Enable Firebase AppCheck with Sample + isolate AppCheckCore for Google SignIn

.github/workflows/ci.yml

@@ -17,14 +17,20 @@ permissions:
 
 jobs:
   build:
-    runs-on: macos-14
+    runs-on: macos-15
     env:
       CAKE_NAMES: ${{ inputs.names || 'Google.SignIn' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup .NET (global.json)
+      - name: Toolchain versions
+        run: |
+          xcodebuild -version
+          swift --version
+          xcode-select -p
+
+      - name: Setup .NET SDK
         uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json

.github/workflows/publish-github-packages.yml

@@ -17,18 +17,33 @@ permissions:
 
 jobs:
   publish:
-    runs-on: macos-14
+    runs-on: macos-15
     env:
       CAKE_NAMES: ${{ inputs.names || 'Google.SignIn' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup .NET (global.json)
+      - name: Toolchain versions
+        run: |
+          xcodebuild -version
+          swift --version
+          xcode-select -p
+
+      - name: Setup .NET SDK
         uses: actions/setup-dotnet@v4
         with:
           global-json-file: global.json
 
+      - name: Configure GitHub Packages NuGet source (this repo owner)
+        run: |
+          dotnet nuget remove source "github-owner" >/dev/null 2>&1 || true
+          dotnet nuget add source "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json" \
+            --name "github-owner" \
+            --username "${{ github.actor }}" \
+            --password "${{ secrets.GITHUB_TOKEN }}" \
+            --store-password-in-clear-text
+
       - name: Restore .NET workloads
         run: dotnet workload restore Xamarin.Google.sln
 

CONTRIBUTING.md

@@ -42,6 +42,31 @@ Most contributions fall into one of these buckets:
 * **Signing vs build-only**: device builds require provisioning; CI should validate “build-only” (no signing) where possible.
 * **URL scheme callbacks**: OAuth-style flows often require `Info.plist` URL scheme changes in addition to config files.
 
+## Versioning notes (Cake vs .csproj)
+
+The Cake pipeline updates versions in binding `.csproj` files during the `externals` step:
+
+* `FileVersion` is always set to `artifact.NugetVersion` (from `components.cake`).
+* `PackageVersion` is set to `artifact.NugetVersion` **unless** the project already specifies a pre-release suffix (e.g. `12.5.0.4-fork`).
+
+This allows forked builds to publish `-fork` (or similar) packages without changing the shared component version line in `components.cake`, while keeping deterministic, aligned build outputs.
+
+## Fork testing suffix policy (`-local` vs `-fork`)
+
+When validating a binding fix before upstream release:
+
+* Use `-local` for packages built on a developer machine and consumed from a local NuGet source.
+* Use `-fork` for packages built by your fork CI and published to GitHub Packages.
+
+Suggested flow:
+
+1. Set a temporary prerelease `PackageVersion` (for example `12.5.0.4-fork` or `12.5.0.4-local`) in the affected project(s).
+2. Build/publish from the matching channel (local machine for `-local`, GitHub Actions for `-fork`).
+3. Consume that package from downstream repos to validate the fix.
+4. Before opening an upstream PR, revert temporary prerelease versions/references back to the canonical version line expected upstream.
+
+Important: do not merge or submit upstream PRs with temporary fork-only or local-only package versions unless explicitly requested by maintainers.
+
 ## Validation checklist (before requesting review)
 
 At minimum, validate the component(s) you touched:

build.cake

@@ -63,7 +63,8 @@ Setup (context =>
 {
 	IS_LOCAL_BUILD = string.IsNullOrWhiteSpace (EnvironmentVariable ("AGENT_ID"));
 	Information ($"Is a local build? {IS_LOCAL_BUILD}");
-	BACKSLASH = IS_LOCAL_BUILD ? @"\" : @"\";
+	// Always use forward slashes for MSBuild targets on all platforms
+	BACKSLASH = "/";
 });
 
