fix(spm): address review — Majors, minors, CodeQL + local-build ergonomics

Group A of the SwiftPM review (code + unit-testable; SPM Release build fixes
land separately). Majors:

- generate-spm-xcodeproj.js: the generated Sync build phase ran `spm sync` then
  `RC=$?` under `set -euo pipefail`, so a non-zero exit aborted the phase and the
  RC branch was unreachable (every transient sync failure broke the build). Now
  `spm sync || RC=$?` captures the code so the warn-and-exit-0 branch works.
- spm-utils.js: buildPerAppHeaderTree built into `outDir + '.tmp'`, which sits
  INSIDE build/generated/ios — a folded root — so foldDir folded the half-built
  farm into a spurious `ReactAppHeaders.tmp/` namespace duplicating every codegen
  header. Build into build/.react-app-headers.tmp (outside every folded root),
  then rename into place. Test asserts `.tmp/` is absent.
- read-podspec.js: pod-ipc JSON extraction anchored on the first `{`/last `}`
  anywhere, so a pre-JSON diagnostic containing braces (`Building {module}`) shifted
  the slice and dropped SILENTLY to the weaker regex parser. Anchor on the
  line-boundary `{`…`}` pod ipc actually emits, and log when the authoritative
  parse is abandoned.

Minors / CodeQL / ergonomics:
- spm-pbxproj.js: array build-setting dedup was substring-based (`-ObjC` vs
  `-ObjCFoo`); now exact-token as the docstring promised.
- expand-spm-dependencies.js: swiftName collision detection is case-insensitive
  (`worklets` vs `Worklets` collide on case-insensitive macOS filesystems).
- generate-spm-autolinking.js: the mixed-language friendly diagnostic now also
  guards user spm.modules / synth wrappers, not just the community-dep path; and
  the `.podspec` scanners skip a crashed run's `.spm-scaffold-*` leftover.
- download-spm-artifacts.js: registry `version` is validated against a safe charset
  before it flows into Maven URLs / tar filenames (clear error instead of a 404;
  satisfies the CodeQL command-line data-flow). Added `--deps-tarball` /
  RN_DEPS_TARBALL_PATH (symmetric with --core-tarball) — a local deps tarball
  auto-stages its headers sidecar via the existing companion path.
- generate-spm-package.js: guard against a stale/wrong React.xcframework layout
  (missing Headers/React-umbrella.h or a nested Headers/React_Core/) — fail loudly
  instead of dying deep in the consumer's Clang module build.
- scaffold-package-swift.js: correct the `exclude:` comment (none is emitted).

CodeQL weak-crypto (spm-pbxproj generateUUID) is already sha256 — those alerts are
stale pre-fix and clear on rescan.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: chrfalch

packages/react-native/scripts/spm/__tests__/download-spm-artifacts-test.js

@@ -527,6 +527,29 @@ describe('resolveRNDepsArtifact', () => {
     expect(result.url).toContain('react-native-artifacts/0.84.2/');
   });
 
+  it('uses a local deps tarball override when the file exists', async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'spm-deps-local-'));
+    try {
+      const tarball = path.join(dir, 'deps.tar.gz');
+      fs.writeFileSync(tarball, 'x');
+      const result = await resolveRNDepsArtifact('0.85.0', 'debug', tarball);
+      expect(result.url).toBe(tarball);
+      expect(result.version).toBe('0.85.0-local');
+    } finally {
+      fs.rmSync(dir, {recursive: true, force: true});
+    }
+  });
+
+  it('throws when the local deps tarball override is missing', async () => {
+    await expect(
+      resolveRNDepsArtifact(
+        '0.85.0',
+        'debug',
+        path.join(os.tmpdir(), 'spm-deps-nope', 'nope.tar.gz'),
+      ),
+    ).rejects.toThrow(/does not exist/);
+  });
+
   it('resolves RN_DEP_VERSION=nightly via the npm registry', async () => {
     process.env.RN_DEP_VERSION = 'nightly';
     globalThis.fetch = routerFetch({

packages/react-native/scripts/spm/__tests__/expand-spm-dependencies-test.js

@@ -326,6 +326,24 @@ describe('expandSpmDependencies', () => {
     ).toThrow(/ReactNativeWorklets/);
   });
 
