diff --git a/.github/workflows/canary-deploy.yml b/.github/workflows/canary-deploy.yml
index 8dc364b48ba..2613fa84843 100644
--- a/.github/workflows/canary-deploy.yml
+++ b/.github/workflows/canary-deploy.yml
@@ -27,18 +27,72 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # Canary release script requires git history and tags.
         fetch-depth: 0
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Deploy canary
       run: yarn release canary
+      if: ${{
+        env.NPM_TOKEN_ANALYTICS != '' &&
+        env.NPM_TOKEN_ANALYTICS_INTEROP_TYPES != '' &&
+        env.NPM_TOKEN_ANALYTICS_TYPES != '' &&
+        env.NPM_TOKEN_APP != '' &&
+        env.NPM_TOKEN_APP_TYPES != '' &&
+        env.NPM_TOKEN_APP_CHECK != '' &&
+        env.NPM_TOKEN_APP_CHECK_INTEROP_TYPES != '' &&
+        env.NPM_TOKEN_APP_CHECK_TYPES != '' &&
+        env.NPM_TOKEN_AUTH != '' &&
+        env.NPM_TOKEN_AUTH_INTEROP_TYPES != '' &&
+        env.NPM_TOKEN_AUTH_TYPES != '' &&
+        env.NPM_TOKEN_COMPONENT != '' &&
+        env.NPM_TOKEN_DATABASE != '' &&
+        env.NPM_TOKEN_DATABASE_TYPES != '' &&
+        env.NPM_TOKEN_FIRESTORE != '' &&
+        env.NPM_TOKEN_FIRESTORE_TYPES != '' &&
+        env.NPM_TOKEN_FUNCTIONS != '' &&
+        env.NPM_TOKEN_FUNCTIONS_TYPES != '' &&
+        env.NPM_TOKEN_INSTALLATIONS != '' &&
+        env.NPM_TOKEN_INSTALLATIONS_TYPES != '' &&
+        env.NPM_TOKEN_LOGGER != '' &&
+        env.NPM_TOKEN_MESSAGING != '' &&
+        env.NPM_TOKEN_MESSAGING_TYPES != '' &&
+        env.NPM_TOKEN_PERFORMANCE != '' &&
+        env.NPM_TOKEN_PERFORMANCE_TYPES != '' &&
+        env.NPM_TOKEN_POLYFILL != '' &&
+        env.NPM_TOKEN_REMOTE_CONFIG != '' &&
+        env.NPM_TOKEN_REMOTE_CONFIG_TYPES != '' &&
+        env.NPM_TOKEN_RULES_UNIT_TESTING != '' &&
+        env.NPM_TOKEN_STORAGE != '' &&
+        env.NPM_TOKEN_STORAGE_TYPES != '' &&
+        env.NPM_TOKEN_TESTING != '' &&
+        env.NPM_TOKEN_UTIL != '' &&
+        env.NPM_TOKEN_VERTEXAI != '' &&
+        env.NPM_TOKEN_VERTEXAI_PREVIEW != '' &&
+        env.NPM_TOKEN_WEBCHANNEL_WRAPPER != '' &&
+        env.NPM_TOKEN_FIREBASE != '' &&
+        env.NPM_TOKEN_APP_COMPAT != '' &&
+        env.NPM_TOKEN_INSTALLATIONS_COMPAT != '' &&
+        env.NPM_TOKEN_ANALYTICS_COMPAT != '' &&
+        env.NPM_TOKEN_AUTH_COMPAT != '' &&
+        env.NPM_TOKEN_MESSAGING_INTEROP_TYPES != '' &&
+        env.NPM_TOKEN_FUNCTIONS_COMPAT != '' &&
+        env.NPM_TOKEN_MESSAGING_COMPAT != '' &&
+        env.NPM_TOKEN_PERFORMANCE_COMPAT != '' &&
+        env.NPM_TOKEN_REMOTE_CONFIG_COMPAT != '' &&
+        env.NPM_TOKEN_DATABASE_COMPAT != '' &&
+        env.NPM_TOKEN_FIRESTORE_COMPAT != '' &&
+        env.NPM_TOKEN_STORAGE_COMPAT != '' &&
+        env.NPM_TOKEN_APP_CHECK_COMPAT != '' &&
+        env.NPM_TOKEN_API_DOCUMENTER != '' &&
+        true
+        }}
       env:
         NPM_TOKEN_ANALYTICS: ${{secrets.NPM_TOKEN_ANALYTICS}}
         NPM_TOKEN_ANALYTICS_INTEROP_TYPES: ${{secrets.NPM_TOKEN_ANALYTICS_INTEROP_TYPES}}
@@ -94,13 +148,15 @@ jobs:
         CI: true
     - name: Launch E2E tests workflow
       # Trigger e2e-test.yml
+      env:
+        OSS_BOT_GITHUB_TOKEN: ${{ secrets.OSS_BOT_GITHUB_TOKEN }}
+      if: env.OSS_BOT_GITHUB_TOKEN != ''
       run: |
         VERSION_SCRIPT="const pkg = require('./packages/firebase/package.json'); console.log(pkg.version);"
         VERSION_OR_TAG=`node -e "${VERSION_SCRIPT}"`
-        OSS_BOT_GITHUB_TOKEN=${{ secrets.OSS_BOT_GITHUB_TOKEN }}
         curl -X POST \
         -H "Content-Type:application/json" \
         -H "Accept:application/vnd.github.v3+json" \
         -H "Authorization:Bearer $OSS_BOT_GITHUB_TOKEN" \
         -d "{\"event_type\":\"canary-tests\", \"client_payload\":{\"versionOrTag\":\"$VERSION_OR_TAG\"}}" \
-        https://api.github.com/repos/firebase/firebase-js-sdk/dispatches
\ No newline at end of file
+        https://api.github.com/repos/firebase/firebase-js-sdk/dispatches
diff --git a/.github/workflows/check-changeset.yml b/.github/workflows/check-changeset.yml
index ca76fe7a76b..e79291b4283 100644
--- a/.github/workflows/check-changeset.yml
+++ b/.github/workflows/check-changeset.yml
@@ -30,12 +30,12 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # This makes Actions fetch all Git history so check_changeset script can diff properly.
         fetch-depth: 0
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Yarn install
@@ -89,4 +89,4 @@ jobs:
     # Don't want it to throw before editing the comment.
     - name: Fail if checker script logged a blocking failure
       if: ${{steps.check-changeset.outputs.BLOCKING_FAILURE == 'true'}}
-      run: exit 1
\ No newline at end of file
+      run: exit 1
diff --git a/.github/workflows/check-docs.yml b/.github/workflows/check-docs.yml
index aefab2506e3..b33c1678858 100644
--- a/.github/workflows/check-docs.yml
+++ b/.github/workflows/check-docs.yml
@@ -23,12 +23,12 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # get all history for the diff
         fetch-depth: 0
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Yarn install
@@ -39,4 +39,4 @@ jobs:
       run: git diff --exit-code docs-devsite
     - name: Reference documentation needs to be updated. See message below.
       if: ${{ failure() }}
-      run: echo "Changes in this PR affect the reference docs. Run \`yarn docgen devsite\` locally to regenerate docs and add them to this PR."
\ No newline at end of file
+      run: echo "Changes in this PR affect the reference docs. Run \`yarn docgen devsite\` locally to regenerate docs and add them to this PR."
diff --git a/.github/workflows/check-pkg-paths.yml b/.github/workflows/check-pkg-paths.yml
index 8ca54225e10..c1ceb76b09f 100644
--- a/.github/workflows/check-pkg-paths.yml
+++ b/.github/workflows/check-pkg-paths.yml
@@ -23,12 +23,12 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Yarn install
@@ -38,4 +38,4 @@ jobs:
     - name: Swap in public typings
       run: yarn release:prepare
     - name: Check paths
-      run: yarn ts-node scripts/ci-test/check-paths.ts
\ No newline at end of file
+      run: yarn ts-node scripts/ci-test/check-paths.ts
diff --git a/.github/workflows/deploy-config.yml b/.github/workflows/deploy-config.yml
index 3a2d935dd28..a1f28e9e055 100644
--- a/.github/workflows/deploy-config.yml
+++ b/.github/workflows/deploy-config.yml
@@ -31,17 +31,18 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Yarn install
       run: yarn
     - name: Deploy project config if needed
+      if: env.FIREBASE_CLI_TOKEN != ''
       run: yarn ts-node scripts/ci-test/deploy-if-needed.ts
       env:
         FIREBASE_CLI_TOKEN: ${{secrets.FIREBASE_CLI_TOKEN}}
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 80a555f7840..c7f6a2e68ef 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -24,8 +24,33 @@ env:
   NODE_OPTIONS: "--max_old_space_size=4096"
 
