From 058c9b59b04fedca11cb2b8dbfae03f187680ab9 Mon Sep 17 00:00:00 2001
From: austinbenoit <austinbenoit@google.com>
Date: Fri, 23 Oct 2026 02:59:55 +0000
Subject: [PATCH 1/3] Update GitHub Actions to Node.js 24-compatible releases

GitHub is forcing actions that target Node.js 20 to run on Node.js 24
(https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/).
Bump every pinned action to its latest release (all `runs.using: node24`),
keeping full-SHA pins with ratchet version comments:

- actions/checkout v3 -> v7
- actions/upload-artifact v4 -> v7
- actions/download-artifact v4 -> v8
- actions/setup-python v4 -> v7
- actions/setup-java v3/v4 -> v6
- actions/setup-node v3 -> v7
- actions/cache v3 -> v6
- actions/create-github-app-token v3.2 -> v3.3
- nick-invision/retry v2 -> nick-fields/retry v4 (repo was renamed)
- microsoft/setup-msbuild v1.1 -> v3
- geekyeggo/delete-artifact v2 -> v6
- styfle/cancel-workflow-action 0.8.0 -> 0.13.1
- FirebaseExtended/github-actions/firebase-test-lab v1.4 -> v1.5

Replace unmaintained node12 actions that have no Node.js 24 release with
equivalent `gh` CLI steps:

- scherermichael-oss/action-has-permission, lannonbr/repo-permission-check-action
  -> `gh api .../collaborators/<actor>/permission`
- andymckay/cancel-action -> `gh run cancel`
- actions-ecosystem/action-add-labels -> `gh api POST .../issues/<n>/labels`
- buildsville/add-remove-label -> `gh pr edit --remove-label`
- KhannaAbhinav/random-selector-action + itsOliverBott/assign-pr-reviewers
  -> `shuf` + `gh api POST .../pulls/<n>/requested_reviewers`
---
 .github/workflows/android.yml                 |  12 +-
 .github/workflows/build-report.yml            |  12 +-
 .github/workflows/checks.yml                  |  12 +-
 .github/workflows/checks_secure.yml           |  22 ++-
 .github/workflows/cpp-packaging.yml           |  82 ++++----
 .github/workflows/desktop.yml                 |  34 ++--
 .github/workflows/integration_tests.yml       | 183 +++++++++---------
 .github/workflows/ios.yml                     |   6 +-
 .github/workflows/lint.yml                    |   6 +-
 .github/workflows/retry-test-failures.yml     |   6 +-
 .github/workflows/reviewer-roulette.yml       |  32 ++-
 .github/workflows/update-dependencies.yml     |  17 +-
 .github/workflows/update-feature-branches.yml |  19 +-
 13 files changed, 229 insertions(+), 214 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 58663bf2e6..28223e4e0b 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -30,7 +30,7 @@ jobs:
       matrix_architecture: ${{ steps.export-result.outputs.matrix_architecture }}
       matrix_python_version: ${{ steps.export-result.outputs.matrix_python_version }}
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
@@ -95,7 +95,7 @@ jobs:
           echo "Enabling expanded build and test matrix."
           echo "USE_EXPANDED_MATRIX=1" >> $GITHUB_ENV
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
@@ -110,18 +110,18 @@ jobs:
           MATRIX_ARCHITECTURE: ${{ matrix.architecture }}
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ matrix.python_version }}
           architecture: ${{ matrix.architecture }}
 
       - name: Add msbuild to PATH
         if: startsWith(matrix.os, 'windows')
-        uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # ratchet:microsoft/setup-msbuild@v1.1
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # ratchet:microsoft/setup-msbuild@v3
 
       - name: Cache NDK
         id: cache_ndk
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: /tmp/android-ndk-r23b
           key: android-ndk-${{ matrix.os }}-r23b
@@ -166,7 +166,7 @@ jobs:
 
       - name: Cache ccache files
         id: cache_ccache
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: ccache_dir
           key: dev-test-ccache-${{ env.MATRIX_UNIQUE_NAME }}
diff --git a/.github/workflows/build-report.yml b/.github/workflows/build-report.yml
index 91879d2fbc..bdba142a4a 100644
--- a/.github/workflows/build-report.yml
+++ b/.github/workflows/build-report.yml
@@ -26,15 +26,15 @@ jobs:
       if: ${{ matrix.test_set == 'firestore' }}
       run: sleep 300
     - name: Setup python
-      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
       with:
         python-version: 3.9
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
       with:
         persist-credentials: true # zizmor: ignore[artipacked]
         fetch-depth: 0
     - name: Install Desktop SDK prerequisites
-      uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
       with:
         timeout_minutes: 15
         max_attempts: 3
@@ -42,7 +42,7 @@ jobs:
           python3 scripts/gha/install_prereqs_desktop.py --gha_build
           python3 -m pip install requests python-dateutil progress attrs
     - name: Fetch GitHub jobs (with retry)
-      uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
       with:
         timeout_minutes: 20
         max_attempts: 3
@@ -54,7 +54,7 @@ jobs:
           fi
           python3 scripts/gha/report_build_status.py --token ${{ github.token }} --days ${{ env.numDays }} --write_cache build_status_short.cache ${extra_flags}
     - name: Fetch extended GitHub jobs (with retry)
-      uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
       with:
         timeout_minutes: 80
         max_attempts: 3
@@ -104,7 +104,7 @@ jobs:
       run: |
         cat comment.md
     - name: Update GitHub issue (with retry)
-      uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
       with:
         timeout_minutes: 5
         max_attempts: 3
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index bd5d63cfbf..61b0164fc6 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -22,12 +22,12 @@ jobs:
   file_format_check:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
       - name: Install prerequisites
@@ -64,12 +64,12 @@ jobs:
       - uses: lukka/get-cmake@591817e96fcad43505fb4eae36172462abb3a42e # ratchet:lukka/get-cmake@latest
         with:
           cmakeVersion: "~3.31.0"
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
       - name: Install prerequisites
@@ -104,7 +104,7 @@ jobs:
     # Check for Google copyright in each file.
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
@@ -117,7 +117,7 @@ jobs:
     # Check that the readme was updated, unless the PR has a specific label set (env.skipReleaseNotesLabel).
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         # Skip this if the PR has the skipReleaseNotes label or if it's a merge to other than main.
         if: ${{!contains(github.event.pull_request.labels.*.name, env.skipReleaseNotesLabel) && (github.event.pull_request.base.ref == 'main')}}
         with:
diff --git a/.github/workflows/checks_secure.yml b/.github/workflows/checks_secure.yml
index f13e236542..1d754dad3a 100644
--- a/.github/workflows/checks_secure.yml
+++ b/.github/workflows/checks_secure.yml
@@ -3,7 +3,7 @@ name: Checks (secure)
 
