一键在 Manus 中运行任何 Skill

gpc-preflight

星标1

分支0

更新时间2026年6月7日 12:53

Use when scanning an AAB or APK for Google Play policy compliance before submission, or checking signing key consistency across releases. Trigger when the user mentions preflight, compliance check, policy scan, pre-submission check, signing key consistency, certificate mismatch, or wants to verify their AAB/APK meets Google Play requirements. Also trigger for questions about restricted permissions, target SDK requirements, 64-bit compliance, hardcoded secrets detection, or Data Safety form reminders.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

yasserstudio

yasserstudio/gpc-skills

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

相关职业SOC

基于 SOC 职业分类

软件开发工程师计算机与数学类职业·SOC 15-1252

SKILL.md

readonly

同仓库更多 Skills

同仓库

gpc-games

yasserstudio/gpc-skills

Use when managing Google Play Games Services achievement and leaderboard configurations with GPC. Make sure to use this skill whenever the user mentions gpc games, games achievements, games leaderboards, achievement config, leaderboard config, Play Games, Play Games Services, gamesconfiguration, achievement CRUD, leaderboard CRUD, points value, incremental achievement, stepsToUnlock, score order, score format, --game-id, GPC_GAME_ID, games.applicationId, or wants to create, update, delete, list, or diff achievement and leaderboard definitions for a game. Also trigger when someone wants to sync local achievement/leaderboard JSON against the remote Play Games configuration, read the runtime (player-facing) leaderboards or achievements, or find a game's numeric application ID. For app releases and tracks, see gpc-release-flow. For in-app purchases and subscriptions, see gpc-monetization.

2026-06-261

gpc-monetization

yasserstudio/gpc-skills

Use when managing in-app purchases, subscriptions, pricing, or Real-Time Developer Notifications in Google Play. Make sure to use this skill whenever the user mentions gpc subscriptions, gpc iap, gpc purchases, gpc pricing, gpc rtdn, in-app products, base plans, subscription offers, one-time products, consumable products, purchase verification, purchase acknowledgement, purchase token, subscription cancellation, subscription deferral, voided purchases, refunds, regional pricing, currency conversion, price migration, SKU management, monetization, revenue, billing, subscription analytics, churn, trial conversion, subscriber count, RTDN, Real-Time Developer Notifications, Pub/Sub notifications, subscription events, purchase events — even if they don't explicitly say 'monetization.' Also trigger when someone wants to create or update subscriptions, manage base plan lifecycle (activate/deactivate), set up introductory offers, verify server-side purchases, handle refunds, convert prices across regions, sync IAP pro

2026-06-261

gpc-release-flow

yasserstudio/gpc-skills

Use when uploading, releasing, promoting, or managing rollouts on Google Play. Make sure to use this skill whenever the user mentions gpc releases, upload AAB, upload APK, staged rollout, promote to production, halt rollout, gpc publish, release notes, track management, internal testing, beta release, production rollout, version code, rollout percentage, or wants to ship an Android app to any Play Store track. Also trigger when someone asks about the Google Play edit lifecycle, release validation, or how to do a phased rollout — even if they don't mention GPC by name. For metadata and listings, see gpc-metadata-sync. For CI/CD integration, see gpc-ci-integration.

2026-06-261

gpc-sdk-usage

yasserstudio/gpc-skills

Use when building applications that programmatically interact with the Google Play Developer API using GPC's TypeScript SDK packages. Make sure to use this skill whenever the user mentions @gpc-cli/api, @gpc-cli/auth, PlayApiClient, createApiClient, resolveAuth, Google Play API client, TypeScript SDK, programmatic access, API client, HTTP client, rate limiter, pagination, edit lifecycle in code, Node.js Google Play, server-side Play Store, backend integration — even if they don't explicitly say 'SDK.' Also trigger when someone wants to build a backend service, custom dashboard, automation script, or any TypeScript/JavaScript application that interacts with Google Play programmatically rather than through the CLI. For CLI usage, see other gpc-* skills. For building plugins, see gpc-plugin-development.

2026-06-261

gpc-troubleshooting

yasserstudio/gpc-skills

Use when debugging GPC errors, failures, or unexpected behavior. Make sure to use this skill whenever the user mentions gpc error, gpc failing, exit code, AUTH_FAILED, API_FORBIDDEN, NETWORK_ERROR, CONFIG_MISSING, EDIT_CONFLICT, upload failed, permission denied, timeout, rate limit, gpc doctor failing, unexpected exit code, command not working, GPC crash, debug GPC, verbose output, --json error, threshold breach — even if they don't explicitly say 'troubleshoot.' Also trigger when someone encounters any GPC error they don't understand, when gpc doctor reports issues, when CI pipelines fail with GPC commands, or when they need to interpret exit codes. For auth-specific setup issues, see gpc-setup. For CI-specific issues, see gpc-ci-integration.

