❌ Committing keystore.jks, .p8, or .env files — store all signing credentials in GitHub Secrets or a secure vault
❌ CI job without timeout-minutes — hung jobs burn runner minutes; always set an explicit timeout (e.g., 30m)
❌ Manual version: 1.0.0+42 edits in pubspec.yaml — automate via git tags or a version script to prevent human error
❌ Running flutter analyze after flutter build — analysis is cheap and fast; fail fast by running it before builds/tests
Related Topics
flutter/testing | dart/tooling
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: comeonoliver-skillshub-flutter-cicd3description: CI/CD Standards4---56# CI/CD Standards78## **Priority: P1 (HIGH)**910Automates code quality checks, testing, and deployment to prevent regressions and accelerate delivery.1112## Core Pipeline Steps13141. **Environment Setup**: Use stable Flutter channel. Cache dependencies (pub, gradle, cocoapods).152. **Static Analysis**: Enforce `flutter analyze` and `dart format`. Fail on any warning in strict mode.163. **Testing**: Run unit, widget, and integration tests. Upload coverage reports (e.g., Codecov).174. **Build**:18 - **Android**: Build App Bundle (`.aab`) for Play Store.19 - **iOS**: Sign and build `.ipa` (requires macOS runner).205. **Deployment** (CD): Automated upload to TestFlight/Play Console using standard tools (Fastlane, Codemagic).2122## Best Practices2324- **Timeout Limits**: Always set `timeout-minutes` (e.g., 30m) to save costs on hung jobs.25- **Fail Fast**: Run Analyze/Format _before_ Tests/Builds.26- **Secrets**: Never commit keys. Use GitHub Secrets or secure vaults for `keystore.jks` and `.p8` certs.27- **Versioning**: Automate version bumping based on git tags or semantic version scripts.2829## Reference3031- [**GitHub Actions Template**](references/github-actions.md) - Standard workflow file.32- [**Advanced Large-Scale Workflow**](references/advanced-workflow.md) - Parallel jobs, Caching, Strict Mode.33- [**Fastlane Standards**](references/fastlane.md) - Automated Signing & Deployment.3435## Anti-Patterns3637- ❌ Committing `keystore.jks`, `.p8`, or `.env` files — store all signing credentials in GitHub Secrets or a secure vault38- ❌ CI job without `timeout-minutes` — hung jobs burn runner minutes; always set an explicit timeout (e.g., 30m)39- ❌ Manual `version: 1.0.0+42` edits in `pubspec.yaml` — automate via git tags or a version script to prevent human error40- ❌ Running `flutter analyze` after `flutter build` — analysis is cheap and fast; fail fast by running it before builds/tests4142## Related Topics4344flutter/testing | dart/tooling4546---47> Converted and distributed by [TomeVault](https://tomevault.io/claim/ComeOnOliver) — claim your Tome and manage your conversions.48<!-- tomevault:4.0:skill_md:2026-04-16 -->
Run npx skillmds@latest add tomevault-io/comeonoliver-skillshub-flutter-cicd in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
CI/CD Standards It is listed under DevOps & Infra on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.