lint → test → build → sign → distribute → monitor

# fastlane/Matchfile
git_url("https://github.com/your-org/certificates")
storage_mode("git")

type("appstore")        # appstore, adhoc, development, enterprise
app_identifier("com.example.myapp")
username("ci@example.com")

# For CI: set MATCH_PASSWORD env var instead of interactive prompt

# fastlane/Fastfile — iOS lanes
platform :ios do
  desc "Sync certificates and profiles"
  lane :sync_certs do
    match(type: "appstore", readonly: is_ci)
    match(type: "development", readonly: is_ci)
  end

  desc "Build and upload to TestFlight"
  lane :beta do
    sync_certs
    build_ios_app(
      workspace: "ios/Runner.xcworkspace",
      scheme: "Runner",
      export_method: "app-store",
      output_directory: "./build/ios",
    )
    upload_to_testflight(
      skip_waiting_for_build_processing: true,
    )
  end
end

# Create a temporary keychain for CI
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
security set-keychain-settings -t 3600 -u build.keychain

# After match installs certs, they live in this keychain
# Clean up after build:
security delete-keychain build.keychain

keytool -genkey -v \
  -keystore release-keystore.jks \
  -keyalg RSA -keysize 2048 \
  -validity 10000 \
  -alias release \
  -storepass "$STORE_PASSWORD" \
  -keypass "$KEY_PASSWORD" \
  -dname "CN=Your Name, OU=Your Org, O=Your Company, L=City, ST=State, C=US"

# android/key.properties — gitignored
storePassword=your_store_password
keyPassword=your_key_password
keyAlias=release
storeFile=../release-keystore.jks

// android/app/build.gradle

def keystoreProperties = new Properties()
def keystorePropertiesFile = rootProject.file('key.properties')
if (keystorePropertiesFile.exists()) {
    keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
}

android {
    signingConfigs {
        release {
            keyAlias keystoreProperties['keyAlias']
            keyPassword keystoreProperties['keyPassword']
            storeFile keystoreProperties['storeFile'] ?
                file(keystoreProperties['storeFile']) : null
            storePassword keystoreProperties['storePassword']
        }
    }

    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled true
            shrinkResources true
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'),
                'proguard-rules.pro'
        }
    }
}

flutter run --flavor dev --dart-define-from-file=config/dev.json
flutter build appbundle --flavor production --dart-define-from-file=config/production.json

// config/dev.json
{
  "API_BASE_URL": "https://api-dev.example.com",
  "ENABLE_LOGGING": "true",
  "ANALYTICS_ENABLED": "false",
  "APP_NAME": "MyApp Dev"
}

// config/production.json
{
  "API_BASE_URL": "https://api.example.com",
  "ENABLE_LOGGING": "false",
  "ANALYTICS_ENABLED": "true",
  "APP_NAME": "MyApp"
}

class EnvConfig {
  static const apiBaseUrl = String.fromEnvironment('API_BASE_URL');
  static const enableLogging = String.fromEnvironment('ENABLE_LOGGING') == 'true';
  static const analyticsEnabled = String.fromEnvironment('ANALYTICS_ENABLED') == 'true';
  static const appName = String.fromEnvironment('APP_NAME', defaultValue: 'MyApp');
}

// Usage
final dio = Dio(BaseOptions(baseUrl: EnvConfig.apiBaseUrl));

// android/app/build.gradle
android {
    flavorDimensions "environment"

    productFlavors {
        dev {
            dimension "environment"
            applicationIdSuffix ".dev"
            resValue "string", "app_name", "MyApp Dev"
            versionNameSuffix "-dev"
        }
        staging {
            dimension "environment"
            applicationIdSuffix ".staging"
            resValue "string", "app_name", "MyApp Staging"
            versionNameSuffix "-staging"
        }
        production {
            dimension "environment"
            resValue "string", "app_name", "MyApp"
        }
    }
}

// ios/Flutter/dev.xcconfig
#include "Generated.xcconfig"
PRODUCT_BUNDLE_IDENTIFIER=com.example.myapp.dev
PRODUCT_NAME=MyApp Dev
FLUTTER_FLAVOR=dev

# fastlane/Fastfile

default_platform(:ios)

platform :ios do
  desc "Build and push to TestFlight"
  lane :beta do
    match(type: "appstore", readonly: is_ci)

