ee95b58ef3e..c5eb64ab385 100644
--- a/.github/workflows/sessions.yml
+++ b/.github/workflows/sessions.yml
@@ -1,5 +1,8 @@
 name: sessions
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/vertexai.yml b/.github/workflows/vertexai.yml
index de9be5c3bbb..3e1a7a99fd5 100644
--- a/.github/workflows/vertexai.yml
+++ b/.github/workflows/vertexai.yml
@@ -1,5 +1,8 @@
 name: vertexai
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:

From a9df00542e41cc98cfd3ee73996431fc63c2f7b3 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 10:57:52 -0400
Subject: [PATCH 29/57] Fix CI

---
 .github/workflows/common.yml           | 7 ++++++-
 .github/workflows/common_cocoapods.yml | 9 +++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index a3de62739cf..95c8c1bae29 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -41,7 +41,12 @@ on:
        required: false
        default: ""
 
-      # TODO
+      # A command to execute before testing.
+      #
+      # This is useful for additional set up, like starting an emulator or
+      # downloading test data.
+      #
+      # Example: `FirebaseFunctions/Backend/start.sh synchronous`
       prereq_command:
         type: string
         required: false
diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index e6689398bbc..8e33031b4c8 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -53,7 +53,12 @@ on:
         required: false
         default: false
 
-      # TODO
+      # A command to execute before testing.
+      #
+      # This is useful for additional set up, like starting an emulator or
+      # downloading test data.
+      #
+      # Example: `FirebaseFunctions/Backend/start.sh synchronous`
       prereq_command:
         type: string
         required: false
@@ -82,7 +87,7 @@ jobs:
       run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
     - name: Set podspec Swift version to 6.0, if supported.
       if: inputs.supports_swift6 == true && matrix.os != 'macos-14'
-      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '${{ matrix.swift_version }}'/" ${{ inputs.product }}.podspec
+      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '6.0'/" ${{ inputs.product }}.podspec
     - name: Run prereq command, if needed.
       if: inputs.prereq_command != ''
       run: ${{ inputs.prereq_command }}

From 139cc5fd2e3cdfb4dad3b53a07dfb276a1cb24fd Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 11:20:53 -0400
Subject: [PATCH 30/57] whitespace

---
 .github/workflows/vertexai.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/vertexai.yml b/.github/workflows/vertexai.yml
index 3e1a7a99fd5..c5db31d75df 100644
--- a/.github/workflows/vertexai.yml
+++ b/.github/workflows/vertexai.yml
@@ -26,7 +26,7 @@ jobs:
     uses: ./.github/workflows/common.yml
     with:
       target: FirebaseVertexAIUnit
-      
+
   pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:

From 50731d5de18a12974a49ebf29cfabc823b541015 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 11:33:08 -0400
Subject: [PATCH 31/57] App distro fix

---
 .github/workflows/appdistribution.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/appdistribution.yml b/.github/workflows/appdistribution.yml
index d141b658f02..9fb776fd058 100644
--- a/.github/workflows/appdistribution.yml
+++ b/.github/workflows/appdistribution.yml
@@ -33,7 +33,8 @@ jobs:
   pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
-      product: FirebaseAppDistribution # --platforms=ios
+      product: FirebaseAppDistribution
+      platforms: iOS # App Distro only supports iOS.
 
   appdistribution-cron-only:
     if: github.event_name == 'schedule' && github.repository == 'Firebase/firebase-ios-sdk'

From 8417b85a4e9ef9c339e6ba3115fb92b5c3f78a7e Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 11:33:29 -0400
Subject: [PATCH 32/57] fix auth by setting env var in reusable workflow

---
 .github/workflows/common_cocoapods.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 8e33031b4c8..5f2679708ce 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -3,6 +3,9 @@ name: common_cocoapods
 permissions:
   contents: read
 
+env:
+  FIREBASE_CI: true
+
 on:
   workflow_call:
     inputs:

From 051f40fd4a03a0c686ff95c2588d746b7b0f93cb Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 11:33:48 -0400
Subject: [PATCH 33/57] fix fiam with specific platforms

---
 .github/workflows/inappmessaging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/inappmessaging.yml b/.github/workflows/inappmessaging.yml
index 3d38b4f290e..6fbab06023c 100644
--- a/.github/workflows/inappmessaging.yml
+++ b/.github/workflows/inappmessaging.yml
@@ -32,7 +32,7 @@ jobs:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseInAppMessaging
-      buildonly_platforms: macOS
+      platforms: iOS, tvOS
 
   tests:
     # Don't run on private repo unless it is a PR.

