From e9408ba0a330641eeb6b13a5930c1367599947ad Mon Sep 17 00:00:00 2001
From: tarikgul <tariksnow37@gmail.com>
Date: Thu, 10 Sep 2026 13:59:14 -0400
Subject: [PATCH 1/2] ci(ios): re-home the dispatch-only iOS workflows to the
 repo root

GitHub reads workflows only from the repository root, so everything under
hosts/ios/.github/workflows/ is inert. These seven are the ones that never
trigger themselves: two are workflow_call, five are workflow_dispatch. Moving
them changes no scheduled or pull request behaviour, so the mechanical work
lands before the secrets and runners that the pull request checks need.

Paths now resolve from the repository root. Composite action references become
./hosts/ios/.github/actions/..., which is also how the workflow_call references
between these files start resolving at all, since a local uses: path is always
read from the root regardless of where the calling file sits.

Steps that drive the app rather than the repository run from hosts/ios: the
fastlane invocations, the xcconfig edit, and the TestFlight build number lookup.
Steps that take a path argument keep a root-relative one instead, so
read-build-version reads a prefixed pbxproj default and a prefixed script path.

The shared composite actions pick up the same treatment: bundler resolves
hosts/ios/Gemfile, the SPM cache points at hosts/ios/source_packages, the
generated secrets and GoogleService-Info.plist land under hosts/ios, and the
built ipa is uploaded from there.

None of this is exercised yet. No current job resolves these workflows, and the
build itself needs the credentials tracked in #672, so this is verified by
actionlint and by every local reference resolving, not by a run.
---
 .../workflows/ios-build-distribute.yml        | 20 ++++++++++---------
 .../workflows/ios-nightly-distribution.yml    |  4 ++--
 .../workflows/ios-prepare-pipeline.yml        |  4 ++--
 .../workflows/ios-register-device.yml         |  3 ++-
 .../workflows/ios-release-prepare.yml         |  2 +-
 .../workflows/ios-safetynet-distribution.yml  | 10 +++++-----
 .../workflows/ios-testflight-distribution.yml |  8 ++++----
 .../configure-google-services/action.yml      |  2 +-
 .../actions/configure-secrets/action.yml      |  4 ++--
 .../actions/distribute-testflight/action.yml  |  8 +++++---
 hosts/ios/.github/actions/install/action.yml  |  3 ++-
 .../actions/read-build-version/action.yml     |  5 +++--
 12 files changed, 40 insertions(+), 33 deletions(-)
 rename hosts/ios/.github/workflows/_build_distribute.yml => .github/workflows/ios-build-distribute.yml (96%)
 rename hosts/ios/.github/workflows/nightly_distribution.yml => .github/workflows/ios-nightly-distribution.yml (97%)
 rename hosts/ios/.github/workflows/_prepare_pipeline.yml => .github/workflows/ios-prepare-pipeline.yml (99%)
 rename hosts/ios/.github/workflows/register_device.yml => .github/workflows/ios-register-device.yml (92%)
 rename hosts/ios/.github/workflows/release_prepare.yml => .github/workflows/ios-release-prepare.yml (95%)
 rename hosts/ios/.github/workflows/safetynet_distribution.yml => .github/workflows/ios-safetynet-distribution.yml (94%)
 rename hosts/ios/.github/workflows/testflight_distribution.yml => .github/workflows/ios-testflight-distribution.yml (95%)

diff --git a/hosts/ios/.github/workflows/_build_distribute.yml b/.github/workflows/ios-build-distribute.yml
similarity index 96%
rename from hosts/ios/.github/workflows/_build_distribute.yml
rename to .github/workflows/ios-build-distribute.yml
index 0e7dc6eb0..fc925e701 100644
--- a/hosts/ios/.github/workflows/_build_distribute.yml
+++ b/.github/workflows/ios-build-distribute.yml
@@ -162,11 +162,11 @@ jobs:
             core.setOutput('increment_step', incrementStep);
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
 
       - name: Read version and build number
         id: build_version
-        uses: ./.github/actions/read-build-version
+        uses: ./hosts/ios/.github/actions/read-build-version
         with:
           increment_step: ${{ steps.release_notes.outputs.increment_step }}
           # Safetynet has its own App Store Connect record, so it carries a TestFlight
@@ -220,6 +220,7 @@ jobs:
         env:
           # The leaf xcconfig is named after the configuration being built.
           BUILD_CONFIGURATION: ${{ inputs.build_configuration }}
+        working-directory: hosts/ios
         run: |
           set -euo pipefail
           config_name=$(echo "${BUILD_CONFIGURATION}" | tr '[:upper:]' '[:lower:]')
@@ -228,14 +229,14 @@ jobs:
             "${{ matrix.variant.extra_swift_flags }}"
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RO_PAT }}
 
