From c27c1e5a2111dd4a9b9f7f8ad2b4a323a878b112 Mon Sep 17 00:00:00 2001
From: Worthing ~ <115107835+w-goog@users.noreply.github.com>
Date: Wed, 26 Aug 2026 16:41:31 -0700
Subject: [PATCH 1/4] g-orchestrated: add non-blocking Xcode 27 preview jobs to
 CI

---
 .github/workflows/builds.yml     | 23 +++++++++++++++++++++++
 .github/workflows/unit_tests.yml | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+)

diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 369d25bf..1cf279e6 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -33,3 +33,26 @@ jobs:
           archive \
           -scheme GoogleSignIn-Package \
           -destination "platform=OS X"
+
+  xcode-27-preview-archive:
+    # Archive every supported platform against the Xcode 27 preview image. The
+    # image is preview, so this job does not block merges.
+    # https://github.com/actions/runner-images/issues/14404
+    runs-on: xcode-27
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        destination: [
+          'generic/platform=iOS',
+          'platform=OS X'
+        ]
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Archive
+      run: |
+        xcodebuild \
+          archive \
+          -scheme GoogleSignIn-Package \
+          -destination "${{ matrix.destination }}"
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index fe2eb6cc..b6241b63 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -65,3 +65,35 @@ jobs:
           -destination ${{ matrix.destination }} \
           test-without-building
 
+  xcode-27-preview-test:
+    # Build and run the unit tests against the Xcode 27 preview image. Xcode 27
+    # beta is the only (thus, default) Xcode on that image, so no xcode-select
+    # step is needed. The image is preview, so this job does not block merges.
+    # https://github.com/actions/runner-images/issues/14404
+    runs-on: xcode-27
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk: ['macosx', 'iphonesimulator']
+        include:
+          - sdk: 'macosx'
+            destination: '"platform=macOS"'
+          - sdk: 'iphonesimulator'
+            destination: '"platform=iOS Simulator,name=iPhone 17,OS=27.0"'
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Build unit test target
+      run: |
+        xcodebuild \
+          -scheme GoogleSignIn-Package \
+          -sdk ${{ matrix.sdk }} \
+          -destination ${{ matrix.destination }} \
+          build-for-testing
+    - name: Run unit test target
+      run: |
+        xcodebuild \
+          -scheme GoogleSignIn-Package \
+          -sdk ${{ matrix.sdk }} \
+          -destination ${{ matrix.destination }} \
+          test-without-building

From ec0a6ecfac31b1a936b72b4d2cb12b1386e43647 Mon Sep 17 00:00:00 2001
From: Worthing ~ <115107835+w-goog@users.noreply.github.com>
Date: Wed, 26 Aug 2026 18:28:56 -0700
Subject: [PATCH 2/4] g-orchestrated: pin actions/checkout to a commit hash in
 CI workflows

---
 .github/workflows/builds.yml     | 2 +-
 .github/workflows/unit_tests.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 1cf279e6..16895e01 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -18,7 +18,7 @@ jobs:
         os: [macos-15]
   
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - name: Select Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Archive for iOS
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index b6241b63..31e3c1ec 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -24,7 +24,7 @@ jobs:
           - podspec: GoogleSignInSwiftSupport.podspec
             includePodspecFlag: "--include-podspecs='GoogleSignIn.podspec'"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - name: Update Bundler
       run: bundle update --bundler
     - name: Install Ruby gems with Bundler
@@ -47,7 +47,7 @@ jobs:
           - sdk: 'iphonesimulator'
             destination: '"platform=iOS Simulator,name=iPhone 16,OS=18.6"'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - name: Select Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Build unit test target

From 2ef096cec2cef4e90426178f41f362467bdd25dc Mon Sep 17 00:00:00 2001
From: Worthing ~ <115107835+w-goog@users.noreply.github.com>
Date: Thu, 27 Aug 2026 15:29:23 -0700
Subject: [PATCH 3/4] g-orchestrated: Add read-only contents permissions to CI
 workflows

---
 .github/workflows/builds.yml     | 3 +++
 .github/workflows/unit_tests.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 16895e01..aae94333 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '0 8 * * *' # Cron uses UTC; run at nightly at midnight PST
 
+permissions:
+  contents: read
+
 jobs:
   cron:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index 31e3c1ec..4439706e 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -7,6 +7,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
     
   pod-lib-lint:

From 1aae5e4b0173b1d248a770be0cb9495228ff190c Mon Sep 17 00:00:00 2001
From: Worthing ~ <115107835+w-goog@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:33:19 -0700
Subject: [PATCH 4/4] g-orchestrated: Bump remaining actions/checkout pins to
 v7.0.1

---
 .github/workflows/builds.yml     | 2 +-
 .github/workflows/unit_tests.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index aae94333..e215d112 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -21,7 +21,7 @@ jobs:
         os: [macos-15]
   
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Select Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Archive for iOS
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index 4439706e..40a305c6 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -27,7 +27,7 @@ jobs:
           - podspec: GoogleSignInSwiftSupport.podspec
             includePodspecFlag: "--include-podspecs='GoogleSignIn.podspec'"
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Update Bundler
       run: bundle update --bundler
     - name: Install Ruby gems with Bundler
@@ -50,7 +50,7 @@ jobs:
           - sdk: 'iphonesimulator'
             destination: '"platform=iOS Simulator,name=iPhone 16,OS=18.6"'
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Select Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Build unit test target