2026-06-261

gpc-user-management

yasserstudio/gpc-skills

Use when managing Google Play developer account users, permissions, grants, or testers. Make sure to use this skill whenever the user mentions gpc users, gpc testers, gpc grants, developer account permissions, user roles, invite user, remove user, permission grants, per-app permissions, per-app grants, standalone grants, tester groups, beta testers, internal testers, alpha testers, Google Group testers, tester CSV import, team management, access control, user audit — even if they don't explicitly say 'user management.' Also trigger when someone wants to invite team members to their Play Console, update permissions for existing users, manage per-app grants independently from users, manage who can test their app, import testers from a CSV file, or audit who has access to their developer account. For authentication setup, see gpc-setup. For release track management, see gpc-release-flow.

2026-06-261

name	gpc-preflight
description	Use when scanning an AAB or APK for Google Play policy compliance before submission, or checking signing key consistency across releases. Trigger when the user mentions preflight, compliance check, policy scan, pre-submission check, signing key consistency, certificate mismatch, or wants to verify their AAB/APK meets Google Play requirements. Also trigger for questions about restricted permissions, target SDK requirements, 64-bit compliance, hardcoded secrets detection, or Data Safety form reminders.
compatibility	GPC v0.9.82+. v0.9.66+ for signing consistency. v0.9.65+ for April 2026 policy rules. APK support added in v0.9.47. AAB/APK scans are entirely offline; signing consistency requires auth.
metadata	{"version":"1.3.1"}

GPC Preflight Scanner

When to use

Use this skill when the task involves:

Scanning an AAB or APK file before uploading to Google Play
Checking target SDK version compliance
Auditing permissions against Google Play policies
Verifying 64-bit native library support
Scanning source code for hardcoded secrets or credentials
Detecting non-Play billing SDKs
Checking store listing metadata compliance
CI/CD quality gates based on policy compliance

Quick reference

# Full scan (AAB or APK)
gpc preflight app.aab
gpc preflight app.apk

# With metadata and source scanning
gpc preflight app.aab --metadata fastlane/metadata/android --source app/src

# Specific scanners only
gpc preflight manifest app.aab
gpc preflight permissions app.aab
gpc preflight metadata ./metadata
gpc preflight codescan ./src

# CI mode
gpc preflight app.aab --fail-on error --json

9 scanners

Scanner	Checks	Severity
manifest	targetSdk >= 36 (v0.9.79+), debuggable, testOnly (reads from `<application>` element since v0.9.80), cleartext, missing exported, FGS types, geofencing foreground service (v0.9.65+)	critical/error/warning
permissions	18 restricted permissions, contacts broad-access, Health Connect granular (v0.9.65+), Data Safety reminders	critical/error/warning/info
native-libs	64-bit ARM compliance, ABI detection, 16KB page alignment (AAB + APK since v0.9.80, ELF header read 4096 bytes)	critical/warning
metadata	Listing character limits, screenshots, privacy policy URL	error/warning
secrets	AWS keys, Google API keys, Stripe keys, private keys	critical/warning
billing	Stripe, Braintree, PayPal, Razorpay SDK detection	warning
privacy	Tracking SDKs, Advertising ID, data collection cross-reference	warning/info
policy	Families/COPPA, financial, health, UGC, overlay	warning/info
size	Download size, large native libs, large assets	warning/info

Configuration (.preflightrc.json)

{
  "failOn": "error",
  "targetSdkMinimum": 36,
  "maxDownloadSizeMb": 150,
  "allowedPermissions": ["android.permission.READ_SMS"],
  "disabledRules": ["cleartext-traffic"],
  "severityOverrides": { "billing-stripe-sdk": "info" }
}

API level 36 (Android 16) is required by August 31, 2026 for all new apps and updates on Google Play. The targetSdkMinimum default in GPC preflight was updated to 36 in v0.9.79 to reflect this deadline.