+  it('throws on a CASE-INSENSITIVE swiftName collision (worklets vs Worklets)', () => {
+    // Distinct as exact strings, but collide as directories on the default
+    // case-insensitive macOS filesystem.
+    const direct = [
+      {name: 'react-native-worklets', root: '/w', platforms: {ios: {}}},
+      {name: 'other-worklets', root: '/o', platforms: {ios: {}}},
+    ];
+    expect(() =>
+      expandSpmDependencies(direct, {
+        readConfig: makeReadConfig({
+          '/w': {spm: {name: 'worklets'}},
+          '/o': {spm: {name: 'Worklets'}},
+        }),
+        resolveDep: makeResolveDep({}),
+      }),
+    ).toThrow(/case/i);
+  });
+
   it('rejects empty-string spm.name with a clear error citing the npm name', () => {
     const direct = [{name: 'a', root: '/a', platforms: {ios: {}}}];
     expect(() =>

packages/react-native/scripts/spm/__tests__/spm-pbxproj-test.js

@@ -192,6 +192,36 @@ describe('addArrayStringValues', () => {
     expect(out).toContain('"-lz"');
     expect(out).toContain('"-ObjC"');
   });
+
+  it('dedups by EXACT token, not substring (adds "-ObjC" even when "-ObjCFoo" is present)', () => {
+    const withArray = PLAIN_PBXPROJ.replace(
+      'PRODUCT_NAME = "$(TARGET_NAME)";',
+      'OTHER_LDFLAGS = ("-ObjCFoo", ); PRODUCT_NAME = "$(TARGET_NAME)";',
+    );
+    const out = addArrayStringValues(
+      withArray,
+      targetDebugDict(withArray),
+      'OTHER_LDFLAGS',
+      ['"-ObjC"'],
+    );
+    // A substring check would have seen "-ObjC" inside "-ObjCFoo" and skipped it.
+    expect(out).toContain('"-ObjC"');
+    expect(out).toContain('"-ObjCFoo"');
+  });
+
+  it('does not re-add an exact existing member', () => {
+    const withArray = PLAIN_PBXPROJ.replace(
+      'PRODUCT_NAME = "$(TARGET_NAME)";',
+      'OTHER_LDFLAGS = ("-ObjC", ); PRODUCT_NAME = "$(TARGET_NAME)";',
+    );
+    const out = addArrayStringValues(
+      withArray,
+      targetDebugDict(withArray),
+      'OTHER_LDFLAGS',
+      ['"-ObjC"'],
+    );
+    expect((out.match(/"-ObjC"/g) || []).length).toBe(1);
+  });
 });
 
 describe('ensureScalarField', () => {

packages/react-native/scripts/spm/__tests__/spm-utils-test.js

@@ -602,6 +602,20 @@ describe('per-app header farm (ReactAppHeaders SPM target)', () => {
     const second = buildPerAppHeaderTree(appRoot);
     // No nested ReactAppHeaders/ReactAppHeaders self-fold artifacts.
     expect(fs.existsSync(path.join(perAppDir, 'ReactAppHeaders'))).toBe(false);
+    // ...and no ReactAppHeaders.tmp/ either: the temp build dir must NOT live
+    // under a folded root (build/generated/ios), else foldDir walks the
+    // half-built farm and creates a spurious `ReactAppHeaders.tmp/` namespace
+    // duplicating every codegen header.
+    expect(fs.existsSync(path.join(perAppDir, 'ReactAppHeaders.tmp'))).toBe(
+      false,
+    );
+    expect(
+      [...second.virtualPaths].some(p => p.includes('ReactAppHeaders.tmp')),
+    ).toBe(false);
+    // The out-of-tree temp is consumed (renamed into place), not left behind.
+    expect(
+      fs.existsSync(path.join(appRoot, 'build', '.react-app-headers.tmp')),
+    ).toBe(false);
     expect(second.virtualPaths.has('MyLib/Provider.h')).toBe(true);
   });
 });