 jobs:
+  has-secrets:
+    name: Check for Service Account Key
+    runs-on: ubuntu-latest
+    outputs:
+      has-secrets: ${{ steps.check-secrets.outputs.has-secrets }}
+    steps:
+      - name: Check for Service Account Key
+        id: check-secrets
+        env:
+          HAS_SECRETS: ${{
+            secrets.TEST_PROJECT_CONFIG != '' &&
+            secrets.TEST_ACCOUNT != '' &&
+            secrets.FIREBASE_CLI_TOKEN != '' &&
+            secrets.APP_CHECK_DEBUG_TOKEN != '' &&
+            secrets.JSCORE_CHAT_WEBHOOK_URL != '' &&
+            secrets.RELEASE_TRACKER_URL != '' &&
+            1 ||
+            ''
+            }}
+        if: env.HAS_SECRETS
+        run: |
+          echo "has-secrets=1" >> $GITHUB_OUTPUTS
+
   test:
+    needs: has-secrets
     name: Run E2E Smoke Tests
+    if: needs.has-secrets.outputs.has-secrets
     runs-on: ubuntu-latest
 
     defaults:
@@ -35,9 +60,9 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
       - name: Set up Node (20)
-        uses: actions/setup-node@master
+        uses: actions/setup-node@main
         with:
           node-version: 20.x
       - name: install Chrome stable
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 7434a9cab4c..5ddae0a284c 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -27,12 +27,12 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # get all history for the diff
         fetch-depth: 0
     - name: Set up node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Yarn install
@@ -43,4 +43,4 @@ jobs:
       run: git diff --exit-code
     - name: Formatting needs to be updated. See message below.
       if: ${{ failure() }}
-      run: echo "Something was changed by formatting. Run \`yarn format\` locally to do a prettier/license pass. Use \`yarn format --help\` to see options."
\ No newline at end of file
+      run: echo "Something was changed by formatting. Run \`yarn format\` locally to do a prettier/license pass. Use \`yarn format --help\` to see options."
diff --git a/.github/workflows/health-metrics-pull-request.yml b/.github/workflows/health-metrics-pull-request.yml
index 2148c6d5abf..6f9ec842af5 100644
--- a/.github/workflows/health-metrics-pull-request.yml
+++ b/.github/workflows/health-metrics-pull-request.yml
@@ -33,36 +33,52 @@ env:
   NODE_OPTIONS: "--max-old-space-size=4096"
 
