Merge branch 'firebase:main' into JesusRojas/#11903

Author: JesusRojass

.github/CODEOWNERS

@@ -1,6 +1,6 @@
 ReleaseTooling/ @firebase/firebase-ios-sdk-admin
 FirebaseCore/ @firebase/firebase-ios-sdk-admin
-Package.swift @firebase/firebase-ios-sdk-admin
+/Package.swift @firebase/firebase-ios-sdk-admin
 Dangerfile @firebase/firebase-ios-sdk-admin
 **/Public @firebase/firebase-ios-sdk-admin
 *.podspec @firebase/firebase-ios-sdk-admin

.github/actions/notices_generation/action.yml

@@ -15,8 +15,7 @@ inputs:
   search-local-pod-version:
     description: 'Add pod version from local spec repo'
     required: true
-    default: false
-    type: boolean
+    default: 'false'
   notices-path:
     description: 'Path of Notices file containing all licences.'
     required: true
@@ -30,14 +29,20 @@ runs:
     with:
       ruby-version: "2.7"
   - name: Generate a NOTICES file
+    env:
+      PODS: ${{ inputs.pods }}
+      SOURCES: ${{ inputs.sources }}
+      MIN_IOS_VERSION: ${{ inputs.min-ios-version }}
+      SEARCH_LOCAL_POD_VERSION: ${{ inputs.search-local-pod-version }}
+      NOTICES_PATH: ${{ inputs.notices-path }}
     run: |
       cd "${{ github.action_path }}"
       bundle install
-      if ${{ inputs.search-local-pod-version == 'true' }} ; then
-        ruby app.rb --pods ${{ inputs.pods }} --sources ${{ inputs.sources }} --min_ios_version ${{ inputs.min-ios-version }} --search_local_pod_version --notices_path ${{ inputs.notices-path }}
-      else
-        ruby app.rb --pods ${{ inputs.pods }} --sources ${{ inputs.sources }} --min_ios_version ${{ inputs.min-ios-version }} --notices_path ${{ inputs.notices-path }}
+      args=("--pods" "$PODS" "--sources" "$SOURCES" "--min_ios_version" "$MIN_IOS_VERSION" "--notices_path" "$NOTICES_PATH")
+      if [ "$SEARCH_LOCAL_POD_VERSION" == "true" ]; then
+        args+=("--search_local_pod_version")
       fi
+      ruby app.rb "${args[@]}"
     shell: bash
   - name: Upload artifacts
     uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0

.github/workflows/_build.yml

@@ -65,15 +65,15 @@ jobs:
           else
             has_secrets="false"
           fi
-          echo "has_secrets=$has_secrets" >> $GITHUB_OUTPUT
+          echo "has_secrets=$has_secrets" >> "$GITHUB_OUTPUT"
 
           # 2. Determine if the build job should run.
           #    - Skip if on a fork AND secrets are present.
           repo_full_name=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
           if [[ "$repo_full_name" != "firebase/firebase-ios-sdk" && "$has_secrets" == "true" ]]; then
-            echo "should_run=false" >> $GITHUB_OUTPUT
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
           else
-            echo "should_run=true" >> $GITHUB_OUTPUT
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
           fi
 
   build:
@@ -94,6 +94,8 @@ jobs:
       FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
       if: inputs.method != 'spm' && inputs.method != 'spmbuildonly' && inputs.method != 'cmake'
     - name: Setup Bundler
@@ -105,20 +107,24 @@ jobs:
         retry_wait_seconds: 300
         command: scripts/setup_bundler.sh
     - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ inputs.xcode }}.app/Contents/Developer
+      env:
+        XCODE_VERSION: ${{ inputs.xcode }}
+      run: sudo xcode-select -s /Applications/"$XCODE_VERSION".app/Contents/Developer
     - name: Install simulators
       if: inputs.platform != 'macOS' && inputs.platform != 'catalyst'
+      env:
+        PLATFORM_INPUT: ${{ inputs.platform }}
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
       with:
         timeout_minutes: 15
         max_attempts: 5
         retry_wait_seconds: 120
         continue_on_error: true
         command: |
-          if [[ "${{ inputs.platform }}" == "all" ]]; then
+          if [[ "$PLATFORM_INPUT" == "all" ]]; then
             xcodebuild -downloadAllPlatforms
           else
-            xcodebuild -downloadPlatform ${{ inputs.platform }}
+            xcodebuild -downloadPlatform "$PLATFORM_INPUT"
           fi
     - name: Run setup command
       if: inputs.setup_command != ''