    # Increment build number using CI build number
    increment_build_number(
      build_number: ENV["CI_BUILD_NUMBER"] || latest_testflight_build_number + 1,
      xcodeproj: "ios/Runner.xcodeproj",
    )

    build_ios_app(
      workspace: "ios/Runner.xcworkspace",
      scheme: "production",
      export_method: "app-store",
      output_directory: "./build/ios",
      xcargs: "-allowProvisioningUpdates",
    )

    upload_to_testflight(
      skip_waiting_for_build_processing: true,
      apple_id: ENV["APPLE_APP_ID"],
    )

    slack(
      message: "iOS beta uploaded to TestFlight",
      slack_url: ENV["SLACK_WEBHOOK"],
    ) if ENV["SLACK_WEBHOOK"]
  end

  desc "Full App Store release"
  lane :release do
    beta
    deliver(
      submit_for_review: true,
      automatic_release: false,
      force: true,
      submission_information: {
        add_id_info_uses_idfa: false,
      },
    )
  end
end

platform :android do
  desc "Build and push to Play Store internal track"
  lane :beta do
    # Decode keystore from base64 secret
    sh("echo $ANDROID_KEYSTORE_BASE64 | base64 --decode > ../android/release-keystore.jks") if is_ci

    gradle(
      project_dir: "./android",
      task: "bundle",
      build_type: "Release",
      flavor: "production",
      properties: {
        "android.injected.signing.store.file" => File.expand_path("../android/release-keystore.jks"),
        "android.injected.signing.store.password" => ENV["STORE_PASSWORD"],
        "android.injected.signing.key.alias" => ENV["KEY_ALIAS"],
        "android.injected.signing.key.password" => ENV["KEY_PASSWORD"],
      },
    )

    upload_to_play_store(
      track: "internal",
      aab: "./build/app/outputs/bundle/productionRelease/app-production-release.aab",
      skip_upload_metadata: true,
      skip_upload_changelogs: false,
      skip_upload_images: true,
      skip_upload_screenshots: true,
    )
  end

  desc "Promote internal to production"
  lane :release do
    upload_to_play_store(
      track: "internal",
      track_promote_to: "production",
      rollout: "0.1",  # 10% staged rollout
    )
  end
end

# .github/workflows/flutter-ci.yml
name: Flutter CI/CD

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FLUTTER_VERSION: "3.27.4"

jobs:
  # ──────────────────────────────────────────────
  # Stage 1: Lint + Test (runs on every PR)
  # ──────────────────────────────────────────────
  analyze-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"

      - name: Install dependencies
        run: flutter pub get

      - name: Check formatting
        run: dart format --set-exit-if-changed .

      - name: Analyze
        run: flutter analyze --fatal-infos

      - name: Run tests with coverage
        run: flutter test --coverage --test-randomize-ordering-seed=random

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          file: coverage/lcov.info
          fail_ci_if_error: false

  # ──────────────────────────────────────────────
  # Stage 2: Build Android (on merge to main)
  # ──────────────────────────────────────────────
  build-android:
    needs: analyze-and-test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "17"

      - uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          cache: true

      # Gradle cache
      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ hashFiles('android/build.gradle', 'android/app/build.gradle') }}
          restore-keys: gradle-

      - name: Decode keystore
        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode > android/release-keystore.jks

      - name: Create key.properties
        run: |
          cat > android/key.properties <<EOF
          storePassword=${{ secrets.STORE_PASSWORD }}
          keyPassword=${{ secrets.KEY_PASSWORD }}
          keyAlias=${{ secrets.KEY_ALIAS }}
          storeFile=release-keystore.jks
          EOF

      - name: Build App Bundle
        run: flutter build appbundle --flavor production --dart-define-from-file=config/production.json

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-release
          path: build/app/outputs/bundle/productionRelease/*.aab
          retention-days: 14

  # ──────────────────────────────────────────────
  # Stage 3: Build iOS (on merge to main)
  # ──────────────────────────────────────────────
  build-ios:
    needs: analyze-and-test
    if: github.ref == 'refs/heads/main'
    runs-on: macos-14  # M1 runner
    steps:
      - uses: actions/checkout@v4

      - uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          cache: true

      # CocoaPods cache
      - uses: actions/cache@v4
        with:
          path: ios/Pods
          key: pods-${{ hashFiles('ios/Podfile.lock') }}
          restore-keys: pods-

      - name: Install CocoaPods
        run: cd ios && pod install --repo-update

      - name: Setup Fastlane
        run: |
          cd ios
          gem install bundler
          bundle install

      - name: Build and upload to TestFlight
        env:
          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
          MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_AUTH }}
          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          APP_STORE_CONNECT_API_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          APP_STORE_CONNECT_API_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          CI_BUILD_NUMBER: ${{ github.run_number }}
        run: bundle exec fastlane ios beta

      - name: Upload dSYM artifact
        uses: actions/upload-artifact@v4
        with:
          name: ios-dsym
          path: build/ios/*.dSYM.zip
          retention-days: 90

# pubspec.yaml
version: 2.4.1+127
#        ^^^^^  ^^^
#        |      |
#        |      build number (integer, auto-incremented in CI)
#        version name (semver: major.minor.patch)

# Option 1: Use CI build number directly
flutter build appbundle --build-number=$GITHUB_RUN_NUMBER

# Option 2: Derive from git commit count (deterministic)
BUILD_NUMBER=$(git rev-list --count HEAD)
flutter build ipa --build-number=$BUILD_NUMBER