packages/react-native/scripts/spm/download-spm-artifacts.js

@@ -96,6 +96,11 @@ function parseArgs(argv /*: Array<string> */) /*: DownloadArgs */ {
       describe:
         'Local ReactNativeHeaders tarball to use instead of downloading. Env fallback: RN_HEADERS_TARBALL_PATH.',
     })
+    .option('deps-tarball', {
+      type: 'string',
+      describe:
+        'Local ReactNativeDependencies tarball to use instead of downloading (e.g. the deps prebuild output). Carries the headers sidecar beside the binary, so this subsumes --deps-headers-tarball for a local build. Env fallback: RN_DEPS_TARBALL_PATH.',
+    })
     .option('deps-headers-tarball', {
       type: 'string',
       describe:
@@ -115,6 +120,8 @@ function parseArgs(argv /*: Array<string> */) /*: DownloadArgs */ {
       parsed['core-tarball'] ?? process.env.RN_CORE_TARBALL_PATH ?? null,
     headersTarball:
       parsed['headers-tarball'] ?? process.env.RN_HEADERS_TARBALL_PATH ?? null,
+    depsTarball:
+      parsed['deps-tarball'] ?? process.env.RN_DEPS_TARBALL_PATH ?? null,
     depsHeadersTarball:
       parsed['deps-headers-tarball'] ??
       process.env.RN_DEPS_HEADERS_TARBALL_PATH ??
@@ -241,11 +248,24 @@ async function resolveNightlyVersion(
   if (!res.ok) {
     throw new Error(`npm lookup failed for ${npmPackage}: ${res.status}`);
   }
-  const ver = (await res.json()).version;
+  const ver = (await res.json())?.version;
+  assertSafeVersion(ver, `${npmPackage}/nightly`);
   log(`  Resolved nightly: ${ver}`);
   return ver;
 }
 
+// A version string flows into Maven URLs and local tarball filenames (which are
+// then passed to tar/cp via execFileSync). Constrain it to a safe charset so a
+// malformed/hostile registry response can't produce a surprising path or a
+// confusing 404 — and so static analysis sees an explicit sanitizer.
+function assertSafeVersion(ver /*: mixed */, source /*: string */) /*: void */ {
+  if (typeof ver !== 'string' || !/^[A-Za-z0-9._-]+$/.test(ver)) {
+    throw new Error(
+      `npm response for ${source} has no usable "version" field (got: ${String(ver)})`,
+    );
+  }
+}
+
 /**
  * Returns the cache-slot key for a given raw version label.
  *
@@ -281,7 +301,8 @@ async function resolveLatestV1Version() /*: Promise<string> */ {
   if (!res.ok) {
     throw new Error(`npm lookup failed: ${res.status}`);
   }
-  const ver = (await res.json()).version;
+  const ver = (await res.json())?.version;
+  assertSafeVersion(ver, 'hermes-compiler/latest-v1');
   log(`  Resolved latest-v1: ${ver}`);
   return ver;
 }
@@ -338,7 +359,23 @@ async function resolveRNCoreArtifact(
 async function resolveRNDepsArtifact(
   rnVersion /*: string */,
   flavor /*: string */,
+  localTarball /*: ?string */,
 ) /*: Promise<ResolvedArtifact> */ {
+  // Local-tarball override (--deps-tarball / RN_DEPS_TARBALL_PATH): use a
+  // locally built deps tarball (the deps prebuild output) instead of
+  // downloading. It carries ReactNativeDependenciesHeaders.xcframework beside
+  // the binary, so the existing companion-staging path (COMPANION_XCFRAMEWORKS
+  // 'rndeps' -> ReactNativeDependenciesHeaders) supplies the sidecar too — no
+  // separate --deps-headers-tarball needed for a local build.
+  if (localTarball != null && localTarball !== '') {
+    if (!fs.existsSync(localTarball)) {
+      throw new Error(
+        `deps tarball override is set to ${localTarball} but the file does not exist`,
+      );
+    }
+    log(`  Using LOCAL deps tarball: ${localTarball}`);
+    return {url: localTarball, version: `${rnVersion}-local`};
+  }
   let version = process.env.RN_DEP_VERSION ?? rnVersion;
   if (version === 'nightly') {
     version = await resolveNightlyVersion('react-native');
@@ -1066,9 +1103,15 @@ async function main(argv /*:: ?: Array<string> */) /*: Promise<void> */ {
     {
       label: 'rndeps',
       name: 'ReactNativeDependencies',
-      resolve: () => resolveRNDepsArtifact(resolvedRnVersion, flavor),
-      sharedName: (v /*: string */) =>
-        `reactnative-dependencies-${v}-${flavor}.tar.gz`,
+      resolve: () =>
+        resolveRNDepsArtifact(resolvedRnVersion, flavor, args.depsTarball),
+      // Local override skips the shared cache (as with core) so a local deps
+      // build can't poison the canonical downloads.
+      sharedName:
+        args.depsTarball != null
+          ? null
+          : (v /*: string */) =>
+              `reactnative-dependencies-${v}-${flavor}.tar.gz`,
     },
     {
       label: 'hermes',