 jobs:
+  has-sa-key:
+    name: Check for Service Account Key
+    runs-on: ubuntu-latest
+    outputs:
+      has-sa-key: ${{ steps.check-key.outputs.has-sa-key }}
+    steps:
+      - name: Check for Service Account Key
+        id: check-key
+        env:
+          HAS_SA_KEY: ${{ secrets.GCP_SA_KEY != '' && 1 || '' }}
+        if: env.HAS_SA_KEY
+        run: |
+          echo "has-sa-key=1" >> $GITHUB_OUTPUTS
+
   binary-size:
+    needs: has-sa-key
     name: Binary Size
-    if: (github.event_name == 'push' || !(github.event.pull_request.head.repo.fork)) && (github.actor != 'dependabot[bot]')
+    if: needs.has-sa-key.outputs.has-sa-key && (github.event_name == 'push' || !(github.event.pull_request.head.repo.fork)) && (github.actor != 'dependabot[bot]')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 20.x
-      - uses: 'google-github-actions/auth@v0'
+      - uses: 'google-github-actions/auth@v1'
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'
-      - uses: google-github-actions/setup-gcloud@v0
+      - uses: google-github-actions/setup-gcloud@v1
       - run: yarn install
       - run: yarn build
       - name: Run health-metrics/binary-size test
         run: yarn size-report
   modular-export-size:
+    needs: has-sa-key
     name: Binary Size For Modular Exports
-    if: (github.event_name == 'push' || !(github.event.pull_request.head.repo.fork)) && (github.actor != 'dependabot[bot]')
+    if: needs.has-sa-key.outputs.has-sa-key && (github.event_name == 'push' || !(github.event.pull_request.head.repo.fork)) && (github.actor != 'dependabot[bot]')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 20.x
-      - uses: 'google-github-actions/auth@v0'
+      - uses: google-github-actions/auth@v1
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'
-      - uses: google-github-actions/setup-gcloud@v0
+      - uses: google-github-actions/setup-gcloud@v1
       - run: yarn install
       - run: yarn build
       - name: Run health-metrics/modular-exports-binary-size test
diff --git a/.github/workflows/health-metrics-release.yml b/.github/workflows/health-metrics-release.yml
index 1fbb9b4d4a1..f646b9dc146 100644
--- a/.github/workflows/health-metrics-release.yml
+++ b/.github/workflows/health-metrics-release.yml
@@ -19,14 +19,30 @@ on:
     tags: ['**']
 
 jobs:
+  has-sa-key:
+    name: Check for Service Account Key
+    runs-on: ubuntu-latest
+    outputs:
+      has-sa-key: ${{ steps.check-key.outputs.has-sa-key }}
+    steps:
+      - name: Check for Service Account Key
+        id: check-key
+        env:
+          HAS_SA_KEY: ${{ secrets.GCP_SA_KEY != '' && 1 || '' }}
+        if: env.HAS_SA_KEY
+        run: |
+          echo "has-sa-key=1" >> $GITHUB_OUTPUTS
+
   release-diffing:
+    needs: has-sa-key
     name: Release Diffing
+    if: needs.has-sa-key.outputs.has-sa-key
     runs-on: ubuntu-latest
     steps:
-      - uses: 'google-github-actions/auth@v0'
+      - uses: google-github-actions/auth@v1
         with:
           credentials_json: '${{ secrets.GCP_SA_KEY }}'
-      - uses: google-github-actions/setup-gcloud@v0
+      - uses: google-github-actions/setup-gcloud@v1
       - uses: FirebaseExtended/github-actions/health-metrics/release-diffing@master
         with:
           repo: ${{ github.repository }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 80851d9834a..d7ac19d3d0b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Set up node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: yarn install
diff --git a/.github/workflows/merge-release-branch.yml b/.github/workflows/merge-release-branch.yml
index 06f4f15a119..08b832b3dc5 100644
--- a/.github/workflows/merge-release-branch.yml
+++ b/.github/workflows/merge-release-branch.yml
@@ -24,7 +24,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout Release Branch
-        uses: actions/checkout@master
+        uses: actions/checkout@main
         with:
           ref: release
       - name: Get release version
@@ -39,7 +39,7 @@ jobs:
       - name: Merge to master
         uses: actions/github-script@v6
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ github.token }}
           script: |
             github.rest.repos.merge({
               owner: context.repo.owner,
diff --git a/.github/workflows/prerelease-manual-deploy.yml b/.github/workflows/prerelease-manual-deploy.yml
index a1dfc08d847..f0bf950f934 100644
--- a/.github/workflows/prerelease-manual-deploy.yml
+++ b/.github/workflows/prerelease-manual-deploy.yml
@@ -30,18 +30,72 @@ jobs:
     