# Option 3: Fastlane — fetch latest from store and increment
# In Fastfile:
# increment_build_number(build_number: latest_testflight_build_number + 1)

# Using git-cliff (Rust-based, fast)
git-cliff --latest --strip header > CHANGELOG.md

# Or using conventional-changelog (Node.js)
npx conventional-changelog -p angular -i CHANGELOG.md -s

Internal Testing → Closed Beta → Open Beta → Staged Rollout → Full Production

# Fastlane: upload to TestFlight with external group
upload_to_testflight(
  distribute_external: true,
  groups: ["Beta Testers"],
  changelog: "Bug fixes and performance improvements",
)

# Fastlane: promote from internal to production with 10% rollout
upload_to_play_store(
  track: "internal",
  track_promote_to: "production",
  rollout: "0.1",
)

# Later: increase rollout to 50%
upload_to_play_store(
  track: "production",
  rollout: "0.5",
)

# Full release
upload_to_play_store(
  track: "production",
  rollout: "1.0",
)

# Install the Firebase CLI
npm install -g firebase-tools

# Distribute Android
firebase appdistribution:distribute build/app/outputs/apk/production/release/app-production-release.apk \
  --app "$FIREBASE_APP_ID_ANDROID" \
  --groups "qa-team, beta-testers" \
  --release-notes "Build $BUILD_NUMBER: $(git log -1 --pretty=%s)"

# Distribute iOS
firebase appdistribution:distribute build/ios/ipa/MyApp.ipa \
  --app "$FIREBASE_APP_ID_IOS" \
  --groups "qa-team"

# Initialize Shorebird in your project
shorebird init

# Create a release (baseline for future patches)
shorebird release android --flavor production
shorebird release ios --flavor production

# Ship a patch (after fixing a bug in Dart code)
shorebird patch android --flavor production
shorebird patch ios --flavor production

final remoteConfig = FirebaseRemoteConfig.instance;

await remoteConfig.setDefaults({
  'new_checkout_flow': false,
  'max_upload_size_mb': 10,
  'maintenance_mode': false,
});

await remoteConfig.setConfigSettings(RemoteConfigSettings(
  fetchTimeout: const Duration(seconds: 10),
  minimumFetchInterval: const Duration(hours: 1),
));

await remoteConfig.fetchAndActivate();

// Usage
final useNewCheckout = remoteConfig.getBool('new_checkout_flow');
final maxUpload = remoteConfig.getInt('max_upload_size_mb');

if (remoteConfig.getBool('maintenance_mode')) {
  // Show maintenance screen
}

# Generate a size breakdown
flutter build apk --analyze-size --target-platform=android-arm64

# iOS equivalent
flutter build ipa --analyze-size

# Output: a JSON file you can load in DevTools → App Size

# Production build with all optimizations
flutter build appbundle \
  --release \
  --obfuscate \
  --split-debug-info=build/debug-info \
  --tree-shake-icons

// Define a deferred import
import 'package:my_app/features/video_editor/video_editor.dart'
    deferred as video_editor;

Future<void> openVideoEditor() async {
  // Downloads the component on first access
  await video_editor.loadLibrary();
  Navigator.push(context, MaterialPageRoute(
    builder: (_) => video_editor.VideoEditorPage(),
  ));
}

#!/bin/bash
# scripts/check_bundle_size.sh

MAX_SIZE_MB=30
APK_PATH="build/app/outputs/flutter-apk/app-production-release.apk"

SIZE_BYTES=$(stat -f%z "$APK_PATH" 2>/dev/null || stat -c%s "$APK_PATH")
SIZE_MB=$((SIZE_BYTES / 1048576))

echo "APK size: ${SIZE_MB}MB (budget: ${MAX_SIZE_MB}MB)"

if [ "$SIZE_MB" -gt "$MAX_SIZE_MB" ]; then
  echo "FAIL: APK exceeds size budget by $((SIZE_MB - MAX_SIZE_MB))MB"
  exit 1
fi

// Firebase Performance — automatic HTTP and screen tracing
import 'package:firebase_performance/firebase_performance.dart';

// Custom trace for a critical operation
Future<void> processCheckout(Cart cart) async {
  final trace = FirebasePerformance.instance.newTrace('checkout_flow');
  trace.putAttribute('item_count', cart.items.length.toString());
  await trace.start();

  try {
    await paymentService.charge(cart);
    trace.putMetric('total_cents', cart.totalCents);
  } finally {
    await trace.stop();
  }
}

// Sentry — captures crashes + performance
import 'package:sentry_flutter/sentry_flutter.dart';

Future<void> main() async {
  await SentryFlutter.init(
    (options) {
      options.dsn = const String.fromEnvironment('SENTRY_DSN');
      options.tracesSampleRate = 0.2;  // 20% of transactions
      options.profilesSampleRate = 0.1;
      options.environment = const String.fromEnvironment('SENTRY_ENV',
          defaultValue: 'production');
    },
    appRunner: () => runApp(const MyApp()),
  );
}