From 1d5a2aa29ba08069ec471e8fe948c013c3db77e0 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 14:11:25 -0400
Subject: [PATCH 34/57] Fix messaging some

---
 .../UnitTests/FIRMessagingRemoteNotificationsProxyTest.m    | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/FirebaseMessaging/Tests/UnitTests/FIRMessagingRemoteNotificationsProxyTest.m b/FirebaseMessaging/Tests/UnitTests/FIRMessagingRemoteNotificationsProxyTest.m
index 3233358a2d0..a8ed4fa3032 100644
--- a/FirebaseMessaging/Tests/UnitTests/FIRMessagingRemoteNotificationsProxyTest.m
+++ b/FirebaseMessaging/Tests/UnitTests/FIRMessagingRemoteNotificationsProxyTest.m
@@ -191,6 +191,8 @@ - (void)testSwizzlingNonAppDelegate {
 
 #if !SWIFT_PACKAGE
 // The next 3 tests depend on a sharedApplication which is not available in the Swift PM test env.
+
+#if !TARGET_OS_OSX
 - (void)testSwizzledIncompleteAppDelegateRemoteNotificationMethod {
   XCTestExpectation *expectation = [self expectationWithDescription:@"completion"];
   IncompleteAppDelegate *incompleteAppDelegate = [[IncompleteAppDelegate alloc] init];
@@ -209,6 +211,7 @@ - (void)testSwizzledIncompleteAppDelegateRemoteNotificationMethod {
   [self.mockMessaging verify];
   [self waitForExpectationsWithTimeout:0.5 handler:nil];
 }
+#endif  // !TARGET_OS_OSX
 
 // This test demonstrates the difference between Firebase 10 and 11. In 10 and earlier the
 // swizzler inserts the old `didReceiveRemoteNotification` method. In 11, the new.
@@ -232,10 +235,9 @@ - (void)testSwizzledAppDelegateRemoteNotificationMethods {
   [[GULAppDelegateSwizzler sharedApplication] setDelegate:appDelegate];
   [self.proxy swizzleMethodsIfPossible];
 
-  NSDictionary *notification = @{@"test" : @""};
-
   // Test application:didReceiveRemoteNotification:fetchCompletionHandler:
 #if TARGET_OS_IOS || TARGET_OS_TV
+  NSDictionary *notification = @{@"test" : @""};
   // Verify our swizzled method was called
   OCMExpect([self.mockMessaging appDidReceiveMessage:notification]);
 

From 03f95b0ab918027982e740f228b22c5095677461 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 14:15:32 -0400
Subject: [PATCH 35/57] fix fdl, fai

---
 .github/workflows/dynamiclinks.yml | 2 +-
 .github/workflows/firebaseai.yml   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dynamiclinks.yml b/.github/workflows/dynamiclinks.yml
index 657f7936946..5bd9cb4346b 100644
--- a/.github/workflows/dynamiclinks.yml
+++ b/.github/workflows/dynamiclinks.yml
@@ -33,7 +33,7 @@ jobs:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseDynamicLinks
-      allows_warnings: true
+      allow_warnings: true
 
   dynamiclinks-cron-only:
     # Don't run on private repo.
diff --git a/.github/workflows/firebaseai.yml b/.github/workflows/firebaseai.yml
index 6c5eb54ced9..4af0b4622d7 100644
--- a/.github/workflows/firebaseai.yml
+++ b/.github/workflows/firebaseai.yml
@@ -41,7 +41,7 @@ jobs:
           - os: macos-15
             xcode: Xcode_16.3
     runs-on: ${{ matrix.os }}
-    needs: spm-package-resolved
+    needs: spm
     env:
       TEST_RUNNER_FIRAAppCheckDebugToken: ${{ secrets.VERTEXAI_INTEGRATION_FAC_DEBUG_TOKEN }}
       TEST_RUNNER_VTXIntegrationImagen: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}

From da3b7d2f763334c8ccebb90a8e753844fe56b611 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Thu, 22 May 2025 15:45:28 -0400
Subject: [PATCH 36/57] fixes and more migrations