       - name: Distribute TestFlight build
         if: matrix.variant.upload_to_testflight
-        uses: ./.github/actions/distribute-testflight
+        uses: ./hosts/ios/.github/actions/distribute-testflight
         with:
           ios_bundle_id: ${{ env.IOS_BUNDLE_ID }}
           ios_extension_bundle_id: ${{ env.IOS_EXTENSION_BUNDLE_ID }}
@@ -261,14 +262,14 @@ jobs:
 
       - name: Configure Google services for non-TestFlight build
         if: ${{ !matrix.variant.upload_to_testflight }}
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ inputs.build_configuration == 'Safetynet' && secrets.GOOGLE_SERVICE_INFO_SAFETY_BASE64 || secrets.GOOGLE_SERVICE_INFO_RELEASE_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets for non-TestFlight build
         if: ${{ !matrix.variant.upload_to_testflight }}
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
@@ -280,6 +281,7 @@ jobs:
           BUILD_NUMBER: ${{ needs.prepare_build_metadata.outputs.build_number }}
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        working-directory: hosts/ios
         run: |
           bundle exec fastlane build_app_ci
 
@@ -290,7 +292,7 @@ jobs:
           s3_access_key: ${{ secrets.SCW_ACCESS_KEY }}
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
           # Subdir keeps each configuration's archive in its own namespace: a nightly run
           # writes two different apps, whose build numbers come from independent counters.
           destination_path: /ios/${{ inputs.s3_static_subdir }}/polkadot-app-${{ needs.prepare_build_metadata.outputs.marketing_version }}-${{ needs.prepare_build_metadata.outputs.build_number }}${{ matrix.variant.s3_suffix }}.ipa
@@ -302,7 +304,7 @@ jobs:
           s3_access_key: ${{ secrets.SCW_ACCESS_KEY }}
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
           destination_path: /ios/${{ inputs.s3_static_subdir }}/polkadot-app${{ matrix.variant.s3_suffix }}.ipa
 
       - name: Comment on PR with build info
@@ -388,7 +390,7 @@ jobs:
         uses: actions/checkout@v6
       - name: Check default matrix leg conclusion
         id: check
-        uses: ./.github/actions/check-job-conclusion
+        uses: ./hosts/ios/.github/actions/check-job-conclusion
         with:
           job_name: "Check and Build TestFlight (${{ inputs.build_configuration }} / default)"
           github_token: ${{ github.token }}
diff --git a/hosts/ios/.github/workflows/nightly_distribution.yml b/.github/workflows/ios-nightly-distribution.yml
similarity index 97%
rename from hosts/ios/.github/workflows/nightly_distribution.yml
rename to .github/workflows/ios-nightly-distribution.yml
index a8f0260f9..8c8a193d1 100644
--- a/hosts/ios/.github/workflows/nightly_distribution.yml
+++ b/.github/workflows/ios-nightly-distribution.yml
@@ -14,7 +14,7 @@ on:
 
 jobs:
   build_nightly:
-    uses: ./.github/workflows/_build_distribute.yml
+    uses: ./.github/workflows/ios-build-distribute.yml
     with:
       release_branch: ${{ inputs.release_branch }}
       release_pr_number: ${{ inputs.release_pr_number }}
@@ -33,7 +33,7 @@ jobs:
   # environment, under its own bundle id so it installs alongside the real app. See
   # Configs/base.safetynet.xcconfig.
   build_safetynet:
-    uses: ./.github/workflows/_build_distribute.yml
+    uses: ./.github/workflows/ios-build-distribute.yml
     with:
       release_branch: ${{ inputs.release_branch }}
       release_pr_number: ${{ inputs.release_pr_number }}
diff --git a/hosts/ios/.github/workflows/_prepare_pipeline.yml b/.github/workflows/ios-prepare-pipeline.yml
similarity index 99%
rename from hosts/ios/.github/workflows/_prepare_pipeline.yml
rename to .github/workflows/ios-prepare-pipeline.yml
index f3b91b726..995f23cac 100644
--- a/hosts/ios/.github/workflows/_prepare_pipeline.yml
+++ b/.github/workflows/ios-prepare-pipeline.yml
@@ -28,7 +28,7 @@ permissions:
   actions: write
 
 env:
-  PBXPROJ_PATH: polkadot-app.xcodeproj/project.pbxproj
+  PBXPROJ_PATH: hosts/ios/polkadot-app.xcodeproj/project.pbxproj
   SOURCE_REF: ${{ inputs.source_ref }}
   MAIN_BRANCH: main
 