 on:
   # This trigger is only safe-ish to use if steps are gated behind the
-  # action-has-permission check.
+  # "Check user permission" step below.
   # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [synchronize]
@@ -22,20 +22,26 @@ jobs:
     steps:
       - name: Check user permission
         id: check
-        uses: scherermichael-oss/action-has-permission@136e061bfe093832d87f090dd768e14e27a740d3 # ratchet:scherermichael-oss/action-has-permission@1.0.6
-        # This action sets outputs.has-permission to '1' or ''
-        with:
-          required-permission: write
+        # This step sets outputs.has-permission to '1' or ''
         env:
-          GITHUB_TOKEN: ${{ github.token }}
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          permission=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq '.permission' || echo "none")
+          echo "User ${ACTOR} has permission: ${permission}"
+          if [[ "${permission}" == "write" || "${permission}" == "admin" ]]; then
+            echo "has-permission=1" >> "$GITHUB_OUTPUT"
+          else
+            echo "has-permission=" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Setup python
         if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
       - name: Install prerequisites
diff --git a/.github/workflows/cpp-packaging.yml b/.github/workflows/cpp-packaging.yml
index ece1df8a6b..e34f5fb36c 100644
--- a/.github/workflows/cpp-packaging.yml
+++ b/.github/workflows/cpp-packaging.yml
@@ -104,7 +104,7 @@ jobs:
         run: sudo xcode-select -s /Applications/Xcode_${{ env.xcodeVersion }}.app/Contents/Developer
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
 
@@ -149,7 +149,7 @@ jobs:
       - name: Cache LLVM (Mac only)
         if: matrix.tools_platform == 'darwin'
         id: cache_llvm
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: llvm-src/llvm/build/bin
           key: llvm-bin-${{matrix.tools_platform}}-${{env.xcodeVersion}}-${{env.llvmVer}}
@@ -157,7 +157,7 @@ jobs:
       - name: Fetch LLVM source (Mac only)
         # Only fetch LLVM if we don't already have binaries from the cache.
         if: ${{ matrix.tools_platform == 'darwin' && !steps.cache_llvm.outputs.cache-hit }}
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           repository: llvm/llvm-project
@@ -180,7 +180,7 @@ jobs:
           cp -af llvm-src/llvm/build/bin/* packaging-tools
 
       - name: fetch demumble
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           repository: nico/demumble
@@ -204,7 +204,7 @@ jobs:
           tar -czhf ../packaging-tools.tgz .
 
       - name: upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: packaging-tools-${{ matrix.tools_platform }}
           path: packaging-tools.tgz
@@ -229,13 +229,13 @@ jobs:
         run: sudo xcode-select -s /Applications/Xcode_${{ env.xcodeVersion }}.app/Contents/Developer
 
       - name: fetch SDK
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
 
@@ -266,7 +266,7 @@ jobs:
           find firebase-cpp-sdk-*-package -type f
 
       - name: upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase-cpp-sdk-ios-tvos-package
           path: firebase-cpp-sdk-ios-tvos-package.tgz
@@ -285,7 +285,7 @@ jobs:
         shell: bash
         run: echo "JAVA_HOME=${JAVA_HOME_11_X64}" >> $GITHUB_ENV
       - name: fetch SDK
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
@@ -299,7 +299,7 @@ jobs:
 
       - name: Cache NDK
         id: cache_ndk
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: /tmp/android-ndk-r23b
           key: android-ndk-${{ runner.os }}-r23b
@@ -330,7 +330,7 @@ jobs:
           find firebase-cpp-sdk-*-package -type f
 
       - name: upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase-cpp-sdk-android-package
           path: firebase-cpp-sdk-android-package.tgz
@@ -400,7 +400,7 @@ jobs:
         if: runner.os == 'macOS'
         run: sudo xcode-select -s /Applications/Xcode_${{ env.xcodeVersion }}.app/Contents/Developer
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
@@ -418,11 +418,11 @@ jobs:
 
       - name: Add msbuild to PATH (windows)
         if: startsWith(matrix.os, 'windows')
-        uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # ratchet:microsoft/setup-msbuild@v1.1
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # ratchet:microsoft/setup-msbuild@v3
 
       - name: Cache vcpkg C++ dependencies
         id: cache_vcpkg
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: external/vcpkg/installed
           key: dev-vcpkg-${{ matrix.architecture }}-${{ matrix.vcpkg_triplet_suffix }}-${{ matrix.msvc_runtime }}-${{ matrix.linux_abi }}-${{ hashFiles(format('{0}', env.VCPKG_RESPONSE_FILE)) }}-${{ hashFiles('.git/modules/external/vcpkg/HEAD') }}${{env.VCPKG_EXTRA_HASH}}
@@ -430,18 +430,18 @@ jobs:
       - name: Cache ccache files
         if: startsWith(matrix.os, 'ubuntu') || startsWith(matrix.os, 'macos')
         id: cache_ccache
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: ccache_dir
           key: dev-test-ccache-${{ env.MATRIX_UNIQUE_NAME }}
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ matrix.python_version }}
 
       - name: Install Desktop SDK prerequisites
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           timeout_minutes: 15
           max_attempts: 3
@@ -489,7 +489,7 @@ jobs:
         continue-on-error: true
 
       - name: upload artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase-cpp-sdk-${{ env.SDK_NAME }}-build
           path: firebase-cpp-sdk-${{ env.SDK_NAME }}-build.tgz
@@ -544,25 +544,25 @@ jobs:
         run: sudo xcode-select -s /Applications/Xcode_${{ env.xcodeVersion }}.app/Contents/Developer
 
       - name: fetch SDK
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
 
       - name: download packaging-tool artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: artifacts
           pattern: packaging-tools-*
 
       - name: download build artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: artifacts
           pattern: firebase-cpp-sdk-*
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
 
@@ -633,7 +633,7 @@ jobs:
           find firebase-cpp-sdk-*-package -type f
 
       - name: upload SDK zip
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase-cpp-sdk-${{ matrix.sdk_platform }}${{ matrix.suffix}}-package
           path: firebase-cpp-sdk-${{ matrix.sdk_platform }}${{ matrix.suffix}}-package.tgz
@@ -688,7 +688,7 @@ jobs:
             && github.event.inputs.downloadPreviousRun == ''
           )
         # Remove the build artifacts that were consumed during this step of packaging.
-        uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # ratchet:geekyeggo/delete-artifact@v2
+        uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # ratchet:geekyeggo/delete-artifact@v6
         with:
           name: |
             firebase-cpp-sdk-${{ matrix.sdk_platform }}${{ matrix.suffix }}*-build
@@ -703,7 +703,7 @@ jobs:
     if: ${{ github.event.inputs.downloadPublicVersion != '' || github.event.inputs.downloadPreviousRun != '' }}
     steps:
       - name: fetch artifact from previous run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         if: ${{ github.event.inputs.downloadPreviousRun != '' }}
         with:
           name: 'firebase_cpp_sdk.zip'
@@ -737,13 +737,13 @@ jobs:
           echo "::warning ::$(cat firebase_cpp_sdk_hash.txt)"
 