.github/workflows/_cocoapods.cron.yml

@@ -64,6 +64,8 @@ jobs:
         flags: ${{ fromJson(inputs.flags) }}
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
@@ -73,10 +75,12 @@ jobs:
         retry_wait_seconds: 300
         command: scripts/setup_bundler.sh
     - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ inputs.xcode }}.app/Contents/Developer
+      env:
+        XCODE_VERSION: ${{ inputs.xcode }}
+      run: sudo xcode-select -s /Applications/"$XCODE_VERSION".app/Contents/Developer
     - name: Set FIREBASE_CI, if needed.
       if: inputs.ignore_deprecation_warnings == true
-      run: echo "FIREBASE_CI=true" >> $GITHUB_ENV
+      run: echo "FIREBASE_CI=true" >> "$GITHUB_ENV"
     - name: Run setup command, if needed.
       if: inputs.setup_command != ''
       env:

.github/workflows/_cocoapods.yml

@@ -139,9 +139,11 @@ jobs:
     steps:
     - name: Skip, if applicable.
       # Skip matrix combinations that weren't requested, while preserving the specific macos-14 / iOS inclusion.
-      if: contains(join(inputs.platforms), matrix.platform) == false && matrix.os != 'macos-14'
+      if: contains(inputs.platforms, matrix.platform) == false && matrix.os != 'macos-14'
       run: exit 0
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
@@ -163,18 +165,20 @@ jobs:
         command: xcodebuild -downloadPlatform ${{ matrix.platform }}
     - name: Set conditional environment variable, if needed.
       if: inputs.product == 'FirebaseAuth'
-      run: echo "FIREBASE_CI=true" >> $GITHUB_ENV
+      run: echo "FIREBASE_CI=true" >> "$GITHUB_ENV"
     - name: Set podspec Swift version to 6.0, if supported.
       if: inputs.supports_swift6 == true && matrix.os != 'macos-14'
-      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '6.0'/" ${{ inputs.product }}.podspec
+      env:
+        PRODUCT: ${{ inputs.product }}
+      run: sed -i "" "s/s.swift_version[[:space:]]*=[[:space:]]*'5.9'/s.swift_version = '6.0'/" "$PRODUCT".podspec
     - name: Run setup command, if needed.
       if: inputs.setup_command != ''
       env:
         plist_secret: ${{ secrets.plist_secret }}
       run: ${{ inputs.setup_command }}
     - name: Lint ${{ inputs.product }}.podspec for ${{ matrix.platform }}
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      if: contains(join(inputs.platforms), matrix.platform) || matrix.os == 'macos-14'
+      if: contains(inputs.platforms, matrix.platform) || matrix.os == 'macos-14'
       with:
         timeout_minutes: ${{ inputs.timeout_minutes }}
         max_attempts: 3

.github/workflows/_quickstart.framework.yml

@@ -54,14 +54,16 @@ on:
 