 Task("build")
@@ -174,17 +175,18 @@ Task ("libs")
 	.IsDependentOn("ci-setup")
 	.Does(() =>
 {
-	var msBuildSettings = new DotNetCoreMSBuildSettings ();
 	var dotNetCoreBuildSettings = new DotNetCoreBuildSettings { 
 		Configuration = "Release",
 		Verbosity = DotNetCoreVerbosity.Diagnostic,
-		MSBuildSettings = msBuildSettings
+		NoRestore = false
 	};
 
-	foreach (var target in SOURCES_TARGETS)
-		msBuildSettings.Targets.Add($@"source\{target}");
-
-	DotNetCoreBuild(SOLUTION_PATH, dotNetCoreBuildSettings);
+	// Build each artifact's csproj directly instead of using solution targets
+	foreach (var artifact in ARTIFACTS_TO_BUILD) {
+		var csprojPath = $"./source/{artifact.ComponentGroup}/{artifact.CsprojName}/{artifact.CsprojName}.csproj";
+		Information ($"Building: {csprojPath}");
+		DotNetCoreBuild(csprojPath, dotNetCoreBuildSettings);
+	}
 });
 
 Task ("samples")
@@ -199,13 +201,22 @@ Task ("samples")
 	var dotNetCoreBuildSettings = new DotNetCoreBuildSettings { 
 		Configuration = "Release",
 		Verbosity = DotNetCoreVerbosity.Diagnostic,
+		NoRestore = false,
 		MSBuildSettings = msBuildSettings
 	};
 
-	foreach (var target in SAMPLES_TARGETS)
-		msBuildSettings.Targets.Add($@"samples-using-source\{target}");
-
-	DotNetCoreBuild(SOLUTION_PATH, dotNetCoreBuildSettings);
+	// Build each sample csproj directly
+	foreach (var artifact in ARTIFACTS_TO_BUILD) {
+		if (artifact.Samples == null)
+			continue;
+		foreach (var sample in artifact.Samples) {
+			var samplePath = $"./samples/{artifact.ComponentGroup}/{sample}/{sample}.csproj";
+			if (FileExists(samplePath)) {
+				Information ($"Building sample: {samplePath}");
+				DotNetCoreBuild(samplePath, dotNetCoreBuildSettings);
+			}
+		}
+	}
 });
 
 Task ("nuget")
@@ -222,8 +233,12 @@ Task ("nuget")
 		Verbosity = DotNetCoreVerbosity.Diagnostic,
 	};
 
-	foreach (var target in SOURCES_TARGETS)
-		DotNetCorePack($"./source/{target}", dotNetCorePackSettings);
+	// Pack each artifact's csproj directly
+	foreach (var artifact in ARTIFACTS_TO_BUILD) {
+		var csprojPath = $"./source/{artifact.ComponentGroup}/{artifact.CsprojName}/{artifact.CsprojName}.csproj";
+		Information ($"Packing: {csprojPath}");
+		DotNetCorePack(csprojPath, dotNetCorePackSettings);
+	}
 });
 
 Task ("clean")

common.cake

@@ -61,7 +61,9 @@ void UpdateVersionInCsproj (Artifact artifact)
 	var componentGroup = artifact.ComponentGroup.ToString ();
 	var csprojPath = $"./source/{componentGroup}/{artifact.CsprojName}/{artifact.CsprojName}.csproj";
 	XmlPoke(csprojPath, "/Project/PropertyGroup/FileVersion", artifact.NugetVersion);
-	XmlPoke(csprojPath, "/Project/PropertyGroup/PackageVersion", artifact.NugetVersion);
+	var currentPackageVersion = XmlPeek(csprojPath, "/Project/PropertyGroup/PackageVersion");
+	if (!currentPackageVersion.Contains("-"))
+		XmlPoke(csprojPath, "/Project/PropertyGroup/PackageVersion", artifact.NugetVersion);
 }
 
 void CreateAndInstallPodfile (Artifact artifact)
@@ -345,6 +347,14 @@ void BuildXcodeFatFramework (FilePath xcodeProject, PodSpec [] podSpecs, Platfor
 