       - name: upload hash
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase_cpp_sdk_hash.txt
           path: firebase_cpp_sdk_hash.txt
 
       - name: upload SDK zip
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase_cpp_sdk.zip
           path: firebase_cpp_sdk.zip
@@ -756,13 +756,13 @@ jobs:
     needs: [build_and_package_ios_tvos, build_and_package_android, package_desktop, log_inputs]
     steps:
       - name: fetch SDK
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
 
       - name: download artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: artifacts
           pattern: firebase-cpp-sdk-*-package
@@ -800,13 +800,13 @@ jobs:
           find firebase_cpp_sdk -type f
 
       - name: upload hash
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase_cpp_sdk_hash.txt
           path: firebase_cpp_sdk_hash.txt
 
       - name: upload SDK zip
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase_cpp_sdk.zip
           path: firebase_cpp_sdk.zip
@@ -817,7 +817,7 @@ jobs:
     needs: [merge_packages]
     steps:
       - name: download SDK zip
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           name: firebase_cpp_sdk.zip
       - name: unzip SDK and remove non-Windows files
@@ -845,12 +845,12 @@ jobs:
           ${{ env.hashCommand }} --tag firebase_cpp_sdk_windows.zip > firebase_cpp_sdk_windows_hash.txt
           echo "::warning ::$(cat firebase_cpp_sdk_windows_hash.txt)"
       - name: upload Windows hash
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase_cpp_sdk_windows_hash.txt
           path: firebase_cpp_sdk_windows_hash.txt
       - name: upload Windows SDK zip
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: firebase_cpp_sdk_windows.zip
           path: firebase_cpp_sdk_windows.zip
@@ -869,7 +869,7 @@ jobs:
         && github.event.inputs.downloadPreviousRun == ''
       )
     steps:
-    - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # ratchet:geekyeggo/delete-artifact@v2
+    - uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # ratchet:geekyeggo/delete-artifact@v6
       with:
         name: |
           packaging-tools-*
@@ -884,12 +884,12 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout repo
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
       with:
         persist-credentials: true # zizmor: ignore[artipacked]
 
     - name: Setup python
-      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
       with:
         python-version: '3.9'
     - name: Use expanded matrix
@@ -903,7 +903,7 @@ jobs:
       # 
       # This method is preferred over the "personal access token" solution, as the GitHub App's scope is limited to just
       # the firebase-cpp-sdk repository.
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # ratchet:actions/create-github-app-token@v3
       id: generate-token
       with:
         client-id: ${{ secrets.WORKFLOW_TRIGGER_CLIENT_ID }}
@@ -960,18 +960,18 @@ jobs:
     if: ${{ failure() && !cancelled() && github.event_name == 'schedule' }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
       - name: Install python deps
         run: pip install -r scripts/gha/python_requirements.txt
       # The default token can't run workflows, so get an alternate token.
       - name: Generate token for GitHub API
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # ratchet:actions/create-github-app-token@v3
         id: generate-token
         with:
           client-id: ${{ secrets.WORKFLOW_TRIGGER_CLIENT_ID }}
diff --git a/.github/workflows/desktop.yml b/.github/workflows/desktop.yml
index 05f33c28a6..05b5e4ef14 100644
--- a/.github/workflows/desktop.yml
+++ b/.github/workflows/desktop.yml
@@ -32,7 +32,7 @@ jobs:
       matrix_xcode_version: ${{ steps.export-result.outputs.xcode_version }}
       matrix_python_version: ${{ steps.export-result.outputs.python_version }}
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
@@ -121,7 +121,7 @@ jobs:
         env:
           XCODE_VERSION: ${{ matrix.xcode_version }}
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
@@ -170,7 +170,7 @@ jobs:
 
       - name: Cache vcpkg C++ dependencies
         id: cache_vcpkg
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: external/vcpkg/installed
           key: dev-vcpkg-${{ matrix.architecture }}-${{ env.VCPKG_SUFFIX }}-${{ matrix.msvc_runtime }}-${{ hashFiles(format('{0}', env.VCPKG_RESPONSE_FILE)) }}-${{ hashFiles('.git/modules/external/vcpkg/HEAD') }}${{ env.VCPKG_EXTRA_HASH }}
@@ -178,20 +178,20 @@ jobs:
       - name: Cache ccache files
         if: startsWith(matrix.os, 'ubuntu') || startsWith(matrix.os, 'macos')
         id: cache_ccache
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: ccache_dir
           key: dev-test-ccache-${{ env.MATRIX_UNIQUE_NAME }}${{ env.VCPKG_EXTRA_HASH }}
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         if: startsWith(matrix.os, 'ubuntu')
         with:
           python-version: ${{ matrix.python_version }}
           architecture: x64
 
       - name: Setup python (Mac)
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         if: startsWith(matrix.os, 'macos')
         with:
           python-version: ${{ matrix.python_version }}
@@ -199,7 +199,7 @@ jobs:
 
 
       - name: Install Desktop SDK prerequisites
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           timeout_minutes: 15
           max_attempts: 3
@@ -303,7 +303,7 @@ jobs:
           sudo chmod -R +rwx ~/Library/Logs/DiagnosticReports/* || :
 
       - name: Archive crashes and binaries (linux)
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: failure() && startsWith(matrix.build_type, 'Debug') && startsWith(matrix.os, 'ubuntu')
         with:
           name: crashes-${{ matrix.os }}-${{ matrix.build_type }}-${{ matrix.architecture }}-${{ matrix.python_version }}
@@ -312,7 +312,7 @@ jobs:
             /tmp/bins/*
 