         steps:
         - name: Checkout Repo
-          uses: actions/checkout@master
+          uses: actions/checkout@main
           with:
             # Canary release script requires git history and tags.
             fetch-depth: 0
         - name: Set up node (20)
-          uses: actions/setup-node@v3
+          uses: actions/setup-node@v4
           with:
             node-version: 20.x
         - name: Yarn install
           run: yarn
         - name: Deploy prerelease
           run: yarn release custom -p ${{ github.event.inputs.prereleaseName }} -t ${{ github.event.inputs.npmTag }}
+          if: ${{
+            env.NPM_TOKEN_ANALYTICS != '' &&
+            env.NPM_TOKEN_ANALYTICS_INTEROP_TYPES != '' &&
+            env.NPM_TOKEN_ANALYTICS_TYPES != '' &&
+            env.NPM_TOKEN_APP != '' &&
+            env.NPM_TOKEN_APP_TYPES != '' &&
+            env.NPM_TOKEN_APP_CHECK != '' &&
+            env.NPM_TOKEN_APP_CHECK_INTEROP_TYPES != '' &&
+            env.NPM_TOKEN_APP_CHECK_TYPES != '' &&
+            env.NPM_TOKEN_AUTH != '' &&
+            env.NPM_TOKEN_AUTH_INTEROP_TYPES != '' &&
+            env.NPM_TOKEN_AUTH_TYPES != '' &&
+            env.NPM_TOKEN_COMPONENT != '' &&
+            env.NPM_TOKEN_DATABASE != '' &&
+            env.NPM_TOKEN_DATABASE_TYPES != '' &&
+            env.NPM_TOKEN_FIRESTORE != '' &&
+            env.NPM_TOKEN_FIRESTORE_TYPES != '' &&
+            env.NPM_TOKEN_FUNCTIONS != '' &&
+            env.NPM_TOKEN_FUNCTIONS_TYPES != '' &&
+            env.NPM_TOKEN_INSTALLATIONS != '' &&
+            env.NPM_TOKEN_INSTALLATIONS_TYPES != '' &&
+            env.NPM_TOKEN_LOGGER != '' &&
+            env.NPM_TOKEN_MESSAGING != '' &&
+            env.NPM_TOKEN_MESSAGING_TYPES != '' &&
+            env.NPM_TOKEN_PERFORMANCE != '' &&
+            env.NPM_TOKEN_PERFORMANCE_TYPES != '' &&
+            env.NPM_TOKEN_POLYFILL != '' &&
+            env.NPM_TOKEN_REMOTE_CONFIG != '' &&
+            env.NPM_TOKEN_REMOTE_CONFIG_TYPES != '' &&
+            env.NPM_TOKEN_RULES_UNIT_TESTING != '' &&
+            env.NPM_TOKEN_STORAGE != '' &&
+            env.NPM_TOKEN_STORAGE_TYPES != '' &&
+            env.NPM_TOKEN_TESTING != '' &&
+            env.NPM_TOKEN_UTIL != '' &&
+            env.NPM_TOKEN_VERTEXAI != '' &&
+            env.NPM_TOKEN_VERTEXAI_PREVIEW != '' &&
+            env.NPM_TOKEN_WEBCHANNEL_WRAPPER != '' &&
+            env.NPM_TOKEN_FIREBASE != '' &&
+            env.NPM_TOKEN_APP_COMPAT != '' &&
+            env.NPM_TOKEN_INSTALLATIONS_COMPAT != '' &&
+            env.NPM_TOKEN_ANALYTICS_COMPAT != '' &&
+            env.NPM_TOKEN_AUTH_COMPAT != '' &&
+            env.NPM_TOKEN_MESSAGING_INTEROP_TYPES != '' &&
+            env.NPM_TOKEN_FUNCTIONS_COMPAT != '' &&
+            env.NPM_TOKEN_MESSAGING_COMPAT != '' &&
+            env.NPM_TOKEN_PERFORMANCE_COMPAT != '' &&
+            env.NPM_TOKEN_REMOTE_CONFIG_COMPAT != '' &&
+            env.NPM_TOKEN_DATABASE_COMPAT != '' &&
+            env.NPM_TOKEN_FIRESTORE_COMPAT != '' &&
+            env.NPM_TOKEN_STORAGE_COMPAT != '' &&
+            env.NPM_TOKEN_APP_CHECK_COMPAT != '' &&
+            env.NPM_TOKEN_API_DOCUMENTER != '' &&
+            true
+            }}
           env:
             NPM_TOKEN_ANALYTICS: ${{secrets.NPM_TOKEN_ANALYTICS}}
             NPM_TOKEN_ANALYTICS_INTEROP_TYPES: ${{secrets.NPM_TOKEN_ANALYTICS_INTEROP_TYPES}}
diff --git a/.github/workflows/release-log.yml b/.github/workflows/release-log.yml
index 780e3e97b52..761a8f148aa 100644
--- a/.github/workflows/release-log.yml
+++ b/.github/workflows/release-log.yml
@@ -26,14 +26,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
 
       - name: Setup Node.js 20.x
-        uses: actions/setup-node@master
+        uses: actions/setup-node@main
         with:
           node-version: 20.x
 
       - name: Get PR number and send to tracker.
+        if: env.RELEASE_TRACKER_URL != ''
         run: node scripts/ci/log-changesets.js
         env:
           RELEASE_TRACKER_URL: ${{ secrets.RELEASE_TRACKER_URL }}
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 04ebbd8b926..d25613dffe8 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -27,13 +27,13 @@ jobs:
     if: ${{ !startsWith(github.event.head_commit.message, 'Version Packages (#') }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
         with:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
 
       - name: Setup Node.js 20.x
-        uses: actions/setup-node@master
+        uses: actions/setup-node@main
         with:
           node-version: 20.x
 
@@ -50,5 +50,6 @@ jobs:
 
       - name: Create Release Pull Request
         uses: changesets/action@v1
+        if: env.GITHUB_TOKEN != ''
         env:
           GITHUB_TOKEN: ${{ secrets.OSS_BOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/release-prod.yml b/.github/workflows/release-prod.yml
index d0c3de16859..0bbe752730f 100644
--- a/.github/workflows/release-prod.yml
+++ b/.github/workflows/release-prod.yml
@@ -24,8 +24,80 @@ on:
         required: true
 
