lint → typecheck → test → build → sign → distribute → monitor

{
  "cli": {
    "version": ">= 12.0.0",
    "appVersionSource": "remote"
  },
  "build": {
    "development": {
      "developmentClient": true,
      "distribution": "internal",
      "ios": {
        "simulator": true
      },
      "env": {
        "APP_VARIANT": "development"
      },
      "channel": "development"
    },
    "preview": {
      "distribution": "internal",
      "ios": {
        "resourceClass": "m-medium"
      },
      "autoIncrement": true,
      "env": {
        "APP_VARIANT": "preview"
      },
      "channel": "preview"
    },
    "production": {
      "ios": {
        "resourceClass": "m-medium",
        "autoIncrement": true
      },
      "android": {
        "buildType": "app-bundle",
        "autoIncrement": true
      },
      "env": {
        "APP_VARIANT": "production"
      },
      "channel": "production"
    }
  },
  "submit": {
    "production": {
      "ios": {
        "appleId": "team@company.com",
        "ascAppId": "1234567890",
        "appleTeamId": "ABCDE12345"
      },
      "android": {
        "serviceAccountKeyPath": "./google-service-account.json",
        "track": "internal"
      }
    }
  }
}

# .eas/build/pre-install.sh
#!/bin/bash
echo "Installing system dependencies..."
apt-get install -y libvips  # example: image processing lib

# .eas/build/post-install.sh
#!/bin/bash
echo "Running codegen..."
npx graphql-codegen

{
  "build": {
    "production": {
      "config": "production.yml"
    }
  }
}

# Submit the latest production build to App Store Connect
eas submit --platform ios --profile production --latest

# Submit a specific build to Google Play (internal track)
eas submit --platform android --profile production --latest

# Build and submit in one command
eas build --platform all --profile production --auto-submit

# fastlane/Matchfile
git_url("https://github.com/your-org/certificates.git")
storage_mode("git")

type("appstore")     # or "adhoc", "development"
app_identifier(["com.company.app", "com.company.app.OneSignalNotificationServiceExtension"])
username("ci@company.com")
team_id("ABCDE12345")

# For CI: use API key instead of password
api_key_path("fastlane/AuthKey.json")

# First-time setup (run locally, not in CI)
fastlane match development
fastlane match adhoc
fastlane match appstore

# CI pulls existing certs (readonly mode prevents accidental regeneration)
fastlane match appstore --readonly

# Automatic: EAS generates and manages everything
eas credentials --platform ios

# Configure auto-managed credentials
eas build --platform ios --profile production
# EAS prompts: "Generate a new Apple Distribution Certificate?" → Yes

# Manual: bring your own
eas credentials --platform ios
# Select: "Upload a certificate (.p12)" and "Upload a provisioning profile"

#!/bin/bash
# ci/setup-keychain.sh

KEYCHAIN_NAME="ci-build.keychain"
KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

# Create temporary keychain
security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
security set-keychain-settings -lut 21600 "$KEYCHAIN_NAME"
security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"

# Add to search list
security list-keychains -d user -s "$KEYCHAIN_NAME" $(security list-keychains -d user | tr -d '"')

# Import certificate
security import "$CERTIFICATE_PATH" \
  -k "$KEYCHAIN_NAME" \
  -P "$CERTIFICATE_PASSWORD" \
  -T /usr/bin/codesign \
  -T /usr/bin/security

# Allow codesign to access keychain without prompt
security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"

# Generate a release keystore (do this ONCE, store securely)
keytool -genkeypair \
  -v \
  -storetype PKCS12 \
  -keystore release.keystore \
  -alias release-key \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000 \
  -dname "CN=Company Name, OU=Mobile, O=Company, L=Auckland, ST=Auckland, C=NZ"

// android/app/build.gradle

def keystoreProperties = new Properties()
def keystorePropertiesFile = rootProject.file('keystore.properties')
if (keystorePropertiesFile.exists()) {
    keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
}

android {
    signingConfigs {
        release {
            storeFile file(keystoreProperties['storeFile'] ?: '/dev/null')
            storePassword keystoreProperties['storePassword'] ?: ''
            keyAlias keystoreProperties['keyAlias'] ?: ''
            keyPassword keystoreProperties['keyPassword'] ?: ''
        }
    }

    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
        }
    }
}

# android/keystore.properties (git-ignored, injected by CI)
storeFile=../release.keystore
storePassword=your-store-password
keyAlias=release-key
keyPassword=your-key-password

# Export the upload certificate for Play Console
keytool -export \
  -rfc \
  -keystore upload.keystore \
  -alias upload-key \
  -file upload-cert.pem

# In CI (GitHub Actions example): decode keystore from secret
echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > android/release.keystore

# Write keystore.properties from secrets
cat > android/keystore.properties <<PROPS
storeFile=../release.keystore
storePassword=$ANDROID_STORE_PASSWORD
keyAlias=$ANDROID_KEY_ALIAS
keyPassword=$ANDROID_KEY_PASSWORD
PROPS