       - name: Archive crashes (mac)
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: failure() && startsWith(matrix.build_type, 'Debug') && startsWith(matrix.os, 'macos')
         with:
           name: crashes-${{ matrix.os }}-${{ matrix.build_type }}-${{ matrix.architecture }}-${{ matrix.python_version }}-${{ matrix.xcode_version }}
@@ -332,28 +332,28 @@ jobs:
       - uses: lukka/get-cmake@591817e96fcad43505fb4eae36172462abb3a42e # ratchet:lukka/get-cmake@latest
         with:
           cmakeVersion: "~3.31.0"
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Cache vcpkg C++ dependencies
         id: cache_vcpkg
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: external/vcpkg/installed
           key: dev-vcpkg-${{ env.VCPKG_TRIPLET }}-${{ hashFiles(format('{0}', env.VCPKG_RESPONSE_FILE)) }}-${{ hashFiles('.git/modules/external/vcpkg/HEAD') }}
       - name: Cache ccache files
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: ccache_dir
           key: local-integration-tests-linux-openssl-ccache
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ fromJson(needs.prepare_matrix.outputs.matrix_python_version)[0] }}
       - name: Prepare for integration tests
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 15
@@ -383,18 +383,18 @@ jobs:
         env:
           JOB_STATUS: ${{ job.status }}
       - name: Set up Node (18)
-        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # ratchet:actions/setup-node@v7
         with:
           node-version: 18.x
       - name: Setup Firestore Emulator
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 5
           max_attempts: 3
           command: npm install -g firebase-tools     
       - name: Setup java
-        uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # ratchet:actions/setup-java@v3
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # ratchet:actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: '17'
diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml
index c44ff23e4a..3f8bcb4b61 100644
--- a/.github/workflows/integration_tests.yml
+++ b/.github/workflows/integration_tests.yml
@@ -81,9 +81,16 @@ jobs:
     steps:
     ### Fail the workflow if the user does not have admin access to run the tests.
     - name: Check if user has permission to trigger tests
-      uses: lannonbr/repo-permission-check-action@b23b656f0dfb810f0c5e224a264d621a92a6f271 # ratchet:lannonbr/repo-permission-check-action@2.0.0
-      with:
-        permission: "admin"
+      env:
+        GH_TOKEN: ${{ github.token }}
+        ACTOR: ${{ github.actor }}
+      run: |
+        permission=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq '.permission' || echo "none")
+        echo "User ${ACTOR} has permission: ${permission}"
+        if [[ "${permission}" != "admin" ]]; then
+          echo "::error ::User ${ACTOR} does not have admin permission to trigger tests."
+          exit 1
+        fi
     ### It sets "github_ref,trigger,pr_number,requested_tests" outputs to control the following jobs and steps
     ### trigger value: manual_trigger, scheduled_trigger, label_trigger, postsubmit_trigger
     - id: set_outputs
@@ -142,7 +149,9 @@ jobs:
     ### e.g. Triggered by non-"test-request" label; triggered by not merged PR close event.
     - name: Cancel workflow
       if: ${{ !steps.set_outputs.outputs.trigger }}
-      uses: andymckay/cancel-action@8f8510d9dea52fcc8eb6ca10d6ce47fd5fc43cd8 # ratchet:andymckay/cancel-action@0.2
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: gh run cancel "${GITHUB_RUN_ID}" --repo "${GITHUB_REPOSITORY}"
     - name: Wait for workflow cancellation
       if: ${{ !steps.set_outputs.outputs.trigger }}
       run: |
@@ -150,21 +159,21 @@ jobs:
         exit 1  # fail out if the cancellation above somehow failed.
     - name: Cancel previous runs on the same PR
       if: steps.set_outputs.outputs.trigger == 'label_trigger'
-      uses: styfle/cancel-workflow-action@3d86a7cc43670094ac248017207be0295edbc31d # ratchet:styfle/cancel-workflow-action@0.8.0
+      uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # ratchet:styfle/cancel-workflow-action@0.13.1
       with:
         access_token: ${{ github.token }}
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
       with:
         persist-credentials: true # zizmor: ignore[artipacked]
         ref: ${{steps.set_outputs.outputs.github_ref}}
         fetch-depth: 0
         submodules: false
     - name: Setup python
-      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
       with:
         python-version: ${{ env.pythonVersion }}
     - name: Install python deps
-      uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
       with:
         timeout_minutes: 1
         max_attempts: 3
@@ -308,13 +317,13 @@ jobs:
       - uses: lukka/get-cmake@591817e96fcad43505fb4eae36172462abb3a42e # ratchet:lukka/get-cmake@latest
         with:
           cmakeVersion: "~3.31.0"
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: setup default Xcode version (macos)
@@ -324,7 +333,7 @@ jobs:
           # Remove default Xcode version to prevent the wrong SDK from being used.
           rm -rf /Applications/Xcode.app
       - name: Install Desktop SDK & integration tests prerequisites
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 15
@@ -332,15 +341,15 @@ jobs:
           command: scripts/gha/install_test_workflow_prereqs.sh -p Desktop -a '${{ matrix.arch }}' -s '${{ matrix.ssl_variant }}'
       - name: Add msbuild to PATH (Windows)
         if: startsWith(matrix.os, 'windows')
-        uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # ratchet:microsoft/setup-msbuild@v1.1
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # ratchet:microsoft/setup-msbuild@v3
       - name: Cache vcpkg C++ dependencies
         id: cache_vcpkg
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: external/vcpkg/installed
           key: dev-vcpkg-${{ env.VCPKG_TRIPLET }}-${{ hashFiles(format('{0}', env.VCPKG_RESPONSE_FILE)) }}-${{ hashFiles('.git/modules/external/vcpkg/HEAD') }}
       - name: Fetch prebuilt packaged SDK from previous run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         if: ${{ github.event.inputs.test_packaged_sdk != '' }}
         with:
           name: 'firebase_cpp_sdk.zip'
@@ -400,7 +409,7 @@ jobs:
           MATRIX_ARCH: ${{ matrix.arch }}
           MATRIX_SSL_VARIANT: ${{ matrix.ssl_variant }}
       - name: Upload Desktop Cmake
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: cmake-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
@@ -419,14 +428,14 @@ jobs:
           MATRIX_ARCH: ${{ matrix.arch }}
           MATRIX_SSL_VARIANT: ${{ matrix.ssl_variant }}
       - name: Upload Desktop integration tests artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: testapps-desktop-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
           path: testapps-desktop-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
           retention-days: ${{ env.binaryArtifactRetentionDays }}
       - name: Upload Desktop build results artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: log-artifact-build-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
@@ -434,7 +443,7 @@ jobs:
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-build-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
@@ -482,7 +491,7 @@ jobs:
       - uses: lukka/get-cmake@591817e96fcad43505fb4eae36172462abb3a42e # ratchet:lukka/get-cmake@latest
         with:
           cmakeVersion: "~3.31.0"
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
@@ -506,26 +515,26 @@ jobs:
         run: echo "JAVA_HOME=${JAVA_HOME_11_arm64}" >> $GITHUB_ENV
       - name: Add msbuild to PATH (Windows)
         if: startsWith(matrix.os, 'windows')
-        uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # ratchet:microsoft/setup-msbuild@v1.1
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # ratchet:microsoft/setup-msbuild@v3
       - name: Cache NDK
         id: cache_ndk
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # ratchet:actions/cache@v6
         with:
           path: /tmp/android-ndk-r23b
           key: android-ndk-${{ matrix.os }}-r23b
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: Install Android SDK & integration tests prerequisites
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 10
           max_attempts: 3
           command: scripts/gha/install_test_workflow_prereqs.sh -p Android
       - name: Fetch prebuilt packaged SDK from previous run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         if: ${{ github.event.inputs.test_packaged_sdk != '' }}
         with:
           name: 'firebase_cpp_sdk.zip'
@@ -567,14 +576,14 @@ jobs:
         env:
           MATRIX_OS: ${{ matrix.os }}
       - name: Upload Android integration tests artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: testapps-android-${{ matrix.os }}
           path: testapps-android-${{ matrix.os }}
           retention-days: ${{ env.binaryArtifactRetentionDays }}
       - name: Upload Android build results artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: log-artifact-build-android-${{ matrix.os }}
@@ -582,7 +591,7 @@ jobs:
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-build-android-${{ matrix.os }}
@@ -627,13 +636,13 @@ jobs:
       - uses: lukka/get-cmake@591817e96fcad43505fb4eae36172462abb3a42e # ratchet:lukka/get-cmake@latest
         with:
           cmakeVersion: "~3.31.0"
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: setup default Xcode version (macos)
@@ -643,13 +652,13 @@ jobs:
           # Remove default Xcode version to prevent the wrong SDK from being used.
           rm -rf /Applications/Xcode.app
       - name: Install iOS SDK & integration tests prerequisites
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           timeout_minutes: 3
           max_attempts: 3
           command: scripts/gha/install_test_workflow_prereqs.sh -p iOS
       - name: Fetch prebuilt packaged SDK from previous run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         if: ${{ github.event.inputs.test_packaged_sdk != '' }}
         with:
           name: 'firebase_cpp_sdk.zip'
@@ -691,14 +700,14 @@ jobs:
             echo "__SUMMARY_MISSING__" > build-results-ios-${{ matrix.os }}.log.json
           fi
       - name: Upload iOS integration tests artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: testapps-ios-${{ matrix.os }}
           path: testapps-ios-${{ matrix.os }}
           retention-days: ${{ env.binaryArtifactRetentionDays }}
       - name: Upload iOS build results artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: log-artifact-build-ios-${{ matrix.os }}
@@ -706,7 +715,7 @@ jobs:
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-build-ios-${{ matrix.os }}
@@ -750,13 +759,13 @@ jobs:
       - uses: lukka/get-cmake@591817e96fcad43505fb4eae36172462abb3a42e # ratchet:lukka/get-cmake@latest
         with:
           cmakeVersion: "~3.31.0"
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: setup default Xcode version (macos)
@@ -766,13 +775,13 @@ jobs:
           # Remove default Xcode version to prevent the wrong SDK from being used.
           rm -rf /Applications/Xcode.app
       - name: Install tvOS SDK & integration tests prerequisites
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           timeout_minutes: 3
           max_attempts: 3
           command: scripts/gha/install_test_workflow_prereqs.sh -p tvOS