---
 .github/workflows/dynamiclinks.yml |  1 +
 .github/workflows/performance.yml  | 36 +++++++++-------------------
 .github/workflows/remoteconfig.yml | 38 ++++++------------------------
 3 files changed, 19 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/dynamiclinks.yml b/.github/workflows/dynamiclinks.yml
index 5bd9cb4346b..000d33c6d1c 100644
--- a/.github/workflows/dynamiclinks.yml
+++ b/.github/workflows/dynamiclinks.yml
@@ -33,6 +33,7 @@ jobs:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseDynamicLinks
+      platforms: iOS # Dynamic Links only supports iOS.
       allow_warnings: true
 
   dynamiclinks-cron-only:
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index cefd7fb083c..1fd3d18fc52 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -12,6 +12,9 @@ on:
     - 'FirebasePerformance.podspec'
     # YML configuration file
     - '.github/workflows/performance.yml'
+    # Re-usable workflows depended on by this file.
+    - '.github/workflows/common.yml'
+    - '.github/workflows/common_cocoapods.yml'
     # Rebuild on Ruby infrastructure changes
     - 'Gemfile*'
   schedule:
@@ -61,30 +64,13 @@ jobs:
     - name: BuildAndTest # can be replaced with pod lib lint with CocoaPods 1.10
       run: scripts/third_party/travis/retry.sh scripts/build.sh Performance ${{ matrix.target }} ${{ matrix.test }}
 
-  # Podspec lint check for Firebase Performance
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        target: [ios, tvos]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-          - os: macos-15
-            xcode: Xcode_16.3
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Build
-    #TODO: tests are not supported with Xcode 15 because the test spec depends on the iOS 8 GDCWebServer
-      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebasePerformance.podspec --skip-tests --platforms=${{ matrix.target }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebasePerformance
+      platforms: iOS, tvOS
+      #TODO: tests are not supported with Xcode 15 because the test spec depends on the iOS 8 GDCWebServer
+      buildonly_platforms: iOS, tvOS
 
   quickstart:
     if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
@@ -150,7 +136,7 @@ jobs:
         flags: [
           '--skip-tests --use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/remoteconfig.yml b/.github/workflows/remoteconfig.yml
index d5e8a348b28..9b399df8dfc 100644
--- a/.github/workflows/remoteconfig.yml
+++ b/.github/workflows/remoteconfig.yml
@@ -74,36 +74,12 @@ jobs:
       # No retry to avoid exhausting AccessToken quota.
       run: ([ -z $plist_secret ] || scripts/build.sh RemoteConfig iOS integration)
 
-  pod-lib-lint:
-    # Don't run on private repo unless it is a PR.
-    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-
-    strategy:
-      matrix:
-        # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
-        target: [ios, tvos, macos --skip-tests, watchos]
-        podspec: [FirebaseRemoteConfig.podspec]
-        build-env:
-          - os: macos-14
-            xcode: Xcode_16.2
-#            # TODO(#13078): Fix testing infra to enforce warnings again.
-#            tests: --allow-warnings
-          # Flaky tests on CI
-          - os: macos-15
-            xcode: Xcode_16.2
-            tests: --skip-tests
-    runs-on: ${{ matrix.build-env.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-    - name: Setup Bundler
-      run: scripts/setup_bundler.sh
-    - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
-    - name: Build and test
-      run: |
-       scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec }} --platforms=${{ matrix.target }} \
-         ${{ matrix.build-env.tests }}
+  pod_lib_lint:
+    uses: ./.github/workflows/common_cocoapods.yml
+    with:
+      product: FirebaseRemoteConfig
+      # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
+      # buildonly_platforms: macOS
 
   quickstart:
     # Don't run on private repo unless it is a PR.
@@ -182,7 +158,7 @@ jobs:
         flags: [
           '--skip-tests --use-static-frameworks'
         ]
-    needs: pod-lib-lint
+    needs: pod_lib_lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1

From 1bc9621036d4dbd4628743ca4bce95b1800d6166 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 27 May 2025 12:26:48 -0400
Subject: [PATCH 37/57] Fix re-usable workflow's output

---
 .github/workflows/common.yml     | 5 +++++
 .github/workflows/firebaseai.yml | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 95c8c1bae29..1a85860dff1 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -52,6 +52,11 @@ on:
         required: false
         default: ""
 
+    outputs:
+      cache_key:
+        description: "The cache key for the Swift package resolution."
+        value: ${{ jobs.spm-package-resolved.outputs.cache_key }}
+
 jobs:
   spm-package-resolved:
     env:
diff --git a/.github/workflows/firebaseai.yml b/.github/workflows/firebaseai.yml
index c256198b59d..5152155401a 100644
--- a/.github/workflows/firebaseai.yml
+++ b/.github/workflows/firebaseai.yml
@@ -52,7 +52,7 @@ jobs:
     - uses: actions/cache/restore@v4
       with:
         path: .build
-        key: ${{needs.spm-package-resolved.outputs.cache_key}}
+        key: ${{ needs.spm.outputs.cache_key }}
     - name: Install Secret GoogleService-Info.plist
       run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/VertexAI/TestApp-GoogleService-Info.plist.gpg \
         FirebaseAI/Tests/TestApp/Resources/GoogleService-Info.plist "$secrets_passphrase"