@@ -74,7 +74,7 @@ jobs:
         run: |
           set -euo pipefail
           TMP_DIR="$(mktemp -d)"
-          cp -R .github/scripts "${TMP_DIR}/scripts"
+          cp -R hosts/ios/.github/scripts "${TMP_DIR}/scripts"
           echo "SCRIPTS_DIR=${TMP_DIR}/scripts" >> "$GITHUB_ENV"
           echo "Cached scripts at ${TMP_DIR}/scripts"
 
diff --git a/hosts/ios/.github/workflows/register_device.yml b/.github/workflows/ios-register-device.yml
similarity index 92%
rename from hosts/ios/.github/workflows/register_device.yml
rename to .github/workflows/ios-register-device.yml
index 115ad9f3d..339581dfb 100644
--- a/hosts/ios/.github/workflows/register_device.yml
+++ b/.github/workflows/ios-register-device.yml
@@ -24,9 +24,10 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
 
       - name: Register device
+        working-directory: hosts/ios
         run: bundle exec fastlane register name:"$DEVICE_NAME" udid:"$DEVICE_UDID"
         env:
           DEVICE_NAME: ${{ inputs.device_name }}
diff --git a/hosts/ios/.github/workflows/release_prepare.yml b/.github/workflows/ios-release-prepare.yml
similarity index 95%
rename from hosts/ios/.github/workflows/release_prepare.yml
rename to .github/workflows/ios-release-prepare.yml
index dabdf9399..c204e72b6 100644
--- a/hosts/ios/.github/workflows/release_prepare.yml
+++ b/.github/workflows/ios-release-prepare.yml
@@ -37,7 +37,7 @@ permissions:
 
 jobs:
   prepare:
-    uses: ./.github/workflows/_prepare_pipeline.yml
+    uses: ./.github/workflows/ios-prepare-pipeline.yml
     with:
       is_nightly: false
       bump_level: ${{ inputs.bump_level }}
diff --git a/hosts/ios/.github/workflows/safetynet_distribution.yml b/.github/workflows/ios-safetynet-distribution.yml
similarity index 94%
rename from hosts/ios/.github/workflows/safetynet_distribution.yml
rename to .github/workflows/ios-safetynet-distribution.yml
index 6b8dba502..71df783cd 100644
--- a/hosts/ios/.github/workflows/safetynet_distribution.yml
+++ b/.github/workflows/ios-safetynet-distribution.yml
@@ -58,14 +58,14 @@ jobs:
           fetch-depth: 0
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RO_PAT }}
 
       - name: Read version and build number
         id: build_version
-        uses: ./.github/actions/read-build-version
+        uses: ./hosts/ios/.github/actions/read-build-version
         with:
           increment_step: ${{ inputs.increment_step }}
           ios_bundle_id: ${{ env.IOS_BUNDLE_ID }}
@@ -75,7 +75,7 @@ jobs:
           asc_key_base64: ${{ secrets.ASC_KEY_BASE64 }}
 
       - name: Distribute TestFlight build
-        uses: ./.github/actions/distribute-testflight
+        uses: ./hosts/ios/.github/actions/distribute-testflight
         with:
           ios_bundle_id: ${{ env.IOS_BUNDLE_ID }}
           ios_extension_bundle_id: ${{ env.IOS_EXTENSION_BUNDLE_ID }}
@@ -107,7 +107,7 @@ jobs:
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
           destination_path: /ios/safetynet/polkadot-app-${{ steps.build_version.outputs.marketing_version }}-${{ steps.build_version.outputs.build_number }}.ipa
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
 
       - name: Upload to S3 (static path)
         uses: novasamatech/github-actions/s3-upload@v5
@@ -117,4 +117,4 @@ jobs:
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
           destination_path: /ios/safetynet/polkadot-app.ipa
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
diff --git a/hosts/ios/.github/workflows/testflight_distribution.yml b/.github/workflows/ios-testflight-distribution.yml
similarity index 95%
rename from hosts/ios/.github/workflows/testflight_distribution.yml
rename to .github/workflows/ios-testflight-distribution.yml
index 7ceb1a66f..23cf2ce6f 100644
--- a/hosts/ios/.github/workflows/testflight_distribution.yml
+++ b/.github/workflows/ios-testflight-distribution.yml
@@ -32,14 +32,14 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RO_PAT }}
 
       - name: Read version and build number
         id: read_marketing_version
-        uses: ./.github/actions/read-build-version
+        uses: ./hosts/ios/.github/actions/read-build-version
         with:
           ios_bundle_id: ${{ env.IOS_BUNDLE_ID }}
           asc_key_id: ${{ secrets.ASC_KEY_ID }}
@@ -47,7 +47,7 @@ jobs:
           asc_key_base64: ${{ secrets.ASC_KEY_BASE64 }}
 