       - name: Fetch prebuilt packaged SDK from previous run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         if: ${{ github.event.inputs.test_packaged_sdk != '' }}
         with:
           name: 'firebase_cpp_sdk.zip'
@@ -811,14 +820,14 @@ jobs:
             echo "__SUMMARY_MISSING__" > build-results-tvos-${{ matrix.os }}.log.json
           fi
       - name: Upload tvOS integration tests artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: testapps-tvos-${{ matrix.os }}
           path: testapps-tvos-${{ matrix.os }}
           retention-days: ${{ env.binaryArtifactRetentionDays }}
       - name: Upload tvOS build results artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         if: ${{ !cancelled() }}
         with:
           name: log-artifact-build-tvos-${{ matrix.os }}
@@ -826,7 +835,7 @@ jobs:
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-build-tvos-${{ matrix.os }}
@@ -891,17 +900,17 @@ jobs:
           ssl_variant: openssl
           arch: x64
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download Desktop integration tests artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: testapps/testapps-desktop-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
           name: testapps-desktop-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: setup default Xcode version (macos)
@@ -911,18 +920,18 @@ jobs:
           # Remove default Xcode version to prevent the wrong SDK from being used.
           rm -rf /Applications/Xcode.app
       - name: Install prerequisites for testing
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 15
           max_attempts: 3
           command: scripts/gha/install_test_workflow_prereqs.sh -p Desktop -t true -a '${{ matrix.arch }}' -s '${{ matrix.ssl_variant }}'
       - name: Set up Node (18)
-        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # ratchet:actions/setup-node@v7
         with:
           node-version: 18.x
       - name: Setup Firestore Emulator
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 5
@@ -934,7 +943,7 @@ jobs:
           echo "$(npm root)" >> $GITHUB_PATH
           echo "$(npm root)/.bin" >> $GITHUB_PATH
       - name: Setup java
-        uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # ratchet:actions/setup-java@v3
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # ratchet:actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -964,14 +973,14 @@ jobs:
           MATRIX_SSL_VARIANT: ${{ matrix.ssl_variant }}
       - name: Upload Desktop test results artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: log-artifact-test-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
           path: testapps/test-results-desktop-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}*
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-test-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.ssl_variant }}
@@ -1022,21 +1031,21 @@ jobs:
           -  android_device: "android_latest"
              test_type: "uitest"
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download Android integration tests artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: testapps/testapps-android-${{ matrix.build_os }}
           name: testapps-android-${{ matrix.build_os }}
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: Install prerequisites for testing
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 5
@@ -1050,7 +1059,7 @@ jobs:
         env:
           MATRIX_ANDROID_DEVICE: ${{ matrix.android_device }}
       - name: Setup java 11 for test_simulator.py
-        uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # ratchet:actions/setup-java@v3
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # ratchet:actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -1068,7 +1077,7 @@ jobs:
           MATRIX_BUILD_OS: ${{ matrix.build_os }}
       - id: ftl_test
         if: steps.device-info.outputs.device_type == 'ftl'
-        uses: FirebaseExtended/github-actions/firebase-test-lab@41c787c37157e4c5932b951e531c041efa5bb7a4 # ratchet:FirebaseExtended/github-actions/firebase-test-lab@v1.4
+        uses: FirebaseExtended/github-actions/firebase-test-lab@57091ac526b308ae005c6d6d59aab83d5ab2aa71 # ratchet:FirebaseExtended/github-actions/firebase-test-lab@v1.5
         timeout-minutes: 240
         with:
           credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
@@ -1099,28 +1108,28 @@ jobs:
           MATRIX_ANDROID_DEVICE: ${{ matrix.android_device }}
       - name: Upload Android test results artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: log-artifact-test-android-${{ matrix.build_os }}-${{ matrix.android_device }}-${{ matrix.test_type }}
           path: testapps/test-results-android-${{ matrix.build_os }}-${{ matrix.android_device }}-${{ matrix.test_type }}*
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Upload Android test video artifact
         if: ${{ steps.device-info.outputs.device_type == 'virtual' && !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: mobile-simulator-test-video-artifact-${{ matrix.build_os }}-${{ matrix.android_device }}-${{ matrix.test_type }}
           path: testapps/video-*-android-${{ matrix.build_os }}-${{ matrix.android_device }}-${{ matrix.test_type }}.mp4
           retention-days: ${{ env.binaryArtifactRetentionDays }}
       - name: Upload Android test logcat artifact
         if: ${{ steps.device-info.outputs.device_type == 'virtual' && !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: mobile-simulator-test-logcat-artifact-${{ matrix.build_os }}-${{ matrix.android_device }}-${{ matrix.test_type }}
           path: testapps/logcat-*-android-${{ matrix.build_os }}-${{ matrix.android_device }}-${{ matrix.test_type }}.txt
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-test-android-${{ matrix.build_os }}-${{ matrix.android_device }}-${{ matrix.test_type }}
@@ -1168,17 +1177,17 @@ jobs:
              test_type: "uitest"
         build_os: [macos-26]
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download iOS integration tests artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: testapps/testapps-ios-${{ matrix.build_os }}
           name: testapps-ios-${{ matrix.build_os }}
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: setup default Xcode version (macos)
@@ -1188,7 +1197,7 @@ jobs:
           # Remove default Xcode version to prevent the wrong SDK from being used.
           rm -rf /Applications/Xcode.app
       - name: Install prerequisites for testing
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           timeout_minutes: 3
           max_attempts: 3
@@ -1201,17 +1210,17 @@ jobs:
         env:
           MATRIX_IOS_DEVICE: ${{ matrix.ios_device }}
       - name: Set up Node (18)
-        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # ratchet:actions/setup-node@v7
         with:
           node-version: 18.x
       - name: Setup java for Firestore emulator
-        uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # ratchet:actions/setup-java@v3
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # ratchet:actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: '17'
       - name: Setup Firestore Emulator
         if: steps.device-info.outputs.device_type == 'virtual' && contains(needs.check_and_prepare.outputs.apis, 'firestore')
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 5
@@ -1259,7 +1268,7 @@ jobs:
           MATRIX_IOS_DEVICE: ${{ matrix.ios_device }}
       - id: ftl_test
         if: steps.device-info.outputs.device_type == 'ftl'
-        uses: FirebaseExtended/github-actions/firebase-test-lab@41c787c37157e4c5932b951e531c041efa5bb7a4 # ratchet:FirebaseExtended/github-actions/firebase-test-lab@v1.4
+        uses: FirebaseExtended/github-actions/firebase-test-lab@57091ac526b308ae005c6d6d59aab83d5ab2aa71 # ratchet:FirebaseExtended/github-actions/firebase-test-lab@v1.5
         timeout-minutes: 180
         with:
           credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
@@ -1297,21 +1306,21 @@ jobs:
           security delete-keychain tmp-keychain || true
       - name: Upload iOS test results artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: log-artifact-test-ios-${{ matrix.build_os }}-${{ matrix.ios_device }}-${{ matrix.test_type }}
           path: testapps/test-results-ios-${{ matrix.build_os }}-${{ matrix.ios_device }}-${{ matrix.test_type }}*
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Upload iOS test video artifact
         if: ${{ steps.device-info.outputs.device_type == 'virtual' && !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: mobile-simulator-test-video-artifact-ios-${{ matrix.build_os }}-${{ matrix.ios_device }}-${{ matrix.test_type }}
           path: testapps/video-*-ios-${{ matrix.build_os }}-${{ matrix.ios_device }}-${{ matrix.test_type }}.mp4
           retention-days: ${{ env.binaryArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-test-ios-${{ matrix.build_os }}-${{ matrix.ios_device }}-${{ matrix.test_type }}
@@ -1354,17 +1363,17 @@ jobs:
         tvos_device: ${{ fromJson(needs.check_and_prepare.outputs.tvos_device) }}
         build_os: [macos-26]
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download tvOS integration tests artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: testapps/testapps-tvos-${{ matrix.build_os }}
           name: testapps-tvos-${{ matrix.build_os }}
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: setup default Xcode version (macos)
@@ -1374,19 +1383,19 @@ jobs:
           # Remove default Xcode version to prevent the wrong SDK from being used.
           rm -rf /Applications/Xcode.app
       - name: Install prerequisites for testing
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           timeout_minutes: 3
           max_attempts: 3
           command: scripts/gha/install_test_workflow_prereqs.sh -p tvOS  -t true
       - name: Setup java for Firestore emulator
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # ratchet:actions/setup-java@v4
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # ratchet:actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: '21'
       - name: Setup Firestore Emulator
         if: contains(needs.check_and_prepare.outputs.apis, 'firestore')
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # ratchet:nick-fields/retry@v4
         with:
           shell: bash
           timeout_minutes: 5
@@ -1451,21 +1460,21 @@ jobs:
           security delete-keychain tmp-keychain || true
       - name: Upload tvOS test results artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: log-artifact-test-tvos-${{ matrix.build_os }}-${{ matrix.tvos_device }}
           path: testapps/test-results-tvos-${{ matrix.build_os }}-${{ matrix.tvos_device }}*
           retention-days: ${{ env.logArtifactRetentionDays }}
       - name: Upload tvOS test video artifact
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # ratchet:actions/upload-artifact@v7
         with:
           name: mobile-simulator-test-video-artifact-tvos-${{ matrix.build_os }}-${{ matrix.tvos_device }}
           path: testapps/video-*-tvos-${{ matrix.build_os }}-${{ matrix.tvos_device }}.mp4
           retention-days: ${{ env.binaryArtifactRetentionDays }}
       - name: Download log artifacts
         if: ${{ needs.check_and_prepare.outputs.pr_number && failure() && !cancelled() }}
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           name: log-artifact-test-tvos-${{ matrix.build_os }}-${{ matrix.tvos_device }}
@@ -1503,19 +1512,19 @@ jobs:
       issues: write
     if: ${{ !cancelled() }}
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
 
