fix(ios-prebuild): allowlist + drift gate for React.framework privacy manifests

collectReactPrivacyManifestPaths merged ANY PrivacyInfo.xcprivacy found
recursively under the React privacy roots — a latent trap: a future pod
under those roots that ships as its OWN framework would silently have its
manifest folded into React.framework's aggregate (over-declaration in the
app's privacy report). The scan is now validated against an explicit
REACT_PRIVACY_MANIFESTS allowlist and FAILS the prebuild on an unlisted
manifest, with instructions for both resolutions. Listed-but-absent stays
legal: partial fixture trees keep working, an upstream deletion
under-declares exactly as a source build would, and a MOVED manifest
cannot slip through since its new path is unlisted.

Also: only create the i18n temp stage when there are .lproj dirs to
bundle, and document that the dedup key's `?? ''` is Flow appeasement
(JSON.stringify is typed `string | void`), not dead code.

56 ios-prebuild tests green (drift-gate cases red-first); Flow + prettier
clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: chrfalch

packages/react-native/scripts/ios-prebuild/__tests__/framework-resources-test.js

@@ -184,6 +184,43 @@ describe('serialize/read privacy-manifest round-trip', () => {
   });
 });
 
+describe('collectReactPrivacyManifestPaths drift gate', () => {
+  let tmp;
+
+  beforeEach(() => {
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'privacy-gate-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmp, {recursive: true, force: true});
+  });
+
+  function writeManifest(rel) {
+    const file = path.join(tmp, rel);
+    fs.mkdirSync(path.dirname(file), {recursive: true});
+    fs.writeFileSync(file, serializePrivacyManifest(reactCore));
+    return file;
+  }
+
+  it('throws when a manifest under the privacy roots is not allowlisted (a new pod must be a conscious decision)', () => {
+    writeManifest('React/Resources/PrivacyInfo.xcprivacy');
+    writeManifest('Libraries/SomeNewPod/PrivacyInfo.xcprivacy');
+    expect(() => collectReactPrivacyManifestPaths(tmp)).toThrow(/SomeNewPod/);
+    expect(() => collectReactPrivacyManifestPaths(tmp)).toThrow(
+      /REACT_PRIVACY_MANIFESTS/,
+    );
+  });
+
+  it('returns the found subset of allowlisted manifests (partial trees stay valid)', () => {
+    const file = writeManifest('React/Resources/PrivacyInfo.xcprivacy');
+    expect(collectReactPrivacyManifestPaths(tmp)).toEqual([file]);
+  });
+
+  it('returns [] for a tree with no manifests', () => {
+    expect(collectReactPrivacyManifestPaths(tmp)).toEqual([]);
+  });
+});
+
 describe('buildReactPrivacyManifest (against the real source tree)', () => {
   it('discovers React-core PrivacyInfo.xcprivacy files (not third-party deps)', () => {
     const paths = collectReactPrivacyManifestPaths(RN_PATH);

packages/react-native/scripts/ios-prebuild/framework-resources.js

@@ -33,6 +33,19 @@ const plist = require('plist');
 // ReactNativeDependencies.xcframework and are aggregated there.
 const REACT_PRIVACY_ROOTS = ['React', 'ReactCommon', 'Libraries', 'ReactApple'];
 
+// The privacy manifests of the pods that compile INTO React.framework —
+// an EXPLICIT allowlist, not a glob: a PrivacyInfo.xcprivacy that appears
+// under REACT_PRIVACY_ROOTS without being listed here fails the prebuild,
+// forcing a conscious decision. A pod whose sources compile into
+// React.framework belongs on this list; a pod that ships as its OWN framework
+// must NOT have its manifest folded into React.framework's aggregate
+// (over-declaration in the app's privacy report).
+const REACT_PRIVACY_MANIFESTS = [
+  path.join('React', 'Resources', 'PrivacyInfo.xcprivacy'),
+  path.join('ReactCommon', 'cxxreact', 'PrivacyInfo.xcprivacy'),
+  path.join('ReactCommon', 'react', 'timing', 'PrivacyInfo.xcprivacy'),
+];
+
 // Where React-Core's localized strings live, relative to the package root.
 const STRINGS_REL = path.join('React', 'I18n', 'strings');
 