 jobs:
+  has-secrets:
+    name: Check for secrets
+    runs-on: ubuntu-latest
+    outputs:
+      has-secrets: ${{ steps.check-secrets.outputs.has-secrets }}
+    steps:
+      - name: Check for secrets
+        id: check-secrets
+        env:
+          HAS_SECRETS: ${{
+            secrets.NPM_TOKEN_ANALYTICS != '' &&
+            secrets.NPM_TOKEN_ANALYTICS_COMPAT != '' &&
+            secrets.NPM_TOKEN_ANALYTICS_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_ANALYTICS_TYPES != '' &&
+            secrets.NPM_TOKEN_API_DOCUMENTER != '' &&
+            secrets.NPM_TOKEN_APP != '' &&
+            secrets.NPM_TOKEN_APP_CHECK != '' &&
+            secrets.NPM_TOKEN_APP_CHECK_COMPAT != '' &&
+            secrets.NPM_TOKEN_APP_CHECK_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_APP_CHECK_TYPES != '' &&
+            secrets.NPM_TOKEN_APP_COMPAT != '' &&
+            secrets.NPM_TOKEN_APP_TYPES != '' &&
+            secrets.NPM_TOKEN_AUTH != '' &&
+            secrets.NPM_TOKEN_AUTH_COMPAT != '' &&
+            secrets.NPM_TOKEN_AUTH_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_AUTH_TYPES != '' &&
+            secrets.NPM_TOKEN_COMPONENT != '' &&
+            secrets.NPM_TOKEN_DATABASE != '' &&
+            secrets.NPM_TOKEN_DATABASE_COMPAT != '' &&
+            secrets.NPM_TOKEN_DATABASE_TYPES != '' &&
+            secrets.NPM_TOKEN_FIREBASE != '' &&
+            secrets.NPM_TOKEN_FIRESTORE != '' &&
+            secrets.NPM_TOKEN_FIRESTORE_COMPAT != '' &&
+            secrets.NPM_TOKEN_FIRESTORE_TYPES != '' &&
+            secrets.NPM_TOKEN_FUNCTIONS != '' &&
+            secrets.NPM_TOKEN_FUNCTIONS_COMPAT != '' &&
+            secrets.NPM_TOKEN_FUNCTIONS_TYPES != '' &&
+            secrets.NPM_TOKEN_INSTALLATIONS != '' &&
+            secrets.NPM_TOKEN_INSTALLATIONS_COMPAT != '' &&
+            secrets.NPM_TOKEN_INSTALLATIONS_TYPES != '' &&
+            secrets.NPM_TOKEN_LOGGER != '' &&
+            secrets.NPM_TOKEN_MESSAGING != '' &&
+            secrets.NPM_TOKEN_MESSAGING_COMPAT != '' &&
+            secrets.NPM_TOKEN_MESSAGING_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_MESSAGING_TYPES != '' &&
+            secrets.NPM_TOKEN_PERFORMANCE != '' &&
+            secrets.NPM_TOKEN_PERFORMANCE_COMPAT != '' &&
+            secrets.NPM_TOKEN_PERFORMANCE_TYPES != '' &&
+            secrets.NPM_TOKEN_POLYFILL != '' &&
+            secrets.NPM_TOKEN_REMOTE_CONFIG != '' &&
+            secrets.NPM_TOKEN_REMOTE_CONFIG_COMPAT != '' &&
+            secrets.NPM_TOKEN_REMOTE_CONFIG_TYPES != '' &&
+            secrets.NPM_TOKEN_RULES_UNIT_TESTING != '' &&
+            secrets.NPM_TOKEN_STORAGE != '' &&
+            secrets.NPM_TOKEN_STORAGE_COMPAT != '' &&
+            secrets.NPM_TOKEN_STORAGE_TYPES != '' &&
+            secrets.NPM_TOKEN_TESTING != '' &&
+            secrets.NPM_TOKEN_UTIL != '' &&
+            secrets.NPM_TOKEN_VERTEXAI != '' &&
+            secrets.NPM_TOKEN_VERTEXAI_PREVIEW != '' &&
+            secrets.NPM_TOKEN_WEBCHANNEL_WRAPPER != '' &&
+            secrets.OSS_BOT_GITHUB_TOKEN != '' &&
+            secrets.RELEASE_TRACKER_URL != '' &&
+            1 ||
+            ''
+            }}
+        if: env.HAS_SECRETS
+        run: |
+          echo "has-secrets=1" >> $GITHUB_OUTPUTS
+
   deploy:
+    needs: has-secrets
     name: Production Release
+    if: needs.has-secrets.outputs.has-secrets
     runs-on: ubuntu-latest
     # Allow GITHUB_TOKEN to have write permissions
     permissions:
@@ -33,11 +105,11 @@ jobs:
 
     steps:
     - name: Set up node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Checkout release branch (with history)
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # Release script requires git history and tags.
         fetch-depth: 0
@@ -126,7 +198,7 @@ jobs:
         $RELEASE_TRACKER_URL/logProduction
     - name: Create Github release
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
         # Get the newest release tag for the firebase package (e.g. firebase@10.12.0)
         NEWEST_TAG=$(git describe --tags --match "firebase@[0-9]*.[0-9]*.[0-9]*" --abbrev=0)
diff --git a/.github/workflows/release-staging.yml b/.github/workflows/release-staging.yml
index 32eca1f036d..5fe366a50e9 100644
--- a/.github/workflows/release-staging.yml
+++ b/.github/workflows/release-staging.yml
@@ -40,14 +40,86 @@ env:
   NODE_OPTIONS: "--max_old_space_size=4096"
 