packages/react-native/scripts/spm/expand-spm-dependencies.js

@@ -149,19 +149,29 @@ function expandSpmDependencies(
   // package layout and the centralized headers tree. Surface it now with a
   // clear message instead of letting SPM emit a confusing duplicate-target
   // error later.
-  const seen /*: Map<string, string> */ = new Map();
+  // Key case-INSENSITIVELY: resolveSwiftName permits lowercase ('worklets')
+  // while toSwiftName produces TitleCase ('Worklets') — an exact-equality check
+  // passes but the two still collide as directories on the default
+  // case-insensitive macOS filesystem (synth package layout + headers tree).
+  const seen /*: Map<string, {name: string, swiftName: string}> */ = new Map();
   for (const dep of byName.values()) {
     const swiftName = dep.swiftName;
     if (swiftName == null) {
       continue;
     }
-    const existing = seen.get(swiftName);
+    const key = swiftName.toLowerCase();
+    const existing = seen.get(key);
     if (existing != null) {
+      const same = existing.swiftName === swiftName;
       throw new Error(
-        `react-native autolinking: SPM Swift name collision: '${existing}' and '${dep.name}' both resolve to '${swiftName}'. Set a distinct 'spm.name' in one of their react-native.config.js files.`,
+        `react-native autolinking: SPM Swift name collision: '${existing.name}' ('${existing.swiftName}') and '${dep.name}' ('${swiftName}') ` +
+          (same
+            ? `both resolve to '${swiftName}'.`
+            : `differ only in case, which collides on case-insensitive filesystems.`) +
+          ` Set a distinct 'spm.name' in one of their react-native.config.js files.`,
       );
     }
-    seen.set(swiftName, dep.name);
+    seen.set(key, {name: dep.name, swiftName});
   }
 
   return Array.from(byName.values());

packages/react-native/scripts/spm/generate-spm-autolinking.js

@@ -384,7 +384,11 @@ function hasPodspec(absSource /*: string */) /*: boolean */ {
   for (const sub of ['', 'ios']) {
     const dir = sub === '' ? absSource : path.join(absSource, sub);
     try {
-      if (fs.readdirSync(dir).some(e => e.endsWith('.podspec'))) {
+      if (
+        fs
+          .readdirSync(dir)
+          .some(e => e.endsWith('.podspec') && !e.startsWith('.spm-scaffold-'))
+      ) {
         return true;
       }
     } catch {
@@ -746,7 +750,10 @@ function extractPodspecHeaderSearchPaths(
   let podspecPath /*: ?string */ = null;
   try {
     const entries = fs.readdirSync(sourceDir);
-    const candidate = entries.find(e => e.endsWith('.podspec'));
+    // Skip a crashed run's leftover `.spm-scaffold-<pid>-<name>.podspec` copy.
+    const candidate = entries.find(
+      e => e.endsWith('.podspec') && !e.startsWith('.spm-scaffold-'),
+    );
     if (candidate != null) {
       podspecPath = path.join(sourceDir, candidate);
     }
@@ -1437,7 +1444,19 @@ function main(argv /*:: ?: Array<string> */) /*: void */ {
       continue;
     }
     // spmModule: synth wrapper is the legitimate mechanism (no podspec exists
-    // to scaffold from, and the app developer declared it explicitly).
+    // to scaffold from, and the app developer declared it explicitly). But a
+    // mixed-language module can't be wrapped either — SPM can't compile Swift +
+    // C-family sources in one target, and a synth wrapper would fail with a
+    // cryptic SPM resolve error. Surface the same friendly diagnostic the
+    // community-dep path uses instead of letting SPM emit the cryptic one.
+    if (hasMixedLanguageSources(absSource)) {
+      throw new Error(
+        `react-native autolinking: the spm.module "${target.name}" mixes Swift ` +
+          `and C-family (.m/.mm/.c/.cpp) sources, which SwiftPM cannot compile ` +
+          `in a single target. Split it into separate single-language modules, ` +
+          `or ship a hand-written Package.swift with multiple targets.`,
+      );
+    }
     const wrapperDir = path.join(packagesDir, target.name);
     wrapperDirs.set(target.name, wrapperDir);
     fs.mkdirSync(wrapperDir, {recursive: true});

packages/react-native/scripts/spm/generate-spm-package.js

@@ -307,6 +307,38 @@ function main(argv /*:: ?: Array<string> */) /*: void */ {
       );
     }
 