@@ -122,6 +135,9 @@ function mergePrivacyManifests(
     for (const dataType of manifest.NSPrivacyCollectedDataTypes ?? []) {
       // Canonicalize (sort object keys recursively) before keying so two pods
       // declaring the same data-type dict in different key order still dedup.
+      // The `?? ''` is unreachable at runtime (canonicalize of a plist dict
+      // never yields undefined) — it exists purely because Flow types
+      // JSON.stringify as `string | void`.
       const key = JSON.stringify(canonicalize(dataType)) ?? '';
       if (!collectedSeen.has(key)) {
         collectedSeen.add(key);
@@ -174,11 +190,27 @@ function collectReactPrivacyManifestPaths(
     }
     for (const rel of fs.readdirSync(dir, {recursive: true})) {
       if (path.basename(String(rel)) === 'PrivacyInfo.xcprivacy') {
-        found.push(path.join(dir, String(rel)));
+        found.push(path.join(root, String(rel)));
       }
     }
   }
-  return found.sort();
+  const unlisted = found.filter(rel => !REACT_PRIVACY_MANIFESTS.includes(rel));
+  if (unlisted.length > 0) {
+    throw new Error(
+      'React.framework privacy-manifest drift: found PrivacyInfo.xcprivacy ' +
+        'file(s) under the React privacy roots that are not allowlisted:\n' +
+        unlisted.map(rel => `  ${rel}`).join('\n') +
+        '\nIf the owning pod compiles into React.framework, add the path to ' +
+        'REACT_PRIVACY_MANIFESTS in framework-resources.js. If it ships as ' +
+        'its own framework, its manifest must NOT be folded into ' +
+        "React.framework's aggregate — relocate it out of the privacy roots " +
+        'or exclude it explicitly.',
+    );
+  }
+  // A listed-but-absent manifest is legal (partial fixture trees; upstream
+  // deletions surface as under-declaration exactly like source builds would).
+  // A MOVED manifest cannot slip through: its new location is unlisted.
+  return found.map(rel => path.join(reactNativePath, rel)).sort();
 }
 
 /**

packages/react-native/scripts/ios-prebuild/headers-compose.js

@@ -20,6 +20,7 @@
 const {
   buildI18nStringsBundle,
   buildReactPrivacyManifest,
+  collectLprojDirs,
   serializePrivacyManifest,
 } = require('./framework-resources');
 const {computeInventory} = require('./headers-inventory');
@@ -152,12 +153,18 @@ function emitReactFrameworkHeaders(
 
   // Build RCTI18nStrings.bundle ONCE into a temp stage, then clone it into each
   // slice below — mirrors the privacy manifest (computed once, embedded per
-  // slice) instead of rebuilding the bundle inside the slice loop.
-  const i18nStage = fs.mkdtempSync(
-    path.join(path.dirname(xcfwPath), '.i18n-stage-'),
-  );
-  const i18nBundleStage = path.join(i18nStage, 'RCTI18nStrings.bundle');
-  const i18nLocales = buildI18nStringsBundle(rnRoot, i18nBundleStage);
+  // slice) instead of rebuilding the bundle inside the slice loop. The stage is
+  // only created when there are locales to bundle.
+  let i18nStage = null;
+  let i18nBundleStage = null;
+  let i18nLocales = 0;
+  if (collectLprojDirs(rnRoot).length > 0) {
+    i18nStage = fs.mkdtempSync(
+      path.join(path.dirname(xcfwPath), '.i18n-stage-'),
+    );
+    i18nBundleStage = path.join(i18nStage, 'RCTI18nStrings.bundle');
+    i18nLocales = buildI18nStringsBundle(rnRoot, i18nBundleStage);
+  }
 
   for (const slice of slices) {
     const fwk = path.join(xcfwPath, slice, 'React.framework');
@@ -177,14 +184,16 @@ function emitReactFrameworkHeaders(
     }
     // Clone the prebuilt RCTI18nStrings.bundle so the framework-aware
     // RCTLocalizedString loader resolves React-Core's strings in prebuilt/SPM.
-    if (i18nLocales > 0) {
+    if (i18nLocales > 0 && i18nBundleStage != null) {
       const dest = path.join(fwk, 'RCTI18nStrings.bundle');
       fs.rmSync(dest, {recursive: true, force: true});
       execFileSync('/bin/cp', [CP_FLAGS, i18nBundleStage, dest]);
     }
   }
   fs.rmSync(stage, {recursive: true, force: true});
-  fs.rmSync(i18nStage, {recursive: true, force: true});
+  if (i18nStage != null) {
+    fs.rmSync(i18nStage, {recursive: true, force: true});
+  }
   console.log(
     `headers-compose: React.framework spec layout -> ${slices.join(', ')} ` +
       `(${plan.react.length} headers, umbrella ${plan.umbrella.length}` +