Speaking as a contract manufacturer - yes, it is common. No, you don't have to share. That's a business decision.
What I usually do when I get a request for that is summarize the finding(s) and say that we do not share inspection reports outside of the company.
If you got a warning letter, that's public knowledge and can be looked up.