Repository navigation
ci: build every iOS and macOS app with Swift Package Manager only - #18852
Merged
Merged
Conversation
Every example except firebase_auth and firebase_crashlytics, and the tests/ smoke app, now builds with Swift Package Manager only: - run `pod deintegrate`, delete the Podfile and drop the Pods workspace ref, xcconfig includes and stale Pods header search paths - let `flutter build <platform> --config-only` add the Swift Package Manager integration (and Flutter's other Xcode project migrations), so local builds no longer rewrite the projects - pin `enable-swift-package-manager: true` in each pubspec - drop the CocoaPods-only Crashlytics upload-symbols phase from tests/ - firebase_data_connect: drop the SPM opt-out and the unused google_sign_in dependency that could not resolve under SPM firebase_auth (google_sign_in) and firebase_crashlytics (PODS_ROOT build scripts) stay on CocoaPods until they can resolve under SPM.
- reusable macOS e2e: SPM by default, with a `macos-spm` opt-out like the iOS job's `ios-spm`; firebase_auth and firebase_crashlytics keep CocoaPods on both platforms - cloud_functions and firebase_performance iOS rejoin SPM: the Xcode 26.2 pin their opt-out blamed is gone - firebase_data_connect iOS and the smoke app's iOS/macOS jobs switch from CocoaPods to SPM and drop their Pods caches - drop the CI-time `pod deintegrate` steps now that the examples commit no Podfile - fail every SPM build that still runs `pod install`, so a silent CocoaPods fallback can't pass - document the SPM-only setup in CONTRIBUTING.md
…ckage Manager The macOS package's privacy manifest was a relative symlink into the iOS sources. Under SPM, Xcode reads a path-dependency plugin through Flutter's ephemeral package symlink, where that relative target no longer resolves, so any app depending on firebase_messaging from this repository (the tests/ smoke app, swift-integration's macOS build) failed with "PrivacyInfo.xcprivacy couldn't be opened". Copy the file instead, and drop swift-integration's workaround that removed firebase_messaging from its macOS build.
- pin enable-swift-package-manager: false in the firebase_auth and firebase_crashlytics examples, so a local build is plain CocoaPods rather than a broken hybrid - retry the smoke and firebase_data_connect builds once on the SPM package resolution race, like the reusable jobs - stream the macOS build log instead of printing it afterwards
google_sign_in could not resolve under SPM (every GoogleSignIn-iOS release needs App Check 11, Firebase Apple SDK 13 needs 12), and flutter_facebook_auth's macOS implementation ships no Package.swift. Sign in through FirebaseAuth itself instead and drop google_sign_in, google_sign_in_dartio and flutter_facebook_auth: - Google: signInWithProvider on Android and iOS, signInWithPopup on web; hidden on Windows, which has no provider flow (macOS already shows only Apple) - Facebook: web only, as Firebase rejects it through the generic provider flow on Apple and Android - remove the Facebook keys and URL scheme from the iOS Info.plist Then remove CocoaPods from the iOS and macOS projects like the other examples and pin enable-swift-package-manager: true.
The example's build phases ran Crashlytics' run and upload-symbols tools
from $PODS_ROOT, which does not exist under SPM. Call them from the
firebase-ios-sdk checkout SPM makes instead: next to the build products
(${BUILD_DIR%/Build/*}/SourcePackages, as Firebase documents, which is
also where `flutter build` clones it), falling back to
build/<platform>/SourcePackages for archives, where BUILD_DIR points into
DerivedData.
On macOS, keep the guard CocoaPods used to add at `pod install` time
(crashlytics_add_upload_symbols): skip Debug builds and builds without
a dSYM instead of uploading on every build.
Then remove CocoaPods from both projects like the other examples and pin
enable-swift-package-manager: true.
Every example now builds with Swift Package Manager, so remove the ios-spm/macos-spm inputs, the 'Disable Swift Package Manager' steps and the Pods caches, and always fail a build that runs pod install.
Contributor
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. |
Flutter adds a plugin's own Swift package to its example app's Xcode
project as a local override, at the plugin's real path. When Xcode
resolves that override instead of the copy in Flutter's ephemeral
package symlink farm, the plugin's path: "../firebase_core" and
"../FlutterFramework" dependencies point next to the real package and
resolution fails ("... doesn't exist in file system"). The CI's default
Xcode 27.0 did this for 4 of 11 macOS examples and the Firestore
pipeline example, twice in a row each.
Link those sibling dependencies into the plugin's platform directory,
pointing at the farm Flutter generates, before every example build.
Locally, fresh resolutions of the storage macOS and pipeline iOS examples
failed 7 of 10 times without the links and 0 of 12 with them.