From 35bbc84eaf7cfd3d23ae1f42f86ed868ffcfa827 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 27 May 2025 13:24:28 -0400
Subject: [PATCH 38/57] set env var in a different way

---
 .github/workflows/common_cocoapods.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 5f2679708ce..22417e25a55 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -3,9 +3,6 @@ name: common_cocoapods
 permissions:
   contents: read
 
-env:
-  FIREBASE_CI: true
-
 on:
   workflow_call:
     inputs:
@@ -88,6 +85,9 @@ jobs:
       run: scripts/setup_bundler.sh
     - name: Xcode
       run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
+    - name: Set conditional environment variable, if needed.
+      if: inputs.product == 'FirebaseAuth'
+      run: echo "FIREBASE_CI=true >> $GITHUB_ENV
     - name: Set podspec Swift version to 6.0, if supported.
       if: inputs.supports_swift6 == true && matrix.os != 'macos-14'
       run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '6.0'/" ${{ inputs.product }}.podspec

From 366d56d7a3ccd8f4dcfaf2fdef5fe93311854240 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Tue, 27 May 2025 14:51:24 -0400
Subject: [PATCH 39/57] Update .github/workflows/common_cocoapods.yml

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 22417e25a55..1aa9ed0c07e 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -87,7 +87,7 @@ jobs:
       run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
     - name: Set conditional environment variable, if needed.
       if: inputs.product == 'FirebaseAuth'
-      run: echo "FIREBASE_CI=true >> $GITHUB_ENV
+      run: echo "FIREBASE_CI=true" >> $GITHUB_ENV
     - name: Set podspec Swift version to 6.0, if supported.
       if: inputs.supports_swift6 == true && matrix.os != 'macos-14'
       run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '6.0'/" ${{ inputs.product }}.podspec

From efb3aaec64fde442b500ed8f5dab427bd1a056e3 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Tue, 27 May 2025 17:51:37 -0400
Subject: [PATCH 40/57] Restore storage for now

---
 .github/workflows/storage.yml | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/storage.yml b/.github/workflows/storage.yml
index fe3cb7ba87d..14577436e56 100644
--- a/.github/workflows/storage.yml
+++ b/.github/workflows/storage.yml
@@ -7,8 +7,6 @@ on:
     - 'FirebaseStorage**'
     - 'FirebaseAuth/Interop/*.h'
     - '.github/workflows/storage.yml'
-    - '.github/workflows/common.yml'
-    - '.github/workflows/common_cocoapods.yml'
     # Rebuild on Ruby infrastructure changes.
     - 'Gemfile*'
   schedule:
@@ -133,10 +131,33 @@ jobs:
         testapp_dir: quickstart-ios/build-for-testing
         test_type: "xctest"
 
-  pod_lib_lint:
-    uses: ./.github/workflows/common_cocoapods.yml
-    with:
-      product: FirebaseStorage # Xcode_16.2 -> --skip-tests / Xcode_16.2 -> --test-specs=unit
+  pod-lib-lint:
+    # Don't run on private repo unless it is a PR.
+    if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
+    strategy:
+      matrix:
+        target: [ios, tvos, macos, watchos]
+        build-env:
+          - os: macos-15
+            xcode: Xcode_16.2
+            tests: --skip-tests
+          - os: macos-15
+            xcode: Xcode_16.2
+            tests: --test-specs=unit
+    runs-on: ${{ matrix.build-env.os }}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
+    - name: Setup Bundler
+      run: scripts/setup_bundler.sh
+    - name: Xcodes
+      run: ls -l /Applications/Xcode*
+    - name: Xcode
+      run: sudo xcode-select -s /Applications/${{ matrix.build-env.xcode }}.app/Contents/Developer
+    - name: Build and test
+      run: |
+       scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb FirebaseStorage.podspec ${{ matrix.build-env.tests }} \
+         --platforms=${{ matrix.target }}
 
   storage-cron-only:
     # Don't run on private repo.
@@ -150,7 +171,7 @@ jobs:
           - os: macos-15
             xcode: Xcode_16.2
     runs-on: ${{ matrix.build-env.os }}
-    needs: pod_lib_lint
+    needs: pod-lib-lint
     steps:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1