Exit codes

0 — all checks passed
1 — runtime error
6 — findings at or above --fail-on severity

Key rules

Rule ID	Severity	What
targetSdk-below-minimum	critical	targetSdkVersion < 36
debuggable-true	critical	android:debuggable="true"
testOnly-true	critical	android:testOnly="true"
missing-arm64	critical	32-bit ARM without 64-bit
missing-exported	error	Component with intent-filter but no exported attr
foreground-service-type-missing	error	Service without foregroundServiceType (API 34+)
secret-aws-key	critical	AWS access key in source
secret-stripe-key	critical	Stripe secret key in source
contacts-permission-broad	warning	READ_CONTACTS / WRITE_CONTACTS (v0.9.65+, April 2026 policy)
geofencing-foreground-service	warning	Location FGS + ACCESS_BACKGROUND_LOCATION (v0.9.65+, April 2026 policy)
health-connect-granular	warning/info	READ_ALL_HEALTH_DATA; warning on targetSdk >= 36, info otherwise (v0.9.65+, April 2026 policy)

Procedures

Running a full preflight scan

Build your AAB or APK: ./gradlew bundleRelease (or assembleRelease for APK)
Run: gpc preflight app/build/outputs/bundle/release/app-release.aab Or for APK: gpc preflight app/build/outputs/apk/release/app-release.apk
Fix any critical/error findings
Add a .preflightrc.json to allow approved permissions or disable false positives
Re-run until clean

Note: After the scan, GPC shows a reminder about Android developer verification requirements (September 30, 2026 enforcement for BR, ID, SG, TH). Run gpc verify for details.

Since v0.9.80, the result JSON includes a skippedScanners array when scanners are filtered out (e.g., manifest-dependent scanners skipped due to manifest parse failure). This replaces the previous behavior where skipped scanners were silently omitted.

Signing key consistency (v0.9.66+)

gpc preflight signing                    # Check cert consistency across two most recent bundles
gpc preflight signing --json             # JSON output for CI
gpc preflight signing --app com.example.app  # Override package name

Compares signing certificates across your two most recent bundle versions via the Play API (generatedApks.list). Requires auth (service account or OAuth). Exit code 6 on mismatch (same as other preflight threshold breaches). Exit code 4 on API errors.

This is NOT an offline scan. It calls the Play API to create an edit, list bundles, fetch generated APKs for the top two version codes, compare certificateSha256Fingerprint, then delete the edit.

April 2026 policy rules (v0.9.65+)

Three rules added for Google Play's April 15, 2026 policy batch. Compliance deadline: May 15, 2026.

Contacts broad access (contacts-permission-broad): Flags READ_CONTACTS / WRITE_CONTACTS. Google now requires the Android Contact Picker instead of broad access. Emits a single finding even when both permissions are present. Suppress via allowedPermissions for dialer/messaging apps.
Geofencing foreground service (geofencing-foreground-service): Fires when a service has foregroundServiceType containing "location" AND the app declares ACCESS_BACKGROUND_LOCATION. Google removed geofencing as an approved foreground service use case. For legitimate background location tracking (navigation, fitness), suppress via "disabledRules": ["geofencing-foreground-service"].
Health Connect granular permissions (health-connect-granular): Flags READ_ALL_HEALTH_DATA. Severity is warning when targetSdk >= 36 (Android 16 requirement), info otherwise. Replace with granular permissions like health.READ_STEPS, health.READ_HEART_RATE, etc.

False-negative fixes (v0.9.80)

Four scanner accuracy improvements shipped in v0.9.80:

testOnly attribute source: The testOnly scanner now reads android:testOnly from the <application> element of the manifest. Previously it was incorrectly reading from the <manifest> root, causing the check to always report no finding even when testOnly="true" was set on the application.
16KB alignment scanner scope: The 16KB page alignment scanner now checks native libraries inside APKs in addition to AABs. Previously it only inspected AAB artifacts, leaving APK native libraries unscanned.
ELF header read size: The ELF header reader was increased from 256 bytes to 4096 bytes. Small reads were insufficient for some native library formats, causing alignment checks to be skipped silently.
skippedScanners in results: Scanners that are disabled via skippedScanners (or skipped due to missing inputs) are now reported in the scan result JSON under a skippedScanners array. This makes it visible in CI when a scanner did not run.

Adding to CI

# GitHub Actions
- name: Preflight
  run: gpc preflight app.aab --fail-on error --json > preflight.json
- name: Upload report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: preflight-report
    path: preflight.json

Related skills

gpc-release-flow — uploading and releasing after preflight passes
gpc-ci-integration — CI/CD patterns including preflight gates
gpc-troubleshooting — exit code 6 handling
gpc-security — credential handling and key rotation