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: Install python deps
         run: pip install -r scripts/gha/python_requirements.txt
       - name: Download log artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # ratchet:actions/download-artifact@v8
         with:
           path: test_results
           pattern: log-artifact-*
@@ -1523,7 +1532,7 @@ jobs:
       # Use a different token to remove the "in-progress" label,
       # to allow the removal to trigger the "Check Labels" workflow.
       - name: Generate token for GitHub API
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # ratchet:actions/create-github-app-token@v3
         id: generate-token
         with:
           client-id: ${{ secrets.WORKFLOW_TRIGGER_CLIENT_ID }}
@@ -1584,20 +1593,20 @@ jobs:
       contents: read
     if: ${{ failure() && needs.check_and_prepare.outputs.trigger == 'scheduled_trigger' }}
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
 
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: ${{ env.pythonVersion }}
       - name: Install python deps
         run: pip install -r scripts/gha/python_requirements.txt
       # The default token can't run workflows, so get an alternate token.
       - name: Generate token for GitHub API
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # ratchet:actions/create-github-app-token@v3
         id: generate-token
         with:
           client-id: ${{ secrets.WORKFLOW_TRIGGER_CLIENT_ID }}
diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index f27b79639d..281c8d835a 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -26,7 +26,7 @@ jobs:
     outputs:
       matrix_xcode_version: ${{ steps.export-result.outputs.matrix_xcode_version }}
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
@@ -64,13 +64,13 @@ jobs:
         env:
           XCODE_VERSION: ${{ matrix.xcode_version }}
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
           architecture: "arm64"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 030a616f17..9b1f53d497 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,20 +18,20 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           repository: cpplint/cpplint
           ref: "1.5.5"
           path: cpplint
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
           path: firebase
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
       - name: Install prerequisites
diff --git a/.github/workflows/retry-test-failures.yml b/.github/workflows/retry-test-failures.yml
index 07ff259075..70c625715e 100644
--- a/.github/workflows/retry-test-failures.yml
+++ b/.github/workflows/retry-test-failures.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Get token for firebase-workflow-trigger
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # ratchet:actions/create-github-app-token@v3
         id: generate-token
         with:
           client-id: ${{ secrets.WORKFLOW_TRIGGER_CLIENT_ID }}
@@ -24,11 +24,11 @@ jobs:
           permission-actions: write
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{ matrix.branch_name }}
diff --git a/.github/workflows/reviewer-roulette.yml b/.github/workflows/reviewer-roulette.yml
index 5a099120d3..d3a1c34f6e 100644
--- a/.github/workflows/reviewer-roulette.yml
+++ b/.github/workflows/reviewer-roulette.yml
@@ -19,11 +19,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Unset label
-        uses: buildsville/add-remove-label@6008d7bd99d3baeb7c04033584e68f8ec80b198b # ratchet:buildsville/add-remove-label@v1
-        with:
-          token: ${{ github.token }}
-          label: "${{ github.event.label.name }}"
-          type: remove
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          LABEL: ${{ github.event.label.name }}
+        run: |
+          gh pr edit "${PR_NUMBER}" --repo "${GITHUB_REPOSITORY}" --remove-label "${LABEL}"
 