From cab259fd4b4ae16b145fb8a9b501fb37f1c74cea Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:16:42 -0400
Subject: [PATCH 41/57] Update remoteconfig.yml

---
 .github/workflows/remoteconfig.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/remoteconfig.yml b/.github/workflows/remoteconfig.yml
index 848948efde7..fbbac36ee78 100644
--- a/.github/workflows/remoteconfig.yml
+++ b/.github/workflows/remoteconfig.yml
@@ -1,5 +1,8 @@
 name: remoteconfig
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

From 6ecc3c14be512281a31abaa2d45c455b2715f737 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:18:38 -0400
Subject: [PATCH 42/57] Apply suggestions from code review

---
 .github/workflows/auth.yml         | 4 ----
 .github/workflows/remoteconfig.yml | 2 --
 .github/workflows/sessions.yml     | 2 +-
 3 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/workflows/auth.yml b/.github/workflows/auth.yml
index 256cd822827..d8514aa4dd6 100644
--- a/.github/workflows/auth.yml
+++ b/.github/workflows/auth.yml
@@ -40,10 +40,6 @@ jobs:
     strategy:
       matrix:
         product: [FirebaseAuthInterop, FirebaseAuth]
-#    steps:
-#    - uses: actions/checkout@v4
-#    - name: Configure test keychain
-#      run: scripts/configure_test_keychain.sh
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: ${{  matrix.product }}
diff --git a/.github/workflows/remoteconfig.yml b/.github/workflows/remoteconfig.yml
index fbbac36ee78..3f23f427b3a 100644
--- a/.github/workflows/remoteconfig.yml
+++ b/.github/workflows/remoteconfig.yml
@@ -81,8 +81,6 @@ jobs:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseRemoteConfig
-      # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
-      # buildonly_platforms: macOS
 
   quickstart:
     # Don't run on private repo unless it is a PR.
diff --git a/.github/workflows/sessions.yml b/.github/workflows/sessions.yml
index c5eb64ab385..976b3886c1f 100644
--- a/.github/workflows/sessions.yml
+++ b/.github/workflows/sessions.yml
@@ -36,5 +36,5 @@ jobs:
   pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
-      product: FirebaseSessions # --skip-tests was used on macos-15
+      product: FirebaseSessions
       supports_swift6: true

From bfc65008798f1dedd2e90fd88323358dab6f1af2 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:28:40 -0400
Subject: [PATCH 43/57] Update common_cocoapods.yml

---
 .github/workflows/common_cocoapods.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 1aa9ed0c07e..4159ca052c5 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -53,6 +53,14 @@ on:
         required: false
         default: false
 
+      # A comma separated (no spaces) string that will be passed to
+      # pod lib lint's `--test-specs=` argument. By default, all
+      # test specs will be tested.
+      test_specs:
+       type: string
+       required: false
+       default: ""
+
       # A command to execute before testing.
       #
       # This is useful for additional set up, like starting an emulator or
@@ -104,4 +112,5 @@ jobs:
         command: |
           scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }} \
             ${{ inputs.allow_warnings == true && '--allow-warnings' || '' }} \
+            ${{ inputs.test_specs != '' && '--test-specs=${{ inputs.test_specs }}' || '' }} \
             ${{ (contains(inputs.buildonly_platforms, matrix.platform) || contains(inputs.buildonly_platforms, 'all')) && '--skip-tests' || '' }}

From 9df8de62c3fea93c3d303447a33715e69e92e4f2 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:29:20 -0400
Subject: [PATCH 44/57] Disable rtdb int tests

---
 .github/workflows/database.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/database.yml b/.github/workflows/database.yml
index 776bfb8ccf4..521d249a0bb 100644
--- a/.github/workflows/database.yml
+++ b/.github/workflows/database.yml
@@ -40,7 +40,8 @@ jobs:
   pod_lib_lint:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
-      product: FirebaseDatabase # --test-specs=unit
+      product: FirebaseDatabase
+      test_specs: unit
       buildonly_platforms: macOS
 
   integration:

From 1965146b913f6d4b255e68332a855c3891772eda Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:29:59 -0400
Subject: [PATCH 45/57] Update .github/workflows/firebase_app_check.yml

---
 .github/workflows/firebase_app_check.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index 36cb2717478..d9459a027ad 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -36,10 +36,6 @@ jobs:
     strategy:
       matrix:
         product: [FirebaseAppCheckInterop, FirebaseAppCheck]
-#    steps:
-#    - uses: actions/checkout@v4
-#    - name: Configure test keychain
-#      run: scripts/configure_test_keychain.sh
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: ${{  matrix.product }}