 jobs:
+  has-secrets:
+    name: Check for secrets
+    runs-on: ubuntu-latest
+    outputs:
+      has-secrets: ${{ steps.check-secrets.outputs.has-secrets }}
+    steps:
+      - name: Check for secrets
+        id: check-secrets
+        env:
+          HAS_SECRETS: ${{
+            secrets.NPM_TOKEN_ANALYTICS != '' &&
+            secrets.NPM_TOKEN_ANALYTICS_COMPAT != '' &&
+            secrets.NPM_TOKEN_ANALYTICS_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_ANALYTICS_TYPES != '' &&
+            secrets.NPM_TOKEN_API_DOCUMENTER != '' &&
+            secrets.NPM_TOKEN_APP != '' &&
+            secrets.NPM_TOKEN_APP_CHECK != '' &&
+            secrets.NPM_TOKEN_APP_CHECK_COMPAT != '' &&
+            secrets.NPM_TOKEN_APP_CHECK_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_APP_CHECK_TYPES != '' &&
+            secrets.NPM_TOKEN_APP_COMPAT != '' &&
+            secrets.NPM_TOKEN_APP_TYPES != '' &&
+            secrets.NPM_TOKEN_AUTH != '' &&
+            secrets.NPM_TOKEN_AUTH_COMPAT != '' &&
+            secrets.NPM_TOKEN_AUTH_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_AUTH_TYPES != '' &&
+            secrets.NPM_TOKEN_COMPONENT != '' &&
+            secrets.NPM_TOKEN_DATABASE != '' &&
+            secrets.NPM_TOKEN_DATABASE_COMPAT != '' &&
+            secrets.NPM_TOKEN_DATABASE_TYPES != '' &&
+            secrets.NPM_TOKEN_FIREBASE != '' &&
+            secrets.NPM_TOKEN_FIRESTORE != '' &&
+            secrets.NPM_TOKEN_FIRESTORE_COMPAT != '' &&
+            secrets.NPM_TOKEN_FIRESTORE_TYPES != '' &&
+            secrets.NPM_TOKEN_FUNCTIONS != '' &&
+            secrets.NPM_TOKEN_FUNCTIONS_COMPAT != '' &&
+            secrets.NPM_TOKEN_FUNCTIONS_TYPES != '' &&
+            secrets.NPM_TOKEN_INSTALLATIONS != '' &&
+            secrets.NPM_TOKEN_INSTALLATIONS_COMPAT != '' &&
+            secrets.NPM_TOKEN_INSTALLATIONS_TYPES != '' &&
+            secrets.NPM_TOKEN_LOGGER != '' &&
+            secrets.NPM_TOKEN_MESSAGING != '' &&
+            secrets.NPM_TOKEN_MESSAGING_COMPAT != '' &&
+            secrets.NPM_TOKEN_MESSAGING_INTEROP_TYPES != '' &&
+            secrets.NPM_TOKEN_MESSAGING_TYPES != '' &&
+            secrets.NPM_TOKEN_PERFORMANCE != '' &&
+            secrets.NPM_TOKEN_PERFORMANCE_COMPAT != '' &&
+            secrets.NPM_TOKEN_PERFORMANCE_TYPES != '' &&
+            secrets.NPM_TOKEN_POLYFILL != '' &&
+            secrets.NPM_TOKEN_REMOTE_CONFIG != '' &&
+            secrets.NPM_TOKEN_REMOTE_CONFIG_COMPAT != '' &&
+            secrets.NPM_TOKEN_REMOTE_CONFIG_TYPES != '' &&
+            secrets.NPM_TOKEN_RULES_UNIT_TESTING != '' &&
+            secrets.NPM_TOKEN_STORAGE != '' &&
+            secrets.NPM_TOKEN_STORAGE_COMPAT != '' &&
+            secrets.NPM_TOKEN_STORAGE_TYPES != '' &&
+            secrets.NPM_TOKEN_TESTING != '' &&
+            secrets.NPM_TOKEN_UTIL != '' &&
+            secrets.NPM_TOKEN_VERTEXAI != '' &&
+            secrets.NPM_TOKEN_VERTEXAI_PREVIEW != '' &&
+            secrets.NPM_TOKEN_WEBCHANNEL_WRAPPER != '' &&
+            secrets.OSS_BOT_GITHUB_TOKEN != '' &&
+            secrets.OSS_BOT_GITHUB_TOKEN != '' &&
+            secrets.RELEASE_TRACKER_URL != '' &&
+            1 ||
+            ''
+            }}
+        if: env.HAS_SECRETS
+        run: |
+          echo "has-secrets=1" >> $GITHUB_OUTPUTS
+
   deploy:
+    needs: has-secrets
     name: Staging Release
     runs-on: ubuntu-latest
     # Block this workflow if run on a non-release branch.
-    if: github.event.inputs.release-branch == 'release' || endsWith(github.event.inputs.release-branch, '-releasebranch')
+    if: needs.has-secrets.outputs.has-secrets && (github.event.inputs.release-branch == 'release' || endsWith(github.event.inputs.release-branch, '-releasebranch'))
     steps:
     - name: Set up node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Merge master into release
@@ -63,7 +135,7 @@ jobs:
           })
           console.log(result)
     - name: Checkout current branch (with history)
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # Release script requires git history and tags.
         fetch-depth: 0
@@ -78,7 +150,7 @@ jobs:
       # TODO: Make these flags defaults in the release script.
       run: yarn release --releaseType Staging --ci --skipTests --skipReinstall --ignoreUnstaged
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ github.token }}
         NPM_TOKEN_ANALYTICS: ${{secrets.NPM_TOKEN_ANALYTICS}}
         NPM_TOKEN_ANALYTICS_INTEROP_TYPES: ${{secrets.NPM_TOKEN_ANALYTICS_INTEROP_TYPES}}
         NPM_TOKEN_ANALYTICS_TYPES: ${{secrets.NPM_TOKEN_ANALYTICS_TYPES}}
diff --git a/.github/workflows/release-tweet.yml b/.github/workflows/release-tweet.yml
index edd2634637b..6d408207776 100644
--- a/.github/workflows/release-tweet.yml
+++ b/.github/workflows/release-tweet.yml
@@ -33,9 +33,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
       - name: Setup Node.js 20.x
-        uses: actions/setup-node@master
+        uses: actions/setup-node@main
         with:
           node-version: 20.x
       - name: Poll release notes page on devsite
@@ -45,6 +45,14 @@ jobs:
           FORCE_PUBLISH: ${{ github.event.inputs.force }}
       - name: Post to Twitter
         uses: firebase/firebase-admin-node/.github/actions/send-tweet@master
+        if: ${{
+          env.consumer-key != '' &&
+          env.consumer-secret != '' &&
+          env.access-token != '' &&
+          env.access-token-secret != '' &&
+          1 ||
+          ''
+          }}
         with:
           status: >
             v${{github.event.inputs.version}} of @Firebase JavaScript client for Web / Node.js is available.
@@ -52,4 +60,4 @@ jobs:
           consumer-key: ${{ secrets.TWITTER_CONSUMER_KEY }}
           consumer-secret: ${{ secrets.TWITTER_CONSUMER_SECRET }}
           access-token: ${{ secrets.TWITTER_ACCESS_TOKEN }}
-          access-token-secret: ${{ secrets.TWITTER_ACCESS_TOKEN_SECRET }}
\ No newline at end of file
+          access-token-secret: ${{ secrets.TWITTER_ACCESS_TOKEN_SECRET }}
diff --git a/.github/workflows/test-all.yml b/.github/workflows/test-all.yml
index 2264ab233fd..3ddb7800dd5 100644
--- a/.github/workflows/test-all.yml
+++ b/.github/workflows/test-all.yml
@@ -39,9 +39,9 @@ jobs:
     - name: install Chrome stable
       run: |
         npx @puppeteer/browsers install chrome@stable
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Test setup and yarn install
@@ -57,7 +57,7 @@ jobs:
         gzip build.tar
     - name: Upload build archive
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
           name: build.tar.gz
           path: build.tar.gz
@@ -74,13 +74,13 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - name: Download build archive
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Test setup and yarn install
@@ -101,7 +101,7 @@ jobs:
     - name: Run coverage
       uses: coverallsapp/github-action@master
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        github-token: ${{ github.token }}
         path-to-lcov: ./lcov-all.info
       continue-on-error: true
 
