# Release Mobile

> Mobile app release pipeline — iOS signing, App Store submission, Android keystore, Play Store tracks, and OTA updates. Use when shipping a mobile app, setting up release CI, managing certificates, or promoting between store tracks.

- Skill: `rockclaver/release-mobile` (Agent Skill)
- Install (CLI): `npx skillmds@latest add rockclaver/release-mobile`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rockclaver/release-mobile/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: rockclaver (https://skillmd.com/u/rockclaver)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rockclaver/release-mobile

---


# Release Mobile

Ship a working app to App Store and Play Store. Code quality is out of scope — this is purely release mechanics.

## Versioning

- **iOS**: `CFBundleShortVersionString` (semver) + `CFBundleVersion` (monotonic integer). Both must bump per submission.
- **Android**: `versionName` (semver) + `versionCode` (integer, must increase per track upload).
- Automate bumps in CI — never hand-edit `Info.plist` or `build.gradle` in PRs.

## iOS — Signing and Build

- **Certificates**: Development (local), Distribution (App Store/Ad Hoc). Store in Keychain or CI secret; never in the repo.
- **Provisioning profiles**: match bundle ID, capabilities, and certificate. Regenerate when a device or capability changes.
- Archive: `xcodebuild archive -scheme <Scheme> -archivePath out.xcarchive`
- Export: `xcodebuild -exportArchive -archivePath out.xcarchive -exportPath out/ -exportOptionsPlist export.plist`
- `export.plist` must set `method: app-store` and `signingCertificate`.
- Automate: Fastlane `match` (cert/profile sync) + `gym` (build) + `pilot` (TestFlight) + `deliver` (App Store).

## iOS — Submission

- Upload via `xcrun altool`, Transporter, or `fastlane deliver`.
- Required: release notes, screenshots per device family, privacy manifest (required since iOS 17).
- Phased rollout: 1% → 2% → 5% → 10% → 20% → 50% → 100% over 7 days. Pause if crash rate spikes.
- Review: typically 24–48 h; expedited review available for critical fixes.

## Android — Signing and Build

- **Keystore**: generate once, store securely — never commit. Fields: alias, key password, store password.
- Build AAB (preferred): `./gradlew bundleRelease`. Configure `signingConfigs` from env vars.
- Automate: Fastlane `supply` or the Play Developer API.

## Play Store Tracks

Internal → Closed testing → Open testing → Production. Promote via Console or API — no rebuild needed. Same 1%→100% rollout pattern; monitor ANR and crash rates before expanding.

## OTA Updates (React Native / Expo)

- Expo EAS Update / CodePush: push JS + assets without App Store review.
- JS/assets only — native changes, permission changes, and payment flows always need a store release.

## CI Pipeline

```
branch push   →  build + unit tests
tag vX.Y.Z    →  sign → upload TestFlight / Play internal → notify QA
manual gate   →  promote to production track
```

## Guardrails

- Rotate certificates and keystore passwords annually; record expiry dates.
- Test the release build (not debug) on a real device before submitting.
- Never store signing credentials in the repository.