From fda6eebe53c76af9e9801c60165e7f53c24c2b03 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:30:19 -0400
Subject: [PATCH 46/57] Update .github/workflows/inappmessaging.yml

---
 .github/workflows/inappmessaging.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/inappmessaging.yml b/.github/workflows/inappmessaging.yml
index 6fbab06023c..6ce96c4fcae 100644
--- a/.github/workflows/inappmessaging.yml
+++ b/.github/workflows/inappmessaging.yml
@@ -27,8 +27,6 @@ jobs:
       buildonly_platforms: iOS
 
   pod_lib_lint:
-#    - name: FirebaseInAppMessaging
-#      run: scripts/third_party/travis/retry.sh scripts/pod_lib_lint.rb ${{ matrix.podspec}}
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseInAppMessaging

From 306907dde0d8007b5eba753d3b19f79c6f309613 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:31:00 -0400
Subject: [PATCH 47/57] Update .github/workflows/messaging.yml

---
 .github/workflows/messaging.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/messaging.yml b/.github/workflows/messaging.yml
index 7db9ef45f31..9bb6e35689a 100644
--- a/.github/workflows/messaging.yml
+++ b/.github/workflows/messaging.yml
@@ -45,7 +45,6 @@ jobs:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: ${{  matrix.product }}
-#      buildonly_platforms: macOS # skip tests on macos and watchos. only test unit spec
 
   # TODO(#12205) Update the build.sh script for this job from "test" instead of "build"
   messaging-integration-tests:

From e376673afff5043f67f54855842aea5c6f856910 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:36:06 -0400
Subject: [PATCH 48/57] Update database.yml

---
 .github/workflows/database.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/database.yml b/.github/workflows/database.yml
index 521d249a0bb..694ed7b48e5 100644
--- a/.github/workflows/database.yml
+++ b/.github/workflows/database.yml
@@ -1,5 +1,8 @@
 name: database
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

From 76d91c3133f5c3067dd0395886e307e89e76275e Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:36:38 -0400
Subject: [PATCH 49/57] Update common_cocoapods.yml

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 4159ca052c5..a164578a4ce 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -112,5 +112,5 @@ jobs:
         command: |
           scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }} \
             ${{ inputs.allow_warnings == true && '--allow-warnings' || '' }} \
-            ${{ inputs.test_specs != '' && '--test-specs=${{ inputs.test_specs }}' || '' }} \
+            ${{ inputs.test_specs != '' && "--test-specs=${{ inputs.test_specs }}" || '' }} \
             ${{ (contains(inputs.buildonly_platforms, matrix.platform) || contains(inputs.buildonly_platforms, 'all')) && '--skip-tests' || '' }}

From cb4d88a7adadad811a9887534788cd693fb26ee2 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:44:50 -0400
Subject: [PATCH 50/57] Update common_cocoapods.yml

---
 .github/workflows/common_cocoapods.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index a164578a4ce..66f9e652fa6 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -112,5 +112,5 @@ jobs:
         command: |
           scripts/pod_lib_lint.rb ${{ inputs.product }}.podspec --platforms=${{ matrix.platform }} \
             ${{ inputs.allow_warnings == true && '--allow-warnings' || '' }} \
-            ${{ inputs.test_specs != '' && "--test-specs=${{ inputs.test_specs }}" || '' }} \
+            ${{ inputs.test_specs != '' && format('--test-specs={0}', inputs.test_specs) || '' }} \
             ${{ (contains(inputs.buildonly_platforms, matrix.platform) || contains(inputs.buildonly_platforms, 'all')) && '--skip-tests' || '' }}

From 429e1c66e67cf4d8bdb5a89eed937bfbcaa68e37 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:50:28 -0400
Subject: [PATCH 51/57] Update abtesting.yml

---
 .github/workflows/abtesting.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/abtesting.yml b/.github/workflows/abtesting.yml
index fbfcf95a662..f874410e988 100644
--- a/.github/workflows/abtesting.yml
+++ b/.github/workflows/abtesting.yml
@@ -1,5 +1,8 @@
 name: abtesting
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

From de5ef724e556299e85bea2ce50642137b19465db Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:50:48 -0400
Subject: [PATCH 52/57] Update appdistribution.yml

---
 .github/workflows/appdistribution.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/appdistribution.yml b/.github/workflows/appdistribution.yml
index 9fb776fd058..059a5ab88b6 100644
--- a/.github/workflows/appdistribution.yml
+++ b/.github/workflows/appdistribution.yml
@@ -1,5 +1,8 @@
 name: appdistribution
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