@@ -125,13 +125,13 @@ jobs:
       run: |
         echo $CHROME_VERSION_NOTES=$CHROME_VERSION_MISMATCH_MESSAGE
     - name: Download build archive
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Test setup and yarn install
@@ -151,7 +151,7 @@ jobs:
     - name: Run coverage
       uses: coverallsapp/github-action@master
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        github-token: ${{ github.token }}
         path-to-lcov: ./lcov-all.info
       continue-on-error: true
 
@@ -165,13 +165,13 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - name: Download build archive
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Test setup and yarn install
@@ -192,7 +192,7 @@ jobs:
     - name: Run coverage
       uses: coverallsapp/github-action@master
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        github-token: ${{ github.token }}
         path-to-lcov: ./lcov-all.info
       continue-on-error: true
   test-firestore-integration:
@@ -209,13 +209,13 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - name: Download build archive
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: build.tar.gz
     - name: Unzip build artifact
       run: tar xf build.tar.gz
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - run: cp config/ci.config.json config/project.json
diff --git a/.github/workflows/test-changed-auth.yml b/.github/workflows/test-changed-auth.yml
index 03674485c7f..52ba6ea93b9 100644
--- a/.github/workflows/test-changed-auth.yml
+++ b/.github/workflows/test-changed-auth.yml
@@ -52,12 +52,12 @@ jobs:
         run: |
          echo $CHROME_VERSION_NOTES=$CHROME_VERSION_MISMATCH_MESSAGE
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: Test setup and yarn install
@@ -84,12 +84,12 @@ jobs:
           sudo apt-get install wget
 
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: Test setup and yarn install
diff --git a/.github/workflows/test-changed-fcm-integration.yml b/.github/workflows/test-changed-fcm-integration.yml
deleted file mode 100644
index affb4639b1b..00000000000
--- a/.github/workflows/test-changed-fcm-integration.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-# Copyright 2023 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: Test FCM integration
-
-on: pull_request
-
-env:
-  # make chromedriver detect installed Chrome version and download the corresponding driver
-  DETECT_CHROMEDRIVER_VERSION: true
-  # Bump Node memory limit
-  NODE_OPTIONS: "--max_old_space_size=4096"
-
-jobs:
-  test:
-    name: Test FCM integration If Changed
-    runs-on: ubuntu-latest
-
-    steps:
-    # install Chrome first, so the correct version of webdriver can be installed by chromedriver when setting up the repo
-    - name: install Chrome stable
-      run: |
-        sudo apt-get update
-        sudo apt-get install google-chrome-stable
-    - name: Checkout Repo
-      uses: actions/checkout@master
-      with:
-        # This makes Actions fetch all Git history so run-changed script can diff properly.
-        fetch-depth: 0
-    - name: Set up Node (20)
-      uses: actions/setup-node@v3
-      with:
-        node-version: 20.x
-    - name: Test setup and yarn install
-      run: |
-        cp config/ci.config.json config/project.json
-        yarn
-    - name: build
-      run: yarn build:changed fcm-integration
-    - name: Run tests if FCM or its dependencies has changed
-      run: xvfb-run yarn test:changed fcm-integration
diff --git a/.github/workflows/test-changed-firestore-integration.yml b/.github/workflows/test-changed-firestore-integration.yml
index 85e9c7e3eaa..0add99f3844 100644
--- a/.github/workflows/test-changed-firestore-integration.yml
+++ b/.github/workflows/test-changed-firestore-integration.yml
@@ -21,19 +21,35 @@ env:
   NODE_OPTIONS: "--max_old_space_size=4096"
 