# fastlane/Fastfile

default_platform(:ios)

before_all do
  ensure_git_status_clean
end

platform :ios do
  desc "Push a new build to TestFlight"
  lane :beta do
    setup_ci if ENV['CI']

    # Pull certificates
    match(type: "appstore", readonly: true)

    # Increment build number from CI
    increment_build_number(
      build_number: ENV['BUILD_NUMBER'] || (latest_testflight_build_number + 1)
    )

    # Build
    gym(
      workspace: "ios/App.xcworkspace",
      scheme: "App",
      configuration: "Release",
      export_method: "app-store",
      output_directory: "./build",
      output_name: "App.ipa",
      xcargs: "-allowProvisioningUpdates"
    )

    # Upload to TestFlight
    pilot(
      ipa: "./build/App.ipa",
      skip_waiting_for_build_processing: true,
      apple_id: "1234567890",
      distribute_external: false
    )

    # Notify
    slack(
      message: "iOS build #{lane_context[SharedValues::BUILD_NUMBER]} uploaded to TestFlight",
      slack_url: ENV['SLACK_WEBHOOK_URL']
    ) if ENV['SLACK_WEBHOOK_URL']
  end

  desc "Push to App Store for review"
  lane :release do
    setup_ci if ENV['CI']
    match(type: "appstore", readonly: true)

    gym(
      workspace: "ios/App.xcworkspace",
      scheme: "App",
      configuration: "Release",
      export_method: "app-store"
    )

    deliver(
      ipa: "./build/App.ipa",
      submit_for_review: true,
      automatic_release: false,
      force: true,
      precheck_include_in_app_purchases: false
    )
  end
end

platform :android do
  desc "Build and upload to Play Store internal track"
  lane :beta do
    # Build AAB
    gradle(
      project_dir: "./android",
      task: "bundle",
      build_type: "Release",
      properties: {
        "android.injected.signing.store.file" => ENV['ANDROID_KEYSTORE_PATH'],
        "android.injected.signing.store.password" => ENV['ANDROID_STORE_PASSWORD'],
        "android.injected.signing.key.alias" => ENV['ANDROID_KEY_ALIAS'],
        "android.injected.signing.key.password" => ENV['ANDROID_KEY_PASSWORD']
      }
    )

    # Upload to Play Store
    supply(
      aab: lane_context[SharedValues::GRADLE_AAB_OUTPUT_PATH],
      track: "internal",
      json_key: ENV['GOOGLE_SERVICE_ACCOUNT_KEY_PATH'],
      skip_upload_metadata: true,
      skip_upload_images: true,
      skip_upload_screenshots: true
    )
  end

  desc "Promote internal to production"
  lane :release do
    supply(
      track: "internal",
      track_promote_to: "production",
      json_key: ENV['GOOGLE_SERVICE_ACCOUNT_KEY_PATH'],
      rollout: "0.1"  # 10% staged rollout
    )
  end
end

# .github/workflows/build.yml
name: Build & Deploy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '20'
  JAVA_VERSION: '17'

jobs:
  # ─── Quality Gate ───────────────────────────────────────────
  quality:
    name: Lint, Typecheck, Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Lint
        run: yarn lint

      - name: Typecheck
        run: yarn tsc --noEmit

      - name: Test
        run: yarn test --ci --coverage --maxWorkers=2

      - name: Upload coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage/lcov.info

  # ─── Android Build ─────────────────────────────────────────
  android:
    name: Build Android
    needs: quality
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ env.JAVA_VERSION }}

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: gradle-${{ runner.os }}-

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Decode keystore
        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode > android/release.keystore

      - name: Create keystore.properties
        run: |
          cat > android/keystore.properties <<EOF
          storeFile=../release.keystore
          storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
          EOF

      - name: Build AAB
        working-directory: android
        run: ./gradlew bundleRelease --no-daemon

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-release
          path: android/app/build/outputs/bundle/release/app-release.aab

  # ─── iOS Build ─────────────────────────────────────────────
  ios:
    name: Build iOS
    needs: quality
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - name: Cache Pods
        uses: actions/cache@v4
        with:
          path: ios/Pods
          key: pods-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock') }}
          restore-keys: pods-${{ runner.os }}-

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Install Pods
        working-directory: ios
        run: bundle exec pod install

      - name: Setup Fastlane
        run: |
          cd ios
          bundle install

      - name: Build and upload to TestFlight
        env:
          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
          MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_TOKEN }}
          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          APP_STORE_CONNECT_API_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          APP_STORE_CONNECT_API_KEY: ${{ secrets.ASC_API_KEY }}
        run: bundle exec fastlane ios beta

  # ─── EAS Build (alternative for Expo projects) ─────────────
  eas:
    name: EAS Build
    needs: quality
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'

      - uses: expo/expo-github-action@v8
        with:
          eas-version: latest
          token: ${{ secrets.EXPO_TOKEN }}