From 6930fc369efaea9bbdc8d7ba1df012eb382a1616 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 11:53:28 -0400
Subject: [PATCH 53/57] Add read permissions to all touched workflows

---
 .github/workflows/auth.yml               | 3 +++
 .github/workflows/core.yml               | 3 +++
 .github/workflows/core_extension.yml     | 3 +++
 .github/workflows/core_internal.yml      | 3 +++
 .github/workflows/crashlytics.yml        | 3 +++
 .github/workflows/dynamiclinks.yml       | 3 +++
 .github/workflows/firebase_app_check.yml | 3 +++
 .github/workflows/functions.yml          | 3 +++
 .github/workflows/inappmessaging.yml     | 3 +++
 .github/workflows/messaging.yml          | 3 +++
 .github/workflows/performance.yml        | 3 +++
 11 files changed, 33 insertions(+)

diff --git a/.github/workflows/auth.yml b/.github/workflows/auth.yml
index d8514aa4dd6..31a5f7584e9 100644
--- a/.github/workflows/auth.yml
+++ b/.github/workflows/auth.yml
@@ -1,5 +1,8 @@
 name: auth
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index 228d9479072..bae3f89c382 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -1,5 +1,8 @@
 name: core
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/core_extension.yml b/.github/workflows/core_extension.yml
index baa52eb9f07..15b86f38538 100644
--- a/.github/workflows/core_extension.yml
+++ b/.github/workflows/core_extension.yml
@@ -1,5 +1,8 @@
 name: core_extension
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/core_internal.yml b/.github/workflows/core_internal.yml
index 20b7b50d5f8..02ae537a6ff 100644
--- a/.github/workflows/core_internal.yml
+++ b/.github/workflows/core_internal.yml
@@ -1,5 +1,8 @@
 name: core_internal
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/crashlytics.yml b/.github/workflows/crashlytics.yml
index 8f95d06828e..6566e39bac0 100644
--- a/.github/workflows/crashlytics.yml
+++ b/.github/workflows/crashlytics.yml
@@ -1,5 +1,8 @@
 name: crashlytics
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/dynamiclinks.yml b/.github/workflows/dynamiclinks.yml
index 000d33c6d1c..b6c2ff19c0b 100644
--- a/.github/workflows/dynamiclinks.yml
+++ b/.github/workflows/dynamiclinks.yml
@@ -1,5 +1,8 @@
 name: dynamiclinks
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index d9459a027ad..5e5c749d808 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -1,5 +1,8 @@
 name: firebase_app_check
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/functions.yml b/.github/workflows/functions.yml
index 6e1ce399d3f..7e042f8ddaf 100644
--- a/.github/workflows/functions.yml
+++ b/.github/workflows/functions.yml
@@ -1,5 +1,8 @@
 name: functions
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/inappmessaging.yml b/.github/workflows/inappmessaging.yml
index 6ce96c4fcae..6650fbb8fc9 100644
--- a/.github/workflows/inappmessaging.yml
+++ b/.github/workflows/inappmessaging.yml
@@ -1,5 +1,8 @@
 name: inappmessaging
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/messaging.yml b/.github/workflows/messaging.yml
index 9bb6e35689a..71d8c111578 100644
--- a/.github/workflows/messaging.yml
+++ b/.github/workflows/messaging.yml
@@ -1,5 +1,8 @@
 name: messaging
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index 1fd3d18fc52..b5e0beea295 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -2,6 +2,9 @@
 # Reference: https://github.community/t/on-schedule-per-branch/17525
 name: performance
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

From be4214cb5092c1e342fddf77be0766796e48b418 Mon Sep 17 00:00:00 2001
From: Nick Cooke <nickcooke@google.com>
Date: Wed, 28 May 2025 11:57:55 -0400
Subject: [PATCH 54/57] rename arg