 jobs:
   quickstart_framework:
-    if: ${{ !cancelled() }}
+    if: github.event.pull_request.head.repo.fork == false && !cancelled()
     env:
       plist_secret: ${{ secrets.plist_secret }}
       SDK: ${{ inputs.product }}
       SCHEME: ${{ inputs.scheme }}
     runs-on: ${{ inputs.os }}
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
     - name: Get framework dir
       uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
@@ -70,7 +72,9 @@ jobs:
         github-token: ${{ secrets.github_token }}
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Xcode
-      run: sudo xcode-select -s /Applications/${{ inputs.xcode }}.app/Contents/Developer
+      env:
+        XCODE_VERSION: ${{ inputs.xcode }}
+      run: sudo xcode-select -s /Applications/"$XCODE_VERSION".app/Contents/Developer
     - name: Setup Bundler
       run: ./scripts/setup_bundler.sh
     - name: Move frameworks
@@ -80,8 +84,11 @@ jobs:
     - name: Setup quickstart
       run: ${{ inputs.setup_command }}
     - name: Install Secret GoogleService-Info.plist
-      run: scripts/decrypt_gha_secret.sh ${{ inputs.plist_src_path }} \
-        ${{ inputs.plist_dst_path }} "$plist_secret"
+      env:
+        PLIST_SRC_PATH: ${{ inputs.plist_src_path }}
+        PLIST_DST_PATH: ${{ inputs.plist_dst_path }}
+      run: scripts/decrypt_gha_secret.sh "$PLIST_SRC_PATH" \
+        "$PLIST_DST_PATH" "$plist_secret"
     - name: Test Quickstart
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
       with:

.github/workflows/_quickstart.yml

@@ -72,6 +72,8 @@ jobs:
     runs-on: macos-15
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Prereqs
       run: gem install xcpretty
@@ -80,30 +82,40 @@ jobs:
     - name: Run setup command.
       run: ${{ inputs.setup_command }}
     - name: Install Secret GoogleService-Info.plist
+      env:
+        PLIST_SRC_PATH: ${{ inputs.plist_src_path }}
+        PLIST_DST_PATH: ${{ inputs.plist_dst_path }}
       run: |
           scripts/decrypt_gha_secret.sh \
-            ${{ inputs.plist_src_path }} \
-            ${{ inputs.plist_dst_path }} \
+            "$PLIST_SRC_PATH" \
+            "$PLIST_DST_PATH" \
             "$plist_secret"
     - name: Build ${{ inputs.product }} Quickstart
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
+      env:
+        PRODUCT: ${{ inputs.product }}
+        RUN_TESTS: ${{ inputs.run_tests }}
       with:
         timeout_minutes: 15
         max_attempts: 3
         retry_wait_seconds: 120
         command: |
-          SPM=true DIR=${{ inputs.product }} scripts/test_quickstart.sh \
-            ${{ inputs.product }} \
-            ${{ inputs.run_tests }}
+          SPM=true DIR="$PRODUCT" scripts/test_quickstart.sh \
+            "$PRODUCT" \
+            "$RUN_TESTS"
     # Failure sequence to upload artifact.
     - id: lowercase_product
       if: failure()
+      env:
+        PRODUCT: ${{ inputs.product }}
       run: |
-        lowercase_product=$(echo "${{ inputs.product }}" | tr '[:upper:]' '[:lower:]')
-        echo "lowercase_product=$lowercase_product" >> $GITHUB_OUTPUT
+        lowercase_product=$(echo "$PRODUCT" | tr '[:upper:]' '[:lower:]')
+        echo "lowercase_product=$lowercase_product" >> "$GITHUB_OUTPUT"
     - name: Remove data before upload.
       if: failure()
-      run: scripts/remove_data.sh ${{ steps.lowercase_product.outputs.lowercase_product }}
+      env:
+        LOWERCASE_PRODUCT: ${{ steps.lowercase_product.outputs.lowercase_product }}
+      run: scripts/remove_data.sh "$LOWERCASE_PRODUCT"
     - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure()
       with:

.github/workflows/_spm.yml

@@ -112,6 +112,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
     - uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: .build
@@ -133,17 +135,19 @@ jobs:
     - name: Initialize xcodebuild
       run: scripts/setup_spm_tests.sh
     - uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-      if: contains(join(inputs.platforms), matrix.platform) || matrix.os == 'macos-14'
+      if: contains(inputs.platforms, matrix.platform) || matrix.os == 'macos-14'
       env:
         FIREBASE_IS_NIGHTLY_TESTING: ${{ inputs.is_nightly && '1' || '' }}
+        TARGET: ${{ inputs.target }}
+        PLATFORM: ${{ matrix.platform }}
       with:
         timeout_minutes: 15
         max_attempts: 3
         retry_wait_seconds: 120
         command: |
           ./scripts/build.sh \
-            ${{ inputs.target }} \
-            ${{ matrix.platform }} \
+            "$TARGET" \
+            "$PLATFORM" \
             ${{ (contains(inputs.buildonly_platforms, matrix.platform) || contains(inputs.buildonly_platforms, 'all')) && 'spmbuildonly' || 'spm' }}
     - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}