       - name: Get PR reviews
         # Put the JSON string for all the PR's completed reviews into env.PR_REVIEWS
@@ -81,16 +82,13 @@ jobs:
           REQUESTED_REVIEWERS: ${{ join(github.event.pull_request.requested_reviewers.*.login, ' ') }}
           GITHUB_EVENT_PULL_REQUEST_USER_LOGIN: ${{ github.event.pull_request.user.login }}
 
-      - name: Choose random reviewer
-        if: ${{ steps.get-reviewers.outputs.reviewer_list != '[]' }}
-        id: choose-random
-        uses: KhannaAbhinav/random-selector-action@1a64ecbd9aac544c4607fcb59ddb59f65e71e3ff # ratchet:KhannaAbhinav/random-selector-action@v1
-        with:
-          data: ${{ steps.get-reviewers.outputs.reviewer_list }}
-
-      - name: Assign Reviewers to PR
+      - name: Choose random reviewer and assign to PR
         if: ${{ steps.get-reviewers.outputs.reviewer_list != '[]' }}
-        uses: itsOliverBott/assign-pr-reviewers@bfe99c76aab72b700a61b84a2703e923a16d9390 # ratchet:itsOliverBott/assign-pr-reviewers@release
-        with:
-          token: ${{ github.token }}
-          users: ${{ fromJSON(steps.choose-random.outputs.selectedValuesList)[0] }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REVIEWER_LIST: ${{ steps.get-reviewers.outputs.reviewer_list }}
+        run: |
+          reviewer=$(echo "${REVIEWER_LIST}" | jq -r '.[]' | shuf -n 1)
+          echo "Selected reviewer: ${reviewer}"
+          gh api --method POST "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/requested_reviewers" -f "reviewers[]=${reviewer}"
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 541f4fc240..5f93def291 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: macos-26
     steps:
       - name: Get token for firebase-workflow-trigger
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # ratchet:actions/create-github-app-token@v3
         id: generate-token
         with:
           client-id: ${{ secrets.WORKFLOW_TRIGGER_CLIENT_ID }}
@@ -39,12 +39,12 @@ jobs:
           permission-pull-requests: write
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
 
       - name: Check out base branch
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           fetch-depth: 0
@@ -209,9 +209,10 @@ jobs:
           GITHUB_EVENT_INPUTS_BASEBRANCH: ${{ github.event.inputs.baseBranch }}
 
       - name: Set test trigger label.
-        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # ratchet:actions-ecosystem/action-add-labels@v1
         if: ${{ github.event.inputs.triggerTests == 1 && steps.push-branch.outputs.branch_pushed == 1 }}
-        with:
-          github_token: ${{ steps.generate-token.outputs.token }}
-          number: ${{ steps.push-branch.outputs.created_pr_number }}
-          labels: "${{ env.triggerTestsLabel }}"
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          PR_NUMBER: ${{ steps.push-branch.outputs.created_pr_number }}
+          LABEL: ${{ env.triggerTestsLabel }}
+        run: |
+          gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/labels" -f "labels[]=${LABEL}"
diff --git a/.github/workflows/update-feature-branches.yml b/.github/workflows/update-feature-branches.yml
index 300caafef8..3a822c9a31 100644
--- a/.github/workflows/update-feature-branches.yml
+++ b/.github/workflows/update-feature-branches.yml
@@ -32,7 +32,7 @@ jobs:
     steps:
       - name: Check out repo (if needed)
         if: ${{ github.event.inputs.branch_list == '' }}
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
 