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Build for both platforms
        run: eas build --platform all --profile production --non-interactive --auto-submit

# Publish an update to the preview channel
eas update --branch preview --message "Fix cart total calculation"

# Publish to production
eas update --branch production --message "v2.3.1 hotfix: payment flow"

# Check update status
eas update:list

// app.config.ts
export default ({ config }: ConfigContext): ExpoConfig => ({
  ...config,
  name: 'MyApp',
  slug: 'my-app',
  runtimeVersion: {
    policy: 'appVersion',  // ties runtime version to app version
  },
  updates: {
    url: 'https://u.expo.dev/your-project-id',
    fallbackToCacheTimeout: 3000,
    checkAutomatically: 'ON_LOAD',
  },
});

// App.tsx — CodePush wrapper
import codePush from 'react-native-code-push';

const codePushOptions = {
  checkFrequency: codePush.CheckFrequency.ON_APP_RESUME,
  installMode: codePush.InstallMode.ON_NEXT_RESTART,
  mandatoryInstallMode: codePush.InstallMode.IMMEDIATE,
  minimumBackgroundDuration: 60 * 5, // 5 minutes
};

function App() {
  return (
    <NavigationContainer>
      <RootStack />
    </NavigationContainer>
  );
}

export default codePush(codePushOptions)(App);

# Release an update via CodePush CLI
appcenter codepush release-react \
  -a "Company/MyApp-iOS" \
  -d "Production" \
  --target-binary-version "~2.3.0" \
  --mandatory false \
  --description "Fix cart total calculation"

# Rollback the latest release
appcenter codepush rollback -a "Company/MyApp-iOS" -d "Production"

// app.config.ts
import { ConfigContext, ExpoConfig } from 'expo/config';

const APP_VARIANT = process.env.APP_VARIANT ?? 'development';

const variantConfig = {
  development: {
    name: 'MyApp (Dev)',
    bundleId: 'com.company.app.dev',
    icon: './assets/icon-dev.png',
    apiUrl: 'https://api-dev.company.com',
  },
  preview: {
    name: 'MyApp (Preview)',
    bundleId: 'com.company.app.preview',
    icon: './assets/icon-preview.png',
    apiUrl: 'https://api-staging.company.com',
  },
  production: {
    name: 'MyApp',
    bundleId: 'com.company.app',
    icon: './assets/icon.png',
    apiUrl: 'https://api.company.com',
  },
} as const;

const variant = variantConfig[APP_VARIANT as keyof typeof variantConfig];

export default ({ config }: ConfigContext): ExpoConfig => ({
  ...config,
  name: variant.name,
  slug: 'my-app',
  version: '2.3.1',
  icon: variant.icon,
  ios: {
    bundleIdentifier: variant.bundleId,
    supportsTablet: true,
  },
  android: {
    package: variant.bundleId,
    adaptiveIcon: {
      foregroundImage: './assets/adaptive-icon.png',
      backgroundColor: '#ffffff',
    },
  },
  extra: {
    apiUrl: variant.apiUrl,
    appVariant: APP_VARIANT,
  },
});

# .env.development
API_URL=https://api-dev.company.com
SENTRY_DSN=https://dev-key@sentry.io/123
FEATURE_FLAG_ENDPOINT=https://flags-dev.company.com

# .env.production
API_URL=https://api.company.com
SENTRY_DSN=https://prod-key@sentry.io/456
FEATURE_FLAG_ENDPOINT=https://flags.company.com

// src/core/config.ts
import Config from 'react-native-config';

export const config = {
  apiUrl: Config.API_URL!,
  sentryDsn: Config.SENTRY_DSN!,
  featureFlagEndpoint: Config.FEATURE_FLAG_ENDPOINT!,
} as const;

# iOS
ENVFILE=.env.production npx react-native run-ios --configuration Release

# Android
ENVFILE=.env.production npx react-native run-android --variant=release

// android/app/build.gradle
android {
    flavorDimensions "environment"
    productFlavors {
        dev {
            dimension "environment"
            applicationIdSuffix ".dev"
            resValue "string", "app_name", "MyApp Dev"
        }
        staging {
            dimension "environment"
            applicationIdSuffix ".staging"
            resValue "string", "app_name", "MyApp Staging"
        }
        prod {
            dimension "environment"
            resValue "string", "app_name", "MyApp"
        }
    }
}

{
  "build": {
    "production": {
      "autoIncrement": true
    }
  },
  "cli": {
    "appVersionSource": "remote"
  }
}

#!/bin/bash
# ci/bump-build-number.sh

# iOS: read current, increment, write back
PLIST_PATH="ios/App/Info.plist"
CURRENT=$(/usr/libexec/PlistBuddy -c "Print CFBundleVersion" "$PLIST_PATH")
NEXT=$((CURRENT + 1))
/usr/libexec/PlistBuddy -c "Set :CFBundleVersion $NEXT" "$PLIST_PATH"
echo "iOS build number: $NEXT"