       - name: Distribute TestFlight build
-        uses: ./.github/actions/distribute-testflight
+        uses: ./hosts/ios/.github/actions/distribute-testflight
         with:
           ios_bundle_id: ${{ env.IOS_BUNDLE_ID }}
           ios_extension_bundle_id: ${{ env.IOS_EXTENSION_BUNDLE_ID }}
@@ -71,7 +71,7 @@ jobs:
         if: always()
         with:
           name: polkadot-app-release-ipa
-          path: "*.ipa"
+          path: "hosts/ios/*.ipa"
           retention-days: 7
 
   upload-to-s3:
diff --git a/hosts/ios/.github/actions/configure-google-services/action.yml b/hosts/ios/.github/actions/configure-google-services/action.yml
index 1e5937cb8..943b93277 100644
--- a/hosts/ios/.github/actions/configure-google-services/action.yml
+++ b/hosts/ios/.github/actions/configure-google-services/action.yml
@@ -25,7 +25,7 @@ runs:
           exit 1
         fi
 
-        destination="${GITHUB_WORKSPACE:?}/polkadot-app/GoogleService-Info.plist"
+        destination="${GITHUB_WORKSPACE:?}/hosts/ios/polkadot-app/GoogleService-Info.plist"
         temporary="$(mktemp "${RUNNER_TEMP:?}/GoogleService-Info.XXXXXX")"
         trap 'rm -f "${temporary}"' EXIT
 
diff --git a/hosts/ios/.github/actions/configure-secrets/action.yml b/hosts/ios/.github/actions/configure-secrets/action.yml
index c5ae88dd9..8039dedce 100644
--- a/hosts/ios/.github/actions/configure-secrets/action.yml
+++ b/hosts/ios/.github/actions/configure-secrets/action.yml
@@ -17,9 +17,9 @@ runs:
     - name: Generate Secrets.generated.swift
       shell: bash
       env:
-        SRCROOT: ${{ github.workspace }}
+        SRCROOT: ${{ github.workspace }}/hosts/ios
         SENTRY_DSN: ${{ inputs.sentry_dsn }}
         MELD_BASIC_AUTH_TOKEN: ${{ inputs.meld_basic_auth_token }}
       run: |
         set -euo pipefail
-        "${GITHUB_WORKSPACE:?}/Runscripts/generate_secrets.sh"
+        "${GITHUB_WORKSPACE:?}/hosts/ios/Runscripts/generate_secrets.sh"
diff --git a/hosts/ios/.github/actions/distribute-testflight/action.yml b/hosts/ios/.github/actions/distribute-testflight/action.yml
index 56b1a64ec..010e29baf 100644
--- a/hosts/ios/.github/actions/distribute-testflight/action.yml
+++ b/hosts/ios/.github/actions/distribute-testflight/action.yml
@@ -105,13 +105,13 @@ runs:
       uses: actions/checkout@v6
 
     - name: Configure secrets
-      uses: ./.github/actions/configure-secrets
+      uses: ./hosts/ios/.github/actions/configure-secrets
       with:
         sentry_dsn: ${{ inputs.sentry_dsn }}
         meld_basic_auth_token: ${{ inputs.meld_basic_auth_token }}
 
     - name: Configure Google services for tests
-      uses: ./.github/actions/configure-google-services
+      uses: ./hosts/ios/.github/actions/configure-google-services
       with:
         google_service_info_base64: ${{ inputs.google_service_info_dev_base64 }}
         expected_bundle_id: io.parity.polkadotapp.develop
@@ -120,11 +120,12 @@ runs:
       shell: bash
       env:
         RUN_IN_CI: ${{ inputs.run_in_ci }}
+      working-directory: hosts/ios
       run: |
         bundle exec fastlane run_unit_tests
 
     - name: Configure Google services for TestFlight
-      uses: ./.github/actions/configure-google-services
+      uses: ./hosts/ios/.github/actions/configure-google-services
       with:
         google_service_info_base64: ${{ inputs.google_service_info_release_base64 }}
         expected_bundle_id: ${{ inputs.ios_bundle_id }}
@@ -148,6 +149,7 @@ runs:
         ASC_KEY_BASE64: ${{ inputs.asc_key_base64 }}
         KEYCHAIN_PASSWORD: ${{ inputs.keychain_password }}
         MATCH_PASSWORD: ${{ inputs.match_password }}
+      working-directory: hosts/ios
       run: |
         set -euo pipefail
         bundle exec fastlane distribute_testflight
diff --git a/hosts/ios/.github/actions/install/action.yml b/hosts/ios/.github/actions/install/action.yml
index 77fb2ef86..9a3af5570 100644
--- a/hosts/ios/.github/actions/install/action.yml
+++ b/hosts/ios/.github/actions/install/action.yml
@@ -54,6 +54,7 @@ runs:
     - uses: ruby/setup-ruby@v1
       with:
         bundler-cache: true
+        working-directory: hosts/ios
 