 jobs:
+  has-sa-key:
+    name: Check for Service Account Key
+    runs-on: ubuntu-latest
+    outputs:
+      has-sa-key: ${{ steps.check-key.outputs.has-sa-key }}
+    steps:
+      - name: Check for Service Account Key
+        id: check-key
+        env:
+          HAS_SA_KEY: ${{ secrets.JSSDK_ACTIONS_SA_KEY != '' && 1 || '' }}
+        if: env.HAS_SA_KEY
+        run: |
+          echo "has-sa-key=1" >> $GITHUB_OUTPUTS
+
   test:
+    needs: has-sa-key
     name: Test Firestore Integration If Changed
+    if: needs.has-sa-key.outputs.has-sa-key
     runs-on: ubuntu-latest
     env:
         run_terraform_steps: ${{ secrets.JSSDK_ACTIONS_SA_KEY != '' }}
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
-    - uses: 'google-github-actions/auth@v0'
+    - uses: google-github-actions/auth@v1
       if: ${{ fromJSON(env.run_terraform_steps) }}
       with:
         credentials_json: '${{ secrets.JSSDK_ACTIONS_SA_KEY }}'
@@ -69,7 +85,7 @@ jobs:
       continue-on-error: true
 
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: install Chrome stable
diff --git a/.github/workflows/test-changed-firestore.yml b/.github/workflows/test-changed-firestore.yml
index 9f241898e0e..6ba2b161c11 100644
--- a/.github/workflows/test-changed-firestore.yml
+++ b/.github/workflows/test-changed-firestore.yml
@@ -33,12 +33,12 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: install Chrome stable
@@ -72,7 +72,7 @@ jobs:
           gzip build.tar
       - name: Upload build archive
         if: ${{ !cancelled() && steps.build.outcome == 'success' && steps.check-changed.outcome != 'success' }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: build.tar.gz
           path: build.tar.gz
@@ -85,7 +85,7 @@ jobs:
     if: ${{ needs.build.outputs.changed == 'true'}}
     steps:
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: install Chrome stable
@@ -93,7 +93,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install google-chrome-stable
       - name: Download build archive
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: build.tar.gz
       - name: Unzip build artifact
@@ -113,7 +113,7 @@ jobs:
     if: ${{ needs.build.outputs.changed == 'true'}}
     steps:
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: install Chrome stable
@@ -121,7 +121,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install google-chrome-stable
       - name: Download build archive
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: build.tar.gz
       - name: Unzip build artifact
@@ -143,7 +143,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' }}
     steps:
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: install Chrome stable
@@ -151,7 +151,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install google-chrome-stable
       - name: Download build archive
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: build.tar.gz
       - name: Unzip build artifact
@@ -181,11 +181,11 @@ jobs:
           sudo apt-get update
           sudo apt-get install firefox
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: Download build archive
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: build.tar.gz
       - name: Unzip build artifact
@@ -214,13 +214,13 @@ jobs:
           sudo apt-get update
           sudo apt-get install firefox
       - name: Download build archive
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: build.tar.gz
       - name: Unzip build artifact
         run: tar xf build.tar.gz
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: Test setup and yarn install
diff --git a/.github/workflows/test-changed-misc.yml b/.github/workflows/test-changed-misc.yml
index e189ff4fecf..9b396227094 100644
--- a/.github/workflows/test-changed-misc.yml
+++ b/.github/workflows/test-changed-misc.yml
@@ -27,12 +27,12 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: install Chrome stable
@@ -48,4 +48,4 @@ jobs:
     - name: Run tests
       run: yarn test:changed misc
       env:
-        FIREBASE_TOKEN: ${{ secrets.FIREBASE_CLI_TOKEN }}
\ No newline at end of file
+        FIREBASE_TOKEN: ${{ secrets.FIREBASE_CLI_TOKEN }}
diff --git a/.github/workflows/test-changed.yml b/.github/workflows/test-changed.yml
index ac45286b0c8..dc2ba5f0498 100644
--- a/.github/workflows/test-changed.yml
+++ b/.github/workflows/test-changed.yml
@@ -27,12 +27,12 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: install Chrome stable
@@ -57,11 +57,11 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@master
+        uses: actions/checkout@main
         with:
           fetch-depth: 0
       - name: Set up Node (20)
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
       - name: install Firefox stable
diff --git a/.github/workflows/test-firebase-integration.yml b/.github/workflows/test-firebase-integration.yml
index f6b1eb3c4b3..0173de73c9b 100644
--- a/.github/workflows/test-firebase-integration.yml
+++ b/.github/workflows/test-firebase-integration.yml
@@ -27,12 +27,12 @@ jobs:
 
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
     - name: Set up Node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: install Chrome stable
@@ -46,4 +46,4 @@ jobs:
     - name: build
       run: yarn build:changed firebase-integration
     - name: Run tests on changed packages
-      run: yarn test:changed firebase-integration
\ No newline at end of file
+      run: yarn test:changed firebase-integration
diff --git a/.github/workflows/update-api-reports.yml b/.github/workflows/update-api-reports.yml
index f49c548e3cc..8a190ad2a8f 100644
--- a/.github/workflows/update-api-reports.yml
+++ b/.github/workflows/update-api-reports.yml
@@ -25,13 +25,13 @@ jobs:
       contents: write
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@main
       with:
         # checkout HEAD commit instead of merge commit
-        ref: ${{ github.event.pull_request.head.ref }}
+        ref: refs/pull/${{ github.event.pull_request.number }}/head
         token: ${{ github.token }}
     - name: Set up node (20)
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
     - name: Yarn install
@@ -45,4 +45,4 @@ jobs:
       with:
         add: 'common/api-review/*'
         message: 'Update API reports'
-        default_author: github_actor
\ No newline at end of file
+        default_author: github_actor