The test added in #18797 signs in anonymously, which persists the user to the keychain. The unsigned CI macOS app cannot write to it (errSecMissingEntitlement, -34018), so the e2e-auth macOS job has failed on main since. Skip it on macOS like the file's other sign-in tests; the signed-out variant still runs there.
Lyokone
marked this pull request as ready for review
October 22, 2026 11:40
SelaseKay
requested changes
Oct 22, 2026
SelaseKay
left a comment
SelaseKay
left a comment
Contributor
There was a problem hiding this comment.
The auth example's Google button on Android now calls signInWithProvider, and example/android/app/src/main/AndroidManifest.xml still sets android:taskAffinity="". That is the combination docs/auth/federated-auth.md warns about: the Chrome Custom Tab closes when the user switches apps, and coming back fails with web-context-already-presented. Let's remove android:taskAffinity="" from that manifest.
The example's Google button now uses signInWithProvider on Android, like the GitHub, Microsoft, Twitter and Yahoo ones. With android:taskAffinity="" the Chrome Custom Tab closes when the user switches apps and returning fails with web-context-already-presented, as docs/auth/federated-auth.md warns.
SelaseKay
approved these changes
Oct 22, 2026
demolaf
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Moves every iOS and macOS build in the repository, in CI and locally, to Swift Package Manager only. The CocoaPods trunk goes read-only at the end of 2026, and Firebase Apple SDK 13 is SPM-only, so the CocoaPods jobs were still testing 12.x.
Before: iOS e2e mostly used SPM, but auth, crashlytics, functions and performance used CocoaPods, and FDC was effectively CocoaPods too (its pubspec turned SPM off). Every macOS e2e job and both smoke test jobs used CocoaPods on purpose. All 35 example and
tests/Apple projects committed a Podfile, so a localflutter runbuilt with CocoaPods or a mix of both.After: no Podfile and no CocoaPods opt-out remain anywhere.
tests/apps: CocoaPods is removed withpod deintegrate, along with the Podfile, the Pods workspace ref, the xcconfig includes and stale header search paths. Flutter's--config-onlythen added the SPM integration (and its usual Xcode project migrations), so local builds no longer rewrite the projects. Every pubspec pinsenable-swift-package-manager: true.firebase_authexample:google_sign_incouldn't resolve under SPM: every GoogleSignIn-iOS release needs App Check 11, while Firebase SDK 13 needs 12. [App Check] Add SPM AppCheckCore 12.x support google/GoogleSignIn-iOS#626 is merged but not released yet.flutter_facebook_auth's macOS implementation has noPackage.swift. The example now signs in through FirebaseAuth instead:signInWithProvideron Android and iOS andsignInWithPopupon web, and is hidden on Windows.google_sign_in,google_sign_in_dartioandflutter_facebook_authare removed.firebase_crashlyticsexample: the build phases callCrashlytics/runandupload-symbolsfrom the SPM checkout instead of$PODS_ROOT. That checkout is${BUILD_DIR%/Build/*}/SourcePackages, falling back tobuild/<platform>/SourcePackagesfor archives. macOS keeps the Debug / no-dSYM guard thatpod installused to inject.firebase_data_connectexample: drops its SPM opt-out and an unusedgoogle_sign_independency.tests/smoke app: drops the CocoaPods-generated Crashlytics upload-symbols phase.firebase_messaging(macOS): the bundledPrivacyInfo.xcprivacywas a relative symlink intoios/. Under SPM, Xcode reads path-dependency plugins through Flutter's ephemeral package symlink, so the link didn't resolve and every macOS SPM build that included messaging failed. It is now a real copy, and swift-integration's workaround that dropped messaging from its macOS build is removed.reusable_e2e_ios.yamlandreusable_e2e_macos.yamllose theios-spminput (and the short-livedmacos-spm), the "Disable Swift Package Manager" steps and the Pods caches.pod deintegratesteps are gone.pod install, so a silent CocoaPods fallback can't pass.CONTRIBUTING.mddocuments the SPM-only setup.The plugins' podspecs are unchanged, so apps that use FlutterFire with CocoaPods keep working.
Testing
pod installin any of them:tests/.tests/.tests/macOS failed on the messaging privacy-manifest symlink before the fix and passes after it.$PODS_ROOTscript and passes with the new one. The new scripts were also checked against simulated Xcode,flutter buildand archive layouts.actionlintandshellcheckare clean apart from the existingxcode-27runner label andall_plugins.yamlnotes.flutter_plugin_tools formatis clean.Notes for reviewers
flutter: config:key needs Flutter 3.35 or newer. The examples still declareflutter: '>=3.27.0', so older tools reject the pubspec. CI uses stable.Related Issues
None filed.
Checklist
///).melos run analyze) does not report any problems on my PR. (dart analyzeis clean on the changed Dart files; full analyze pending CI.)Breaking Change