 	workingDirectory = workingDirectory ?? Directory("./externals/");
 	buildSettings = buildSettings ?? new Dictionary<string, string> ();
+	if (!buildSettings.ContainsKey("CODE_SIGNING_ALLOWED"))
+		buildSettings["CODE_SIGNING_ALLOWED"] = "NO";
+	if (!buildSettings.ContainsKey("CODE_SIGNING_REQUIRED"))
+		buildSettings["CODE_SIGNING_REQUIRED"] = "NO";
+	if (!buildSettings.ContainsKey("CODE_SIGN_IDENTITY"))
+		buildSettings["CODE_SIGN_IDENTITY"] = "";
+	if (!buildSettings.ContainsKey("EXPANDED_CODE_SIGN_IDENTITY"))
+		buildSettings["EXPANDED_CODE_SIGN_IDENTITY"] = "";
 
 	foreach (var podSpec in podSpecs) {
 		var target = podSpec.TargetName;
@@ -423,6 +433,14 @@ void BuildXcodeXcframework (FilePath xcodeProject, PodSpec [] podSpecs, Platform
 
 	workingDirectory = workingDirectory ?? Directory ("./externals/");
 	buildSettings = buildSettings ?? new Dictionary<string, string> ();
+	if (!buildSettings.ContainsKey("CODE_SIGNING_ALLOWED"))
+		buildSettings["CODE_SIGNING_ALLOWED"] = "NO";
+	if (!buildSettings.ContainsKey("CODE_SIGNING_REQUIRED"))
+		buildSettings["CODE_SIGNING_REQUIRED"] = "NO";
+	if (!buildSettings.ContainsKey("CODE_SIGN_IDENTITY"))
+		buildSettings["CODE_SIGN_IDENTITY"] = "";
+	if (!buildSettings.ContainsKey("EXPANDED_CODE_SIGN_IDENTITY"))
+		buildSettings["EXPANDED_CODE_SIGN_IDENTITY"] = "";
 
 	foreach (var podSpec in podSpecs) {
 		Information ($"Building the following framework: {podSpec.FrameworkName}...");

components.cake

@@ -14,7 +14,7 @@ Artifact FIREBASE_PERFORMANCE_MONITORING_ARTIFACT  = new Artifact ("Firebase.Per
 Artifact FIREBASE_REMOTE_CONFIG_ARTIFACT           = new Artifact ("Firebase.RemoteConfig",           "12.5.0.4",  "15.0", ComponentGroup.Firebase, csprojName: "RemoteConfig");
 Artifact FIREBASE_STORAGE_ARTIFACT                 = new Artifact ("Firebase.Storage",                "12.5.0.4",  "15.0", ComponentGroup.Firebase, csprojName: "Storage");
 //Artifact FIREBASE_APP_DISTRIBUTION_ARTIFACT      = new Artifact ("Firebase.AppDistribution",        "8.10.0.1",  "15.0", ComponentGroup.Firebase, csprojName: "AppDistribution");
-//Artifact FIREBASE_APP_CHECK_ARTIFACT             = new Artifact ("Firebase.AppCheck",               "8.10.0.1",  "15.0", ComponentGroup.Firebase, csprojName: "AppCheck");
+Artifact FIREBASE_APP_CHECK_ARTIFACT               = new Artifact ("Firebase.AppCheck",               "12.5.0.4",  "15.0", ComponentGroup.Firebase, csprojName: "AppCheck");
 