     - name: Install Python
       uses: actions/setup-python@v6
@@ -63,7 +64,7 @@ runs:
     - name: Restore SPM cache
       uses: actions/cache@v5
       with:
-        path: source_packages
+        path: hosts/ios/source_packages
         key: ${{ runner.os }}-xcode-${{ inputs.xcode-version }}-spm-${{ hashFiles('**/Package.resolved') }}
         restore-keys: |
           ${{ runner.os }}-xcode-${{ inputs.xcode-version }}-spm-
diff --git a/hosts/ios/.github/actions/read-build-version/action.yml b/hosts/ios/.github/actions/read-build-version/action.yml
index c64178afb..42db2701e 100644
--- a/hosts/ios/.github/actions/read-build-version/action.yml
+++ b/hosts/ios/.github/actions/read-build-version/action.yml
@@ -5,7 +5,7 @@ inputs:
   pbxproj_path:
     description: "Path to project.pbxproj"
     required: false
-    default: "polkadot-app.xcodeproj/project.pbxproj"
+    default: "hosts/ios/polkadot-app.xcodeproj/project.pbxproj"
   config_name:
     description: "Xcode configuration to read MARKETING_VERSION from (Release, Nightly or Safetynet)"
     required: false
@@ -47,7 +47,7 @@ runs:
         CONFIG_NAME: ${{ inputs.config_name }}
       run: |
         set -euo pipefail
-        python3 .github/scripts/read_versions.py "${PBXPROJ_PATH}" \
+        python3 hosts/ios/.github/scripts/read_versions.py "${PBXPROJ_PATH}" \
           --config-name "${CONFIG_NAME}" \
           --output-format env | grep "marketing_version=" >> "$GITHUB_OUTPUT"
 
@@ -60,6 +60,7 @@ runs:
         ASC_KEY_ID: ${{ inputs.asc_key_id }}
         ASC_ISSUER_ID: ${{ inputs.asc_issuer_id }}
         ASC_KEY_BASE64: ${{ inputs.asc_key_base64 }}
+      working-directory: hosts/ios
       run: |
         set -euo pipefail
         CURRENT=$(bundle exec fastlane get_testflight_build_number 2>&1 | grep -oE "Latest TestFlight build number: [0-9]+" | grep -oE "[0-9]+")

From 53eed6459a5aa52f5e923fe01b15184b49edae38 Mon Sep 17 00:00:00 2001
From: tarikgul <tariksnow37@gmail.com>
Date: Fri, 11 Sep 2026 10:23:41 -0400
Subject: [PATCH 2/2] ci(ios): re-home the remaining iOS workflows, held on
 dispatch

The last eight, which is every iOS workflow that triggers itself. Four run on
pull_request and four on a schedule, so unlike the first batch they cannot be
moved and left alone: at the repository root they would run, and the build
credentials tracked in #672 are not all in place.

Each live trigger is therefore commented out rather than deleted, with the note
that restoring it is what puts the workflow live. The original filters are
preserved exactly, including the pull_request types and branch lists and the
cron expressions, so going live is a readable diff rather than a rewrite. pr.yml
and release_branch_lifecycle.yml carried only pull_request, so they gain a
workflow_dispatch trigger to stay valid.

Paths get the same treatment as the first batch. Steps that drive the app run
from hosts/ios, artifact and upload paths are prefixed, and the simulator
release writes a root-relative archive path because the release step resolves it
from the workspace.

These files are linted for the first time by moving to the root, so the
pre-existing findings are fixed here: six unquoted GITHUB_ENV and GITHUB_OUTPUT
redirects, and a glob that could be read as options.

Two things deliberately left for the follow-up that restores the triggers. The
branch filters name develop and main from the source repository's branching
model, which does not apply here. And no run has exercised any of this.
---
 .../workflows/ios-collect-prs-summary.yml     |  7 +++-
 .../ios-firebase-debug-distribution.yml       | 40 +++++++++++--------
 .../workflows/ios-nightly-prepare.yml         |  9 +++--
 .../ios-nightly-simulator-release.yml         | 25 +++++++-----
 .../pr.yml => .github/workflows/ios-pr.yml    | 27 ++++++++-----
 .../ios-release-branch-lifecycle.yml          | 12 ++++--
 .../workflows/ios-release-distribution.yml    | 13 +++---
 .../workflows/ios-update-signing-data.yml     | 10 +++--
 8 files changed, 90 insertions(+), 53 deletions(-)
 rename hosts/ios/.github/workflows/collect_prs_summary.yml => .github/workflows/ios-collect-prs-summary.yml (58%)
 rename hosts/ios/.github/workflows/firebase_debug_distribution.yml => .github/workflows/ios-firebase-debug-distribution.yml (83%)
 rename hosts/ios/.github/workflows/nightly_prepare.yml => .github/workflows/ios-nightly-prepare.yml (72%)
 rename hosts/ios/.github/workflows/nightly_simulator_release.yml => .github/workflows/ios-nightly-simulator-release.yml (81%)
 rename hosts/ios/.github/workflows/pr.yml => .github/workflows/ios-pr.yml (87%)
 rename hosts/ios/.github/workflows/release_branch_lifecycle.yml => .github/workflows/ios-release-branch-lifecycle.yml (94%)
 rename hosts/ios/.github/workflows/release_distribution.yml => .github/workflows/ios-release-distribution.yml (88%)
 rename hosts/ios/.github/workflows/update_signing_data.yml => .github/workflows/ios-update-signing-data.yml (69%)

