菜单
Build and release mobile apps from GitHub Actions — macOS runners, AAB/IPA artifacts, signing secrets, and tag-triggered deploys. Use this when GitHub Actions is the CI of record.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use Apple's phased release for automatic updates on iOS — behavior, pausing, resuming, and interaction with manual updates. Use this when shipping production iOS builds.
Use Play percentage rollouts and iOS phased release to limit blast radius. Use this when planning or operating a production release.
Generate keystores, enrol in Play App Signing, and understand v1/v2/v3/v4 APK signature schemes. Use this when setting up Android release signing.
Diagnose and fix common Apple and Google code-signing errors. Use this when a release build fails to sign, upload, or install.
Manage Apple certificates, provisioning profiles, automatic vs manual signing, and fastlane match. Use this when setting up iOS release signing.
Publish Android apps to Amazon Appstore, Huawei AppGallery, Samsung Galaxy Store, and deal with HMS vs GMS. Use this when targeting non-Google Android markets.
| name | github-actions-mobile-release |
| description | Build and release mobile apps from GitHub Actions — macOS runners, AAB/IPA artifacts, signing secrets, and tag-triggered deploys. Use this when GitHub Actions is the CI of record. |
GitHub Actions is the default CI for many mobile teams because the workflows live next to the code. This skill gives you a production-ready setup for iOS + Android with proper secret handling, caching, and tag-triggered releases.
.github/workflows/
pr.yml # lint + test on every PR
main.yml # internal/TestFlight on every merge to main
release.yml # production release on v*.*.* tags
Keep each file single-purpose; avoid one mega-workflow with 20 jobs.
name: PR
on:
pull_request:
branches: [main]
concurrency:
group: pr-${{ github.event.pull_request.number }}
cancel-in-progress: true
jobs:
lint-test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with: { distribution: temurin, java-version: '17' }
- uses: ruby/setup-ruby@v1
with: { bundler-cache: true }
- name: Gradle lint + test
run: ./gradlew :app:lintRelease :app:testReleaseUnitTest
name: Release iOS
on:
push:
tags: ['v*.*.*']
jobs:
ios:
runs-on: macos-14
environment: production # requires manual approval
timeout-minutes: 60
steps:
- uses: actions/checkout@v4
- uses: ruby/setup-ruby@v1
with: { bundler-cache: true, working-directory: ios }
- name: Select Xcode 15.4
run: sudo xcode-select -s /Applications/Xcode_15.4.app
- name: Cache CocoaPods
uses: actions/cache@v4
with:
path: ios/Pods
key: pods-${{ hashFiles('ios/Podfile.lock') }}
- run: cd ios && pod install --repo-update
- name: Fastlane release
working-directory: ios
env:
APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
VERSION_NAME: ${{ github.ref_name }}
VERSION_CODE: ${{ github.run_number }}
run: |
bundle exec fastlane beta
bundle exec fastlane release
- uses: actions/upload-artifact@v4
with:
name: ios-ipa
path: ios/build/ios/ipa/*.ipa
retention-days: 30
name: Release Android
on:
push:
tags: ['v*.*.*']
jobs:
android:
runs-on: ubuntu-latest
environment: production
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with: { distribution: temurin, java-version: '17' }
- uses: ruby/setup-ruby@v1
with: { bundler-cache: true, working-directory: android }
- uses: gradle/actions/setup-gradle@v3
- name: Decode keystore
run: |
echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d \
> android/upload-keystore.jks
cat > android/key.properties <<EOF
storeFile=../upload-keystore.jks
storePassword=${{ secrets.KEYSTORE_PASSWORD }}
keyAlias=${{ secrets.KEY_ALIAS }}
keyPassword=${{ secrets.KEY_PASSWORD }}
EOF
- name: Fastlane internal
working-directory: android
env:
PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
VERSION_NAME: ${{ github.ref_name }}
run: bundle exec fastlane internal
- uses: actions/upload-artifact@v4
with:
name: android-aab
path: android/app/build/outputs/bundle/release/*.aab
Settings → Environments → production:
main and release/* tags.This gates the release workflow behind a manual click.
ANDROID_*, IOS_*, PLAY_*, APP_STORE_CONNECT_*.*_BASE64 when the value is binary-encoded.API_KEY or PASSWORD.| Cache | Key |
|---|---|
| Ruby gems | hashFiles('**/Gemfile.lock') |
| CocoaPods | hashFiles('**/Podfile.lock') |
| Gradle | hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') via gradle/actions/setup-gradle |
| Pub | hashFiles('**/pubspec.lock') |
| node_modules | hashFiles('**/package-lock.json', '**/yarn.lock') |
Prefer the official setup actions' built-in caching over hand-rolled actions/cache where available.
Keep signed AABs and IPAs for 30–90 days. Enough time to re-upload if a release is pulled, short enough to control storage costs. Never store secrets in artefacts.
concurrency.cancel-in-progress).# .github/workflows/release-please.yml
on: { push: { branches: [main] } }
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: googleapis/release-please-action@v4
with:
release-type: simple
When the PR merges, a tag is created and the release.yml workflow fires. Zero manual steps.
.env files.push to any branch..p8 or .jks files in the repo, even encrypted with git-crypt.production environment requires manual approval.xcode-select.