 // Google artifacts available to be built. These artifacts generate NuGets.
 Artifact GOOGLE_ANALYTICS_ARTIFACT                 = new Artifact ("Google.Analytics",                "3.20.0.2",  "15.0", ComponentGroup.Google, csprojName: "Analytics");
@@ -23,6 +23,7 @@ Artifact GOOGLE_MAPS_ARTIFACT                      = new Artifact ("Google.Maps"
 Artifact GOOGLE_MOBILE_ADS_ARTIFACT                = new Artifact ("Google.MobileAds",                "8.13.0.3",  "15.0", ComponentGroup.Google, csprojName: "MobileAds");
 Artifact GOOGLE_UMP_ARTIFACT                       = new Artifact ("Google.UserMessagingPlatform",    "1.1.0.1",   "15.0", ComponentGroup.Google, csprojName: "UserMessagingPlatform");
 Artifact GOOGLE_PLACES_ARTIFACT                    = new Artifact ("Google.Places",                   "7.4.0.2",   "15.0", ComponentGroup.Google, csprojName: "Places");
+Artifact GOOGLE_APP_CHECK_CORE_ARTIFACT            = new Artifact ("Google.AppCheckCore",              "11.2.0.0",  "15.0", ComponentGroup.Google, csprojName: "AppCheckCore");
 Artifact GOOGLE_SIGN_IN_ARTIFACT                   = new Artifact ("Google.SignIn",                   "9.0.0.0",   "15.0", ComponentGroup.Google, csprojName: "SignIn");
 Artifact GOOGLE_TAG_MANAGER_ARTIFACT               = new Artifact ("Google.TagManager",               "7.4.0.2",   "15.0", ComponentGroup.Google, csprojName: "TagManager");
 
@@ -64,7 +65,7 @@ var ARTIFACTS = new Dictionary<string, Artifact> {
 	{ "Firebase.RemoteConfig",           FIREBASE_REMOTE_CONFIG_ARTIFACT },
 	{ "Firebase.Storage",                FIREBASE_STORAGE_ARTIFACT },
 	// { "Firebase.AppDistribution",        FIREBASE_APP_DISTRIBUTION_ARTIFACT },
-	// { "Firebase.AppCheck",               FIREBASE_APP_CHECK_ARTIFACT },
+	{ "Firebase.AppCheck",               FIREBASE_APP_CHECK_ARTIFACT },
 
     { "Google.GoogleAppMeasurement",  GOOGLE_GOOGLE_APP_MEASUREMENT_ARTIFACT },
 	{ "Google.Analytics",             GOOGLE_ANALYTICS_ARTIFACT },
@@ -74,6 +75,7 @@ var ARTIFACTS = new Dictionary<string, Artifact> {
 	{ "Google.UserMessagingPlatform", GOOGLE_UMP_ARTIFACT },
 	{ "Google.Places",                GOOGLE_PLACES_ARTIFACT },
 	{ "Google.SignIn",                GOOGLE_SIGN_IN_ARTIFACT },
+	{ "Google.AppCheckCore",          GOOGLE_APP_CHECK_CORE_ARTIFACT },
 	{ "Google.TagManager",            GOOGLE_TAG_MANAGER_ARTIFACT },
 	{ "Google.GTMSessionFetcher",     GOOGLE_GTM_SESSION_FETCHER_ARTIFACT },
 	{ "Google.PromisesObjC",          GOOGLE_PROMISES_OBJC_ARTIFACT },
@@ -113,16 +115,17 @@ void SetArtifactsDependencies ()
 	FIREBASE_REMOTE_CONFIG_ARTIFACT.Dependencies           = new [] { FIREBASE_CORE_ARTIFACT, FIREBASE_INSTALLATIONS_ARTIFACT, FIREBASE_AB_TESTING_ARTIFACT };
 	FIREBASE_STORAGE_ARTIFACT.Dependencies                 = new [] { FIREBASE_CORE_ARTIFACT, FIREBASE_DATABASE_ARTIFACT, GOOGLE_GTM_SESSION_FETCHER_ARTIFACT /* Needed for sample FIREBASE_AUTH_ARTIFACT */ };
 	// FIREBASE_APP_DISTRIBUTION_ARTIFACT.Dependencies        = new [] { FIREBASE_CORE_ARTIFACT, FIREBASE_INSTALLATIONS_ARTIFACT };
-	// FIREBASE_APP_CHECK_ARTIFACT.Dependencies               = new [] { FIREBASE_CORE_ARTIFACT };
+	FIREBASE_APP_CHECK_ARTIFACT.Dependencies               = new [] { FIREBASE_CORE_ARTIFACT, FIREBASE_INSTALLATIONS_ARTIFACT, GOOGLE_APP_CHECK_CORE_ARTIFACT };
 