diff --git a/hosts/ios/.github/workflows/collect_prs_summary.yml b/.github/workflows/ios-collect-prs-summary.yml
similarity index 58%
rename from hosts/ios/.github/workflows/collect_prs_summary.yml
rename to .github/workflows/ios-collect-prs-summary.yml
index c4ec31d09..081d3f36b 100644
--- a/hosts/ios/.github/workflows/collect_prs_summary.yml
+++ b/.github/workflows/ios-collect-prs-summary.yml
@@ -8,8 +8,11 @@ on:
         required: false
         default: 30
         type: number
-  schedule:
-    - cron: "0 7 1 * *" # 1st of every month at 08:00 CET (UTC+1)
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     - cron: "0 7 1 * *" # 1st of every month at 08:00 CET (UTC+1)
 
 jobs:
   pr-summary:
diff --git a/hosts/ios/.github/workflows/firebase_debug_distribution.yml b/.github/workflows/ios-firebase-debug-distribution.yml
similarity index 83%
rename from hosts/ios/.github/workflows/firebase_debug_distribution.yml
rename to .github/workflows/ios-firebase-debug-distribution.yml
index 94b68dd56..1a553caf0 100644
--- a/hosts/ios/.github/workflows/firebase_debug_distribution.yml
+++ b/.github/workflows/ios-firebase-debug-distribution.yml
@@ -10,10 +10,13 @@ on:
       releaseNotes:
         description: "Release notes for the distribution"
         required: true
-  pull_request:
-    types: [closed]
-    branches:
-      - develop
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
+#     types: [closed]
+#     branches:
+#       - develop
 
 env:
   IOS_BUNDLE_ID: "io.parity.polkadotapp.develop"
@@ -60,7 +63,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RO_PAT }}
@@ -68,20 +71,21 @@ jobs:
       - name: Set Bundle ID and Profile if triggered by workflow_dispatch
         if: github.event_name == 'workflow_dispatch'
         run: |
-          echo "FIREBASE_GROUPS=${{ inputs.groups }}" >> $GITHUB_ENV
-          echo "RELEASE_NOTES=${{ inputs.releaseNotes }}" >> $GITHUB_ENV
+          echo "FIREBASE_GROUPS=${{ inputs.groups }}" >> "$GITHUB_ENV"
+          echo "RELEASE_NOTES=${{ inputs.releaseNotes }}" >> "$GITHUB_ENV"
 
       - name: Calculate build number
         id: build_number
         run: |
           BUILD_NUMBER=$((10100 + ${{ github.run_number }}))
-          echo "BUILD_NUMBER=${BUILD_NUMBER}" >> $GITHUB_ENV
-          echo "build_number=${BUILD_NUMBER}" >> $GITHUB_OUTPUT
+          echo "BUILD_NUMBER=${BUILD_NUMBER}" >> "$GITHUB_ENV"
+          echo "build_number=${BUILD_NUMBER}" >> "$GITHUB_OUTPUT"
           echo "Calculated build number: ${BUILD_NUMBER}"
 
       - name: Update build number
         env:
           PBXPROJ_PATH: polkadot-app.xcodeproj/project.pbxproj
+        working-directory: hosts/ios
         run: |
           set -euo pipefail
 
@@ -94,6 +98,7 @@ jobs:
         id: read_version
         env:
           PBXPROJ_PATH: polkadot-app.xcodeproj/project.pbxproj
+        working-directory: hosts/ios
         run: |
           set -euo pipefail
 
@@ -101,24 +106,25 @@ jobs:
           MARKETING_VERSION=$(python3 .github/scripts/read_versions.py "${PBXPROJ_PATH}" \
             --config-name "DevCI" \
             --output-format env | grep "marketing_version=" | cut -d'=' -f2)
-          echo "marketing_version=${MARKETING_VERSION}" >> $GITHUB_OUTPUT
-          echo "MARKETING_VERSION=${MARKETING_VERSION}" >> $GITHUB_ENV
+          echo "marketing_version=${MARKETING_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "MARKETING_VERSION=${MARKETING_VERSION}" >> "$GITHUB_ENV"
 