+    // Guard against a stale/wrong React.xcframework layout. The modular
+    // framework (post-#57285) ships a FLAT Headers/ with React-umbrella.h and
+    // NO nested Headers/React_Core/. An older/experimental artifact carrying the
+    // React_Core-per-pod nesting would otherwise fail deep inside the consumer's
+    // Clang module build with a cryptic "'React/RCTDefines.h' file not found" —
+    // surface it here with an actionable message instead.
+    const reactXcfw = raw.React?.xcframeworkPath;
+    if (reactXcfw != null && fs.existsSync(reactXcfw)) {
+      const frameworkSlice = fs
+        .readdirSync(reactXcfw)
+        .map(d => path.join(reactXcfw, d, 'React.framework'))
+        .find(f => fs.existsSync(f));
+      if (frameworkSlice != null) {
+        const headersDir = path.join(frameworkSlice, 'Headers');
+        const hasUmbrella = fs.existsSync(
+          path.join(headersDir, 'React-umbrella.h'),
+        );
+        const hasReactCoreNesting = fs.existsSync(
+          path.join(headersDir, 'React_Core'),
+        );
+        if (!hasUmbrella || hasReactCoreNesting) {
+          throw new Error(
+            'React.xcframework has an unexpected header layout (missing ' +
+              'Headers/React-umbrella.h and/or a stale nested Headers/React_Core/). ' +
+              'This is a pre-#57285 or experimental artifact; a SwiftPM consumer ' +
+              'cannot build the `React` Clang module from it. Use a post-#57285 ' +
+              'React.xcframework (current nightly/release or a fresh ios-prebuild build).',
+          );
+        }
+      }
+    }
+
     const names /*: Array<string> */ = [];
     const linkOne = (name /*: string */, target /*: string */) => {
       const linkPath = path.join(xcfwLinksDir, `${name}.xcframework`);

packages/react-native/scripts/spm/generate-spm-xcodeproj.js

@@ -382,8 +382,11 @@ fi
 
 cd "$SRCROOT"
 if command -v npx >/dev/null 2>&1; then
-  npx react-native spm sync
-  RC=$?
+  # \`|| RC=$?\` so a non-zero exit is CAPTURED rather than aborting the phase
+  # under \`set -e\` — the whole point is to branch on the code below (2 = fail
+  # the build with a scaffold hint; other non-zero = warn but don't break).
+  RC=0
+  npx react-native spm sync || RC=$?
   if [ "$RC" -eq 2 ]; then
     # Exit 2 = an autolinked community dependency has no Package.swift. The
     # autolinker already printed an \`error:\` line per dep (so Xcode shows them

packages/react-native/scripts/spm/read-podspec.js

@@ -125,18 +125,33 @@ function runPodIpcSpec(podspecPath /*: string */) /*: RawSpec | null */ {
     return null;
   }
   // Some podspecs print diagnostics to stdout during evaluation (e.g. skia:
-  // `-- SK_GRAPHITE: OFF ...`) before `pod ipc` emits the JSON. Parsing the
-  // raw stdout then throws and we'd silently fall back to the (much weaker)
-  // regex parser. Extract just the JSON object (first `{` … last `}`).
+  // `-- SK_GRAPHITE: OFF ...`) before `pod ipc` emits the JSON, and a
+  // diagnostic can itself contain braces (`Building {module}`). `pod ipc`
+  // pretty-prints the spec as a JSON object whose outermost braces sit at
+  // column 0, so ANCHOR on a line-boundary `{`…`}` rather than the first/last
+  // brace anywhere — otherwise a brace inside a diagnostic shifts the slice and
+  // JSON.parse throws. When the authoritative parse is abandoned we log (not
+  // silently drop to the much weaker, subspec-blind regex parser).
   const stdout = result.stdout;
-  const start = stdout.indexOf('{');
-  const end = stdout.lastIndexOf('}');
+  const startMatch = stdout.match(/^\{/m);
+  const start = startMatch != null ? startMatch.index : -1;
+  const lastLineBrace = stdout.lastIndexOf('\n}');
+  const end =
+    lastLineBrace >= 0 ? lastLineBrace + 2 : stdout.lastIndexOf('}') + 1;
   if (start < 0 || end <= start) {
+    console.warn(
+      '[read-podspec] pod ipc spec produced no line-anchored JSON object; ' +
+        'falling back to the regex parser (subspecs/helpers may be missed).',
+    );
     return null;
   }
   try {
-    return JSON.parse(stdout.slice(start, end + 1));
-  } catch {
+    return JSON.parse(stdout.slice(start, end));
+  } catch (e) {
+    console.warn(
+      `[read-podspec] pod ipc spec JSON parse failed (${e.message}); ` +
+        'falling back to the regex parser (subspecs/helpers may be missed).',
+    );
     return null;
   }
 }