 	GOOGLE_ANALYTICS_ARTIFACT.Dependencies             = null;
 	GOOGLE_CAST_ARTIFACT.Dependencies                  = new [] { FIREBASE_CORE_ARTIFACT };
 	GOOGLE_MAPS_ARTIFACT.Dependencies                  = null;
 	GOOGLE_MOBILE_ADS_ARTIFACT.Dependencies            = new [] { FIREBASE_CORE_ARTIFACT };
 	GOOGLE_UMP_ARTIFACT.Dependencies                   = null;
 	GOOGLE_PLACES_ARTIFACT.Dependencies                = null;
-	GOOGLE_SIGN_IN_ARTIFACT.Dependencies               = new [] { GOOGLE_GTM_SESSION_FETCHER_ARTIFACT, GOOGLE_PROMISES_OBJC_ARTIFACT, GOOGLE_GOOGLE_UTILITIES_ARTIFACT };
+	GOOGLE_SIGN_IN_ARTIFACT.Dependencies               = new [] { GOOGLE_GTM_SESSION_FETCHER_ARTIFACT, GOOGLE_PROMISES_OBJC_ARTIFACT, GOOGLE_GOOGLE_UTILITIES_ARTIFACT, GOOGLE_APP_CHECK_CORE_ARTIFACT };
 	GOOGLE_TAG_MANAGER_ARTIFACT.Dependencies           = new [] { FIREBASE_CORE_ARTIFACT, FIREBASE_INSTALLATIONS_ARTIFACT, FIREBASE_ANALYTICS_ARTIFACT };
+	GOOGLE_APP_CHECK_CORE_ARTIFACT.Dependencies        = new [] { GOOGLE_PROMISES_OBJC_ARTIFACT, GOOGLE_GOOGLE_UTILITIES_ARTIFACT };
 	GOOGLE_PROMISES_OBJC_ARTIFACT.Dependencies         = null;
 	GOOGLE_GTM_SESSION_FETCHER_ARTIFACT.Dependencies   = null;
 	GOOGLE_NANOPB_ARTIFACT.Dependencies                = null;
@@ -209,9 +212,9 @@ void SetArtifactsPodSpecs ()
 	// FIREBASE_APP_DISTRIBUTION_ARTIFACT.PodSpecs = new [] {
 	// 	PodSpec.Create ("Firebase", "8.10.0", frameworkSource: FrameworkSource.Pods, frameworkName: "FirebaseAppDistribution", targetName: "FirebaseAppDistribution", subSpecs: new [] { "AppDistribution" })		
 	// };
-	// FIREBASE_APP_CHECK_ARTIFACT.PodSpecs = new [] {
-	// 	PodSpec.Create ("Firebase", "8.10.0", frameworkSource: FrameworkSource.Pods, frameworkName: "FirebaseAppCheck", targetName: "FirebaseAppCheck", subSpecs: new [] { "AppCheck" })		
-	// };
+	FIREBASE_APP_CHECK_ARTIFACT.PodSpecs = new [] {
+		PodSpec.Create ("FirebaseAppCheck", "12.5.0", frameworkSource: FrameworkSource.Pods)
+	};
 
