Distillation

Date: Sep 10, 2026

• 🔴 (11:51) User stated that repository secrets must never be used by .github/workflows/ci-poller-dispatch.yml; the production protected environment enforces that an arbitrarily dispatched ref cannot access them. Production permits deployments only from main.
• 🟡 (11:51) .github/workflows/ci-poller-dispatch.yml defines the manually triggered workflow Run CI Status Poller with on: workflow_dispatch, permissions: {}, and a dispatch job using environment: production, runs-on: ubuntu-latest, and a single run: ":" step.
• 🟡 (11:52) .github/workflows/cocoapods-keepalive.yml defines CocoaPods Token Keep-Alive, scheduled by cron "0 0 * * *" every day at midnight UTC because CocoaPods sessions currently expire after 3 days of inactivity (VALIDITY_LENGTH).
• 🟡 (11:52) The keepalive job in .github/workflows/cocoapods-keepalive.yml is named Refresh CocoaPods Session, runs on macos-15 in environment: production, has contents: read permission, and exposes ${{ secrets.COCOAPODS_TRUNK_TOKEN }} as COCOAPODS_TRUNK_TOKEN.
• 🟡 (11:52) .github/workflows/cocoapods-keepalive.yml performs 3 ordered steps: 1. gem install cocoapods, 2. pod --version, 3. pod trunk me > /dev/null 2>&1 to refresh the CocoaPods session.