.github/workflows/infra.api_diff.yml

@@ -13,9 +13,16 @@ env:
   BASE_API_OUTPUT: ci_outputs/base_branch_api
   DIFF_REPORT_OUTPUT: ci_outputs/diff_report
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   diff_report:
     runs-on: macos-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
 
@@ -24,14 +31,15 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Copy diff report tools
         run: cp -a scripts/api_diff_report/. ~/api_diff_report
 
       - id: get_changed_files
         name: Get changed file list
         run: |
-          echo "file_list=$(git diff --name-only -r HEAD^1 HEAD | tr '\n' ' ')" >> $GITHUB_OUTPUT
+          echo "file_list=$(git diff --name-only -r HEAD^1 HEAD | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
 
       - name: Setup python
         uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
@@ -42,27 +50,36 @@ jobs:
         run:  ~/api_diff_report/prerequisite.sh
 
       - name: Clean Diff Report Comment in PR
+        env:
+          STAGE: ${{ env.STAGE_PROGRESS }}
+          TOKEN: ${{github.token}}
+          PR_NUMBER: ${{github.event.pull_request.number}}
+          RUN_ID: ${{github.run_id}}
         run: |
           python ~/api_diff_report/pr_commenter.py \
-            --stage ${{ env.STAGE_PROGRESS }} \
-            --token ${{github.token}} \
-            --pr_number ${{github.event.pull_request.number}} \
-            --commit $GITHUB_SHA \
-            --run_id ${{github.run_id}}
+            --stage "$STAGE" \
+            --token "$TOKEN" \
+            --pr_number "$PR_NUMBER" \
+            --commit "$GITHUB_SHA" \
+            --run_id "$RUN_ID"
 
       - name: Generate API files for PR branch
+        env:
+          FILE_LIST: ${{ steps.get_changed_files.outputs.file_list }}
         run: |
           python ~/api_diff_report/api_info.py \
-            --file_list ${{ steps.get_changed_files.outputs.file_list }} \
+            --file_list "$FILE_LIST" \
             --output_dir ${{ env.PR_API_OUTPUT }}
 
       - name: Checkout Base branch
         run: git checkout HEAD^
 
       - name: Generate API files for Base branch
+        env:
+          FILE_LIST: ${{ steps.get_changed_files.outputs.file_list }}
         run: |
           python ~/api_diff_report/api_info.py \
-            --file_list ${{ steps.get_changed_files.outputs.file_list }} \
+            --file_list "$FILE_LIST" \
             --output_dir ${{ env.BASE_API_OUTPUT }}
 
       - name: Generate API Diff Report
@@ -73,14 +90,20 @@ jobs:
             --output_dir ${{ env.DIFF_REPORT_OUTPUT }}
 
       - name: Update Diff Report Comment in PR
+        env:
+          STAGE: ${{ env.STAGE_END }}
+          REPORT: ${{ env.DIFF_REPORT_OUTPUT }}
+          TOKEN: ${{github.token}}
+          PR_NUMBER: ${{github.event.pull_request.number}}
+          RUN_ID: ${{github.run_id}}
         run: |
           python ~/api_diff_report/pr_commenter.py \
-            --stage ${{ env.STAGE_END }} \
-            --report ${{ env.DIFF_REPORT_OUTPUT }} \
-            --token ${{github.token}} \
-            --pr_number ${{github.event.pull_request.number}} \
-            --commit $GITHUB_SHA \
-            --run_id ${{github.run_id}}
+            --stage "$STAGE" \
+            --report "$REPORT" \
+            --token "$TOKEN" \
+            --pr_number "$PR_NUMBER" \
+            --commit "$GITHUB_SHA" \
+            --run_id "$RUN_ID"
 
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ !cancelled() }}