 	// Google components
 	GOOGLE_ANALYTICS_ARTIFACT.PodSpecs = new [] {
@@ -235,9 +238,11 @@ void SetArtifactsPodSpecs ()
 	GOOGLE_SIGN_IN_ARTIFACT.PodSpecs = new [] {
 		PodSpec.Create ("GoogleSignIn", "9.0.0", frameworkSource: FrameworkSource.Pods),
 		PodSpec.Create ("AppAuth",      "2.0.0",  frameworkSource: FrameworkSource.Pods),
-		PodSpec.Create ("AppCheckCore", "11.2.0", frameworkSource: FrameworkSource.Pods),
 		PodSpec.Create ("GTMAppAuth",   "5.0.0",  frameworkSource: FrameworkSource.Pods),
 	};
+	GOOGLE_APP_CHECK_CORE_ARTIFACT.PodSpecs = new [] {
+		PodSpec.Create ("AppCheckCore", "11.2.0", frameworkSource: FrameworkSource.Pods),
+	};
 	GOOGLE_TAG_MANAGER_ARTIFACT.PodSpecs = new [] {
 		PodSpec.Create ("GoogleTagManager", "7.4.0")
 	};
@@ -421,7 +426,7 @@ void SetArtifactsSamples ()
 	FIREBASE_REMOTE_CONFIG_ARTIFACT.Samples           = new [] { "RemoteConfigSample" };
 	FIREBASE_STORAGE_ARTIFACT.Samples                 = new [] { "StorageSample" };
 	//FIREBASE_APP_DISTRIBUTION_ARTIFACT.Samples        = new [] { "AppDistributionSample" };
-	//FIREBASE_APP_CHECK_ARTIFACT.Samples               = new [] { "AppCheckSample" };
+	FIREBASE_APP_CHECK_ARTIFACT.Samples                = new [] { "AppCheckSample" };
 
 	// Google components
 	GOOGLE_ANALYTICS_ARTIFACT.Samples                 = new [] { "AnalyticsSample" };

docs/BUILDING.md

@@ -14,6 +14,26 @@ Restore the local Cake tool (any version `< 1.0` should work):
 dotnet tool restore
 ```
 
+## Configure GitHub Packages feed (for fork contributors)
+
+If you are working on a fork of this repository and want to resolve NuGet packages published from your fork, run:
+
+```sh
+# Using GitHub CLI (recommended)
+./scripts/configure-github-feed.sh --gh
+
+# Or using a personal access token
+export GITHUB_PACKAGES_PAT="your_github_pat_here"
+./scripts/configure-github-feed.sh
+```
+
+This script:
+- Auto-detects your fork owner from the git remote URL
+- Configures a GitHub Packages feed (`github-<YourUsername>`)
+- Allows `dotnet restore` to resolve packages published from your fork
+
+**Note**: Your GitHub Personal Access Token must have the `read:packages` scope. See [GitHub docs](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic) for token creation.
+
 ## Build + pack a component
 
 Build and produce `.nupkg` files into `./output`:
@@ -41,3 +61,40 @@ To clean generated folders:
 ```sh
 dotnet tool run dotnet-cake -- --target=clean
 ```
+
+## Troubleshooting
+
+### MSB4057: The target "source/..." does not exist
+
+This error can occur when using MSBuild solution-level targets with certain .NET SDK versions. The `build.cake` script avoids this by building each `.csproj` directly in dependency order, which is more explicit and reliable.
+
+### NU1101: Unable to find package AdamE.Google.iOS.AppCheckCore
+
+Some packages (like `SignIn`) depend on `AppCheckCore` which is built from this repo. The Cake script handles this automatically by building dependencies first. If you still encounter this:
+
+1. Ensure you're using the latest `build.cake` (it should iterate `ARTIFACTS_TO_BUILD`)
+2. Run the full build: `dotnet tool run dotnet-cake -- --target=nuget --names=Google.SignIn`
+
+### Code signing errors during xcframework build
+
+The Cake scripts disable code signing by default (`CODE_SIGNING_ALLOWED=NO`) for CI compatibility. If you need signed frameworks, override the build settings in `common.cake`.
+
+### NuGet feed issues
+
+If you see errors like:
+```
+NU1101: Unable to find package AdamE.Firebase.iOS.AppCheck [...]
+```
+
+This may occur if your GitHub Packages feed is not configured. See "[Configure GitHub Packages feed](#configure-github-packages-feed-for-fork-contributors)" above.
+
+Verify your feed configuration:
+```sh
+dotnet nuget list source
+```
+
+Clear the NuGet cache if needed:
+```sh
+dotnet nuget locals all --clear
+dotnet restore
+```