ci: add publish-cocoapods job to release-publish workflow

[nickolas-dimitrakas]

Summary

The `release-publish` workflow had no step to push the core SDK or kits to CocoaPods trunk after GitHub releases. This adds two jobs to cover both.

Changes

• Adds `publish-cocoapods` job — runs after `release-core-sdk`, pushes `mParticle-Apple-SDK.podspec` to CocoaPods trunk
• Adds `publish-kit-cocoapods` matrix job — runs after `mirror-and-release-kits` and `publish-cocoapods` (core must be on trunk first), pushes each kit's podspec; kits without a `podspec` field in `matrix.json` (e.g. kochava) are skipped
• Both jobs use `COCOAPODS_TRUNK_TOKEN` secret and are skipped when `dry_run: true`

Test plan

• Trigger `release-publish.yml` with `dry_run: true` — confirm both CocoaPods jobs are skipped
• Confirm `COCOAPODS_TRUNK_TOKEN` secret is set in the repo before the next real release
• On a real release, verify core SDK and all kits with podspecs appear on CocoaPods trunk

[cursor]

PR Summary

Medium Risk
Medium risk because it changes the release pipeline to automatically publish to CocoaPods using a short-lived token, where misconfiguration could push incorrect versions or fail releases.

Overview
Adds automatic CocoaPods publishing to the Release – Publish workflow: after the core GitHub release it now pushes mParticle-Apple-SDK.podspec to trunk, and a new matrix job publishes each kit’s podspec (skipping entries without one).

Updates RELEASE.md to reflect the new automated CocoaPods step and emphasize refreshing the COCOAPODS_TRUNK_TOKEN secret before each release, and removes the now-obsolete Scripts/pod_publish.sh manual publishing script.

^{Reviewed by Cursor Bugbot for commit 2d3e273. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

📦 SDK Size Impact Report

Measures how much the SDK adds to an app's size (with-SDK minus without-SDK).

Metric	Target Branch	This PR	Change
App Bundle Impact	1.75 MB	1.75 MB	+N/A
Executable Impact	848 bytes	848 bytes	+N/A
XCFramework Size	6.38 MB	6.38 MB	+N/A

➡️ SDK size impact change is minimal.

Raw measurements

Target branch (main):

{"baseline_app_size_kb":84,"baseline_executable_size_bytes":75464,"with_sdk_app_size_kb":1880,"with_sdk_executable_size_bytes":76312,"sdk_impact_kb":1796,"sdk_executable_impact_bytes":848,"xcframework_size_kb":6532}

This PR:

{"baseline_app_size_kb":84,"baseline_executable_size_bytes":75464,"with_sdk_app_size_kb":1880,"with_sdk_executable_size_bytes":76312,"sdk_impact_kb":1796,"sdk_executable_impact_bytes":848,"xcframework_size_kb":6532}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 2d3e273. Configure here.}

[cursor]

Kit CocoaPods job skipped on manual non-dry-run dispatch

Medium Severity

The if: ${{ !inputs.dry_run }} condition on publish-kit-cocoapods uses the inputs context, where workflow_dispatch boolean inputs are strings ('true'/'false'), not actual booleans. Since 'false' is a non-empty string (truthy), !'false' evaluates to false, causing the entire job to be silently skipped when a user manually triggers the workflow with dry_run unchecked. Every other dry-run guard in this workflow uses the reliable env.DRY_RUN != 'true' pattern at step level, which correctly handles the string representation.

 

^{Reviewed by Cursor Bugbot for commit 2d3e273. Configure here.}