       - name: Add extra Swift flags to xcconfig
         if: matrix.variant.extra_swift_flags != ''
+        working-directory: hosts/ios
         run: |
           python3 .github/scripts/add_swift_flags.py \
             "polkadot-app/Configs/polkadot-app.devci.xcconfig" \
             "${{ matrix.variant.extra_swift_flags }}"
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_DEV_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
@@ -131,6 +137,7 @@ jobs:
           FIREBASE_APP_ID: ${{ secrets.FIREBASE_APP_ID }}
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        working-directory: hosts/ios
         run: |
           bundle exec fastlane distribute_app_to_firebase release_notes:"$FL_RELEASE_NOTES"
 
@@ -139,6 +146,7 @@ jobs:
         env:
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        working-directory: hosts/ios
         run: |
           bundle exec fastlane build_app_ci
 
@@ -147,7 +155,7 @@ jobs:
         if: always()
         with:
           name: polkadot-app-debug-ipa${{ matrix.variant.s3_suffix }}
-          path: "*.ipa"
+          path: "hosts/ios/*.ipa"
           retention-days: 7
 
       - name: Upload to S3
@@ -157,7 +165,7 @@ jobs:
           s3_access_key: ${{ secrets.SCW_ACCESS_KEY }}
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
           destination_path: /ios/develop/polkadot-app-${{ env.MARKETING_VERSION }}-${{ env.BUILD_NUMBER }}${{ matrix.variant.s3_suffix }}.ipa
 
       - name: Upload to S3 (static path)
@@ -167,5 +175,5 @@ jobs:
           s3_access_key: ${{ secrets.SCW_ACCESS_KEY }}
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
           destination_path: /ios/develop/polkadot-app${{ matrix.variant.s3_suffix }}.ipa
diff --git a/hosts/ios/.github/workflows/nightly_prepare.yml b/.github/workflows/ios-nightly-prepare.yml
similarity index 72%
rename from hosts/ios/.github/workflows/nightly_prepare.yml
rename to .github/workflows/ios-nightly-prepare.yml
index 28e4701de..f231df5ca 100644
--- a/hosts/ios/.github/workflows/nightly_prepare.yml
+++ b/.github/workflows/ios-nightly-prepare.yml
@@ -17,8 +17,11 @@ on:
         type: string
         required: false
         default: ""
-  schedule:
-    - cron: "0 16 * * 1-5" # 16:00 UTC Monday-Friday
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     - cron: "0 16 * * 1-5" # 16:00 UTC Monday-Friday
 
 permissions:
   contents: write
@@ -27,7 +30,7 @@ permissions:
 
 jobs:
   prepare:
-    uses: ./.github/workflows/_prepare_pipeline.yml
+    uses: ./.github/workflows/ios-prepare-pipeline.yml
     with:
       is_nightly: true
       bump_level: "no-bump"
diff --git a/hosts/ios/.github/workflows/nightly_simulator_release.yml b/.github/workflows/ios-nightly-simulator-release.yml
similarity index 81%
rename from hosts/ios/.github/workflows/nightly_simulator_release.yml
rename to .github/workflows/ios-nightly-simulator-release.yml
index 8deb1d73e..f5ad1d12c 100644
--- a/hosts/ios/.github/workflows/nightly_simulator_release.yml
+++ b/.github/workflows/ios-nightly-simulator-release.yml
@@ -14,11 +14,14 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  schedule:
-    # 02:30 UTC — runs after the nightly Firebase distribution on develop
-    # (typically completes by ~01:00 UTC after the day's last merge), so
-    # the simulator artifact reflects the same code that Firebase shipped.
-    - cron: "30 2 * * *"
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     # 02:30 UTC — runs after the nightly Firebase distribution on develop
+#     # (typically completes by ~01:00 UTC after the day's last merge), so
+#     # the simulator artifact reflects the same code that Firebase shipped.
+#     - cron: "30 2 * * *"
   workflow_dispatch:
 
 permissions:
@@ -39,21 +42,22 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_RELEASE_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
 
       - name: Build simulator .app
+        working-directory: hosts/ios
         run: bundle exec fastlane build_app_simulator
 
       - name: Compute release tag + name
@@ -71,12 +75,13 @@ jobs:
 
       - name: Zip .app bundle
         id: zip
+        working-directory: hosts/ios
         run: |
           set -euo pipefail
           cd build_simulator
           # `.app` is a directory bundle; zip preserves the structure so
           # consumers can unzip and `xcrun simctl install` the result.
-          APP_DIR=$(ls -d *.app | head -1)
+          APP_DIR=$(ls -d ./*.app | head -1)
           if [ -z "$APP_DIR" ]; then
             echo "::error::No .app directory found under build_simulator/"
             exit 1
@@ -84,7 +89,7 @@ jobs:
           ARCHIVE="polkadot-app-simulator.app.zip"
           zip -ry "$ARCHIVE" "$APP_DIR"
           ls -la "$ARCHIVE"
-          echo "archive=build_simulator/$ARCHIVE" >> "$GITHUB_OUTPUT"
+          echo "archive=hosts/ios/build_simulator/$ARCHIVE" >> "$GITHUB_OUTPUT"
 