@@ -74,7 +74,7 @@ jobs:
         branch_name: ${{ fromJson(needs.list_feature_branches.outputs.branch_list) }}
     steps:
       - name: Get token for firebase-workflow-trigger
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # ratchet:actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # ratchet:actions/create-github-app-token@v3
         id: generate-token
         with:
           client-id: ${{ secrets.WORKFLOW_TRIGGER_CLIENT_ID }}
@@ -83,11 +83,11 @@ jobs:
           permission-pull-requests: write
 
       - name: Setup python
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # ratchet:actions/setup-python@v7
         with:
           python-version: 3.9
 
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
         with:
           persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{ matrix.branch_name }}
@@ -145,9 +145,10 @@ jobs:
           STEPS_GENERATE_TOKEN_OUTPUTS_TOKEN: ${{ steps.generate-token.outputs.token }}
 
       - name: Set test trigger label.
-        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # ratchet:actions-ecosystem/action-add-labels@v1
         if: ${{ steps.create-pr.outputs.created_pr_number }}
-        with:
-          github_token: ${{ steps.generate-token.outputs.token }}
-          number: ${{ steps.create-pr.outputs.created_pr_number }}
-          labels: "${{ env.triggerTestsLabel }}"
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          PR_NUMBER: ${{ steps.create-pr.outputs.created_pr_number }}
+          LABEL: ${{ env.triggerTestsLabel }}
+        run: |
+          gh api --method POST "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/labels" -f "labels[]=${LABEL}"

From 768186528919396d62e5c541d386fe3dcc7130f3 Mon Sep 17 00:00:00 2001
From: austinbenoit <austinbenoit@google.com>
Date: Fri, 23 Oct 2026 14:23:34 +0000
Subject: [PATCH 2/3] Remove non-functional update-custom-runner workflow

This workflow_dispatch-only workflow targeted two self-hosted macOS
runners (fplmac1, fplmac2) that are no longer registered to the repo
(the repo has zero self-hosted runners). It was also never functional:
its job condition reads `github.event.input` (singular), which is not a
valid context and always evaluates empty, so the job was always skipped,
and its steps only echo the commands they describe.
---
 .github/workflows/update-custom-runner.yml | 55 ----------------------
 1 file changed, 55 deletions(-)
 delete mode 100644 .github/workflows/update-custom-runner.yml

diff --git a/.github/workflows/update-custom-runner.yml b/.github/workflows/update-custom-runner.yml
deleted file mode 100644
index bcf03f0a77..0000000000
--- a/.github/workflows/update-custom-runner.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Update custom GitHub runners
-
-on:
-  workflow_dispatch:
-    inputs:
-      runner_list:
-        description: 'Runner hostname to update (comma-separated)'
-        default: 'fplmac1,fplmac2'
-        required: true
-      update_tools:
-        description: 'Update tools?'
-        default: '1'
-        required: true
-      update_os:
-        description: 'Update OS?'
-        default: '0'
-        required: true
-
-env:
-  GITHUB_TOKEN: ${{ github.token }}
-
-permissions:
-  contents: read
-
-jobs:
-  update_custom_runners:
-    name: update-custom-runner-${{ matrix.runner_hostname }}
-    runs-on: [self-hosted, '${{ matrix.runner_hostname }}' ]
-    if: ${{ github.event.input.runner_list }}
-
-    strategy:
-      matrix:
-        runner_hostname: ${{ github.event.input.runner_list }}
-
-    steps:
-      - name: Update tools
-        if: ${{ github.event.inputs.update_tools }}
-        shell: bash
-        run: |
-          echo "npm install -g firebase-tools"
-
-      - name: Check for OS updates
-        shell: bash
-        run: |
-          if softwareupdate -l -r | grep -q 'No new software available'
-          then
-            echo "::warning ::No OS updates available."
-          else
-            echo "softwareupdate -l -r | tr '\n' '|' | sed 's/|/%0A/g' | sed "
-        
-      - name: Update OS
-        if: ${{ github.event.inputs.update_os }}
-        shell: bash
-        run: |
-          echo "softwareupdate -i -r -f"

From dc4466339feaafc1cd5c631b24995c534782cfe7 Mon Sep 17 00:00:00 2001
From: austinbenoit <austinbenoit@google.com>
Date: Fri, 23 Oct 2026 22:25:25 +0000
Subject: [PATCH 3/3] integration_tests: skip permission check for
 bots/schedule, require write

The replaced lannonbr/repo-permission-check-action was effectively a no-op:
it read its input as `permision` (typo), so the required level was never
set and every actor passed, and a 404 for non-collaborator actors (bots,
departed users) was an unhandled rejection that did not fail the step.

Enforcing it for real broke the chained run dispatched by
firebase-workflow-trigger[bot] from the packaging workflow, since bots are
not collaborators. Skip the check for bot actors (they already need
actions:write to dispatch) and for scheduled runs (whose actor is whoever
last committed the workflow file), and accept write as well as admin so
existing write-level team members can still trigger tests.
---
 .github/workflows/integration_tests.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/integration_tests.yml b/.github/workflows/integration_tests.yml
index 3f8bcb4b61..3420c92e3c 100644
--- a/.github/workflows/integration_tests.yml
+++ b/.github/workflows/integration_tests.yml
@@ -79,16 +79,21 @@ jobs:
       ios_device: ${{ steps.matrix_config.outputs.ios_device }}
       tvos_device: ${{ steps.matrix_config.outputs.tvos_device }}
     steps:
-    ### Fail the workflow if the user does not have admin access to run the tests.
+    ### Fail the workflow if the user does not have write access to run the tests.
+    ### Skipped for scheduled runs (the actor is whoever last touched the workflow file)
+    ### and for bot actors (e.g. firebase-workflow-trigger[bot] dispatching this from the
+    ### packaging workflow), since bots are not collaborators and already need
+    ### actions:write to dispatch a workflow.
     - name: Check if user has permission to trigger tests
+      if: github.event_name != 'schedule' && !endsWith(github.actor, '[bot]')
       env:
         GH_TOKEN: ${{ github.token }}
         ACTOR: ${{ github.actor }}
       run: |
         permission=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq '.permission' || echo "none")
         echo "User ${ACTOR} has permission: ${permission}"
-        if [[ "${permission}" != "admin" ]]; then
-          echo "::error ::User ${ACTOR} does not have admin permission to trigger tests."
+        if [[ "${permission}" != "admin" && "${permission}" != "write" ]]; then
+          echo "::error ::User ${ACTOR} does not have write permission to trigger tests."
           exit 1
         fi
     ### It sets "github_ref,trigger,pr_number,requested_tests" outputs to control the following jobs and steps