[ofalvai]

ios/PrivacyInfo.xcprivacy has been in the repo since the upstream manifest PR, but no build ever packaged it. The podspec had no resource bundle, and Package.swift had no resources. The file also sat outside the CodePush target path, so SwiftPM couldn't have picked it up anyway. Apps that use CodePush got none of its declarations.

This came up in #113 (#113 (comment)), where a review asked to declare a new API in this file.

Changes

• Move the manifest to ios/CodePush/ so it lives inside the SwiftPM target.
• CocoaPods ships it as the CodePushPrivacyInfo resource bundle.
• SwiftPM ships it as a resource of the CodePush target.
• Declare file timestamp access with C617.1 instead of 0A2A.1. This matters now that the declaration actually reaches App Store review. Details below.

Why C617.1

From Apple's reason list:

0A2A.1: Declare this reason if your third-party SDK is providing a wrapper function around file timestamp API(s) for the app to use, and you only access the file timestamp APIs when the app calls your wrapper function.

C617.1: Declare this reason to access the timestamps, size, or other metadata of files inside the app container, app group container, or the app's CloudKit container.

CodePush doesn't wrap anything for the app. It reads timestamps itself, in two places:

• lstat on files in its update directory, in the app's data container. C617.1 covers that.
• The modification date of main.jsbundle inside the .app. Apple doesn't say whether the app bundle counts as part of the "app container". React Native makes the same call, though: both React.framework and React-cxxreact declare C617.1 for file timestamps.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The manifest declares no collected data despite update checks and telemetry transmitting identifierForVendor, so the service owner must confirm retention and use beyond what the repository can establish.

No open issues 🎉

What changed in this PR

This PR configures CocoaPods and SwiftPM to include CodePush’s iOS privacy manifest in consuming apps, addressing a packaging gap, and updates the file-timestamp declaration to match the SDK’s usage.

Changes:

• Moves the manifest into the SwiftPM target directory and updates its Xcode project reference.
• Adds manifest resources to both package definitions.
• Replaces timestamp-access reason 0A2A.1 with C617.1 for access within the app container.

File	Description
Package.swift	Adds the privacy manifest as a copied target resource.
ios/​CodePush/​PrivacyInfo.xcprivacy	Relocates the manifest and updates the timestamp-access reason.
ios/​CodePush.xcodeproj/​project.pbxproj	Points the manifest reference to its new location.
CodePush.podspec	Adds the CodePushPrivacyInfo resource bundle.

_{Review effort: Balanced}