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@v2
diff --git a/hosts/ios/.github/workflows/pr.yml b/.github/workflows/ios-pr.yml
similarity index 87%
rename from hosts/ios/.github/workflows/pr.yml
rename to .github/workflows/ios-pr.yml
index 071c169b8..0f41b29f7 100644
--- a/hosts/ios/.github/workflows/pr.yml
+++ b/.github/workflows/ios-pr.yml
@@ -5,7 +5,11 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  pull_request:
+  workflow_dispatch:
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
 
 permissions:
   contents: read
@@ -52,19 +56,19 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RO_PAT }}
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_DEV_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
@@ -73,6 +77,7 @@ jobs:
         env:
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        working-directory: hosts/ios
         run: |
           # Pass debug flag to fastlane if DEBUG_CI is enabled
           if [ "${{ env.DEBUG_CI }}" = "true" ]; then
@@ -87,6 +92,7 @@ jobs:
       - name: Warning ratchet
         id: ratchet
         continue-on-error: true
+        working-directory: hosts/ios
         run: |
           Runscripts/extract_xcresult.sh \
             --out current_warnings.json \
@@ -127,7 +133,7 @@ jobs:
         with:
           name: build-artifacts-${{ github.run_number }}
           path: |
-            ./fastlane/build_logs/
+            hosts/ios/fastlane/build_logs/
           retention-days: 3
 
   test:
@@ -138,21 +144,22 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_DEV_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
 
       - name: Run tests
+        working-directory: hosts/ios
         run: |
           # Pass debug flag to fastlane if DEBUG_CI is enabled
           if [ "${{ env.DEBUG_CI }}" = "true" ]; then
@@ -169,6 +176,6 @@ jobs:
         with:
           name: test-artifacts-${{ github.run_number }}
           path: |
-            ./fastlane/test_output/
-            ./fastlane/build_logs/
+            hosts/ios/fastlane/test_output/
+            hosts/ios/fastlane/build_logs/
           retention-days: 3
diff --git a/hosts/ios/.github/workflows/release_branch_lifecycle.yml b/.github/workflows/ios-release-branch-lifecycle.yml
similarity index 94%
rename from hosts/ios/.github/workflows/release_branch_lifecycle.yml
rename to .github/workflows/ios-release-branch-lifecycle.yml
index 8a78a6089..392173423 100644
--- a/hosts/ios/.github/workflows/release_branch_lifecycle.yml
+++ b/.github/workflows/ios-release-branch-lifecycle.yml
@@ -1,10 +1,14 @@
 name: Release Branch Lifecycle
 
 on:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
+  workflow_dispatch:
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
+#     types: [closed]
+#     branches:
+#       - main
 
 permissions:
   contents: write
diff --git a/hosts/ios/.github/workflows/release_distribution.yml b/.github/workflows/ios-release-distribution.yml
similarity index 88%
rename from hosts/ios/.github/workflows/release_distribution.yml
rename to .github/workflows/ios-release-distribution.yml
index 0488582a5..1e856557c 100644
--- a/hosts/ios/.github/workflows/release_distribution.yml
+++ b/.github/workflows/ios-release-distribution.yml
@@ -1,10 +1,13 @@
 name: Release Distribution
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches:
-      - main
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
+#     types: [opened, synchronize, reopened]
+#     branches:
+#       - main
   workflow_dispatch:
     inputs:
       release_branch:
@@ -30,7 +33,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (startsWith(github.head_ref, 'release/') &&
        !contains(github.event.pull_request.body, 'nightly_build=true'))
-    uses: ./.github/workflows/_build_distribute.yml
+    uses: ./.github/workflows/ios-build-distribute.yml
     with:
       release_branch: ${{ inputs.release_branch || github.head_ref }}
       release_pr_number: ${{ inputs.release_pr_number || github.event.pull_request.number || '' }}
diff --git a/hosts/ios/.github/workflows/update_signing_data.yml b/.github/workflows/ios-update-signing-data.yml
similarity index 69%
rename from hosts/ios/.github/workflows/update_signing_data.yml
rename to .github/workflows/ios-update-signing-data.yml
index a91cb8f87..4f1a4090b 100644
--- a/hosts/ios/.github/workflows/update_signing_data.yml
+++ b/.github/workflows/ios-update-signing-data.yml
@@ -6,8 +6,11 @@ concurrency:
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: "0 10 * * *" # 10:00 AM every day
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     - cron: "0 10 * * *" # 10:00 AM every day
 
 jobs:
   update_signing_data:
@@ -16,12 +19,13 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RW_PAT }}
 
       - name: Update signing data
+        working-directory: hosts/ios
         run: bundle exec fastlane update_signing_data
         env:
           ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}