---
 .github/workflows/common.yml           | 8 ++++----
 .github/workflows/common_cocoapods.yml | 8 ++++----
 .github/workflows/firebaseai.yml       | 4 ++--
 .github/workflows/functions.yml        | 2 +-
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 1a85860dff1..40ba550d095 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -47,7 +47,7 @@ on:
       # downloading test data.
       #
       # Example: `FirebaseFunctions/Backend/start.sh synchronous`
-      prereq_command:
+      setup_command:
         type: string
         required: false
         default: ""
@@ -107,9 +107,9 @@ jobs:
     - name: Install visionOS, if needed.
       if: matrix.platform == 'visionOS'
       run: xcodebuild -downloadPlatform visionOS
-    - name: Run prereq command, if needed.
-      if: inputs.prereq_command != ''
-      run: ${{ inputs.prereq_command }}
+    - name: Run setup command, if needed.
+      if: inputs.setup_command != ''
+      run: ${{ inputs.setup_command }}
     - name: Initialize xcodebuild
       run: scripts/setup_spm_tests.sh
     - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 66f9e652fa6..6a575554bb4 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -67,7 +67,7 @@ on:
       # downloading test data.
       #
       # Example: `FirebaseFunctions/Backend/start.sh synchronous`
-      prereq_command:
+      setup_command:
         type: string
         required: false
         default: ""
@@ -99,9 +99,9 @@ jobs:
     - name: Set podspec Swift version to 6.0, if supported.
       if: inputs.supports_swift6 == true && matrix.os != 'macos-14'
       run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '6.0'/" ${{ inputs.product }}.podspec
-    - name: Run prereq command, if needed.
-      if: inputs.prereq_command != ''
-      run: ${{ inputs.prereq_command }}
+    - name: Run setup command, if needed.
+      if: inputs.setup_command != ''
+      run: ${{ inputs.setup_command }}
     - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
       if: contains(join(inputs.platforms), matrix.platform) || matrix.os == 'macos-14'
       with:
diff --git a/.github/workflows/firebaseai.yml b/.github/workflows/firebaseai.yml
index 5152155401a..1184ce74897 100644
--- a/.github/workflows/firebaseai.yml
+++ b/.github/workflows/firebaseai.yml
@@ -30,7 +30,7 @@ jobs:
     uses: ./.github/workflows/common.yml
     with:
       target: FirebaseAIUnit
-      prereq_command: scripts/update_vertexai_responses.sh
+      setup_command: scripts/update_vertexai_responses.sh
 
   testapp-integration:
     strategy:
@@ -79,7 +79,7 @@ jobs:
     with:
       product: FirebaseAI
       supports_swift6: true
-      prereq_command: scripts/update_vertexai_responses.sh
+      setup_command: scripts/update_vertexai_responses.sh
 
   quickstart:
     runs-on: macos-15
diff --git a/.github/workflows/functions.yml b/.github/workflows/functions.yml
index 7e042f8ddaf..bd279cb3f55 100644
--- a/.github/workflows/functions.yml
+++ b/.github/workflows/functions.yml
@@ -33,7 +33,7 @@ jobs:
     with:
       product: FirebaseFunctions
       supports_swift6: true
-      prereq_command: FirebaseFunctions/Backend/start.sh synchronous
+      setup_command: FirebaseFunctions/Backend/start.sh synchronous
 
   spm-package-resolved:
     runs-on: macos-14

From eaaa045c87f0070278279dcec90af79bbf65d013 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 14:18:53 -0400
Subject: [PATCH 55/57] Apply suggestions from code review

---
 .github/workflows/crashlytics.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/crashlytics.yml b/.github/workflows/crashlytics.yml
index 6566e39bac0..05f492d68d3 100644
--- a/.github/workflows/crashlytics.yml
+++ b/.github/workflows/crashlytics.yml
@@ -38,7 +38,7 @@ jobs:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseCrashlytics
-      buildonly_platforms: watchOS
+      buildonly_platforms: tvOS, macOS, watchOS
 
   quickstart:
     # Don't run on private repo unless it is a PR.

From 6932da31dbdc90385e6d781c016ebff4ac694782 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 14:21:08 -0400
Subject: [PATCH 56/57] [attempt] run tests on macos for firebasecore

---
 .github/workflows/core.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index bae3f89c382..90146cb8e31 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -37,7 +37,7 @@ jobs:
     with:
       product: FirebaseCore
       # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
-      buildonly_platforms: macOS
+#      buildonly_platforms: macOS
 
   spm-package-resolved:
     env:

From 150d1483a6a883e4e6f5c65dd5472b1c94d6eb29 Mon Sep 17 00:00:00 2001
From: Nick Cooke <36927374+ncooke3@users.noreply.github.com>
Date: Wed, 28 May 2025 16:57:03 -0400
Subject: [PATCH 57/57] Update .github/workflows/core.yml

---
 .github/workflows/core.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index 90146cb8e31..70b8cb92612 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -36,8 +36,6 @@ jobs:
     uses: ./.github/workflows/common_cocoapods.yml
     with:
       product: FirebaseCore
-      # TODO: macos tests are blocked by https://github.com/erikdoe/ocmock/pull/532
-#      buildonly_platforms: macOS
 
   spm-package-resolved:
     env: