Lint changed iOS podspecs in CI with pod lib lint

Summary:
The RNTester integration build only proves that pods work *together* inside one workspace — it does not build every pod from source, and pods outside RNTester's dependency closure are never validated on their own. As a result, a podspec can ship with a defect that only shows up when the pod is built in isolation: a malformed compiler flag, or a header/dependency that the pod uses but never declares (which surfaces as a `'yoga/Yoga.h' file not found` style build error for open-source consumers).

This adds a pull-request job that runs `pod lib lint` on the `*.podspec` files a change actually touches. Each pod is linted in isolation, so a dependency that is used-but-not-declared fails to resolve and the job fails. Because React Native's pods are not published to a spec repo, the script exposes every local podspec via `--include-podspecs`, letting the linter resolve inter-pod dependencies from the checkout.

The job is scoped to changed podspecs via `dorny/paths-filter`, so PRs that touch no podspec do no extra work.

Changelog:
[Internal] - Add CI linting for changed iOS podspecs

Differential Revision: D108889958

Author: zeyap

.github/actions/lint-ios-podspecs/action.yml

@@ -0,0 +1,24 @@
+name: lint-ios-podspecs
+description: Lint the CocoaPods podspecs changed by a pull request with `pod lib lint`
+inputs:
+  ruby-version:
+    description: The version of ruby that must be used
+    default: 2.6.10
+  podspecs:
+    description: Space-separated list of changed *.podspec paths to lint
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup xcode
+      uses: ./.github/actions/setup-xcode
+    - name: Setup ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ inputs.ruby-version }}
+    - name: Install gems
+      shell: bash
+      run: bundle install
+    - name: Lint changed podspecs
+      shell: bash
+      run: ./scripts/lint-changed-podspecs.sh ${{ inputs.podspecs }}

.github/workflows/test-all.yml

@@ -89,6 +89,31 @@ jobs:
               - 'packages/debugger-shell/**'
               - 'scripts/debugger-shell/**'
 
+  lint_ios_podspecs:
+    runs-on: macos-15
+    timeout-minutes: 60
+    needs: check_code_changes
+    if: |
+      github.repository == 'react/react-native' &&
+      needs.check_code_changes.outputs.any_code_change == 'true' &&
+      needs.check_code_changes.outputs.should_test_ios == 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Detect changed podspecs
+        uses: dorny/paths-filter@209e61402dbca8aa44f967535da6666b284025ed
+        id: changed_podspecs
+        with:
+          list-files: shell
+          filters: |
+            podspecs:
+              - 'packages/react-native/**/*.podspec'
+      - name: Lint changed podspecs
+        if: ${{ steps.changed_podspecs.outputs.podspecs == 'true' }}
+        uses: ./.github/actions/lint-ios-podspecs
+        with:
+          podspecs: ${{ steps.changed_podspecs.outputs.podspecs_files }}
+
   prebuild_apple_dependencies:
     needs: check_code_changes
     if: |

scripts/lint-changed-podspecs.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# This source code is licensed under the MIT license found in the
+# LICENSE file in the root directory of this source tree.
+
+# Lints the podspecs passed as arguments — intended for the *.podspec files that
+# a pull request changes. Each pod is linted in isolation with `pod lib lint`,
+# which builds it from source using ONLY its declared dependencies. That catches
+# podspec defects the RNTester integration build misses, e.g. a malformed
+# compiler flag, or a header/dependency that the pod uses but does not declare
+# (which surfaces as a "'yoga/Yoga.h' file not found" style build error).
+#
+# React Native's pods are not published to a CocoaPods spec repo, so we expose
+# every local podspec via `--include-podspecs`. That lets the linter resolve
+# inter-pod dependencies (React-Core, Yoga, React-Fabric, the third-party deps,
+# …) from this checkout instead of from trunk. A dependency that is *used but
+# not declared* still fails to resolve its headers, which is exactly the class
+# of breakage this check exists to prevent.
+
+set -eo pipefail
+
+SCRIPTS="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(dirname "$SCRIPTS")"
+
+if [ "$#" -eq 0 ]; then
+  echo "No changed podspecs to lint."
+  exit 0
+fi
+
+cd "$ROOT"
+
+# Make every local podspec resolvable as a dependency source during lint. The
+# `**` glob also covers the root React.podspec and third-party-podspecs/. Loaded
+# this way each spec resolves by path (like a `:path` install), so we must NOT
+# set the INSTALL_YOGA_* env vars that process-podspecs.sh uses only for `push`.
+INCLUDE_PODSPECS='packages/react-native/**/*.podspec'
+
+# Lint options follow scripts/process-podspecs.sh; dependency resolution differs
+# (we rely on --include-podspecs rather than a published spec repo).
+LINT_OPT=(
+  --verbose
+  --allow-warnings
+  --fail-fast
+  --private
+  --swift-version=3.0
+  --include-podspecs="$INCLUDE_PODSPECS"
+  --sources=https://github.com/CocoaPods/Specs.git
+)
+
+echo "Linting $# changed podspec(s): $*"
+
+status=0
+for podspec in "$@"; do
+  if [ ! -f "$podspec" ]; then
+    # The podspec was deleted/renamed in this change; nothing to lint.
+    echo "Skipping '$podspec' (no longer present)."
+    continue
+  fi
+
+  case "$podspec" in
+    */__fixtures__/*)
+      # Codegen test fixtures are not real pods; do not attempt to lint them.
+      echo "Skipping '$podspec' (codegen test fixture)."
+      continue
+      ;;
+  esac
+
+  echo "::group::pod lib lint $podspec"
+  # Lint both the default (frameworks) and the static-library builds, mirroring
+  # process-podspecs.sh, since linkage-specific issues can hide in either.
+  for extra in "" "--use-libraries"; do
+    # shellcheck disable=SC2086
+    if ! bundle exec pod lib lint "$podspec" "${LINT_OPT[@]}" $extra; then
+      echo "::error file=$podspec::pod lib lint failed for $podspec ${extra:-(frameworks)}"
+      status=1
+    fi
+  done
+  echo "::endgroup::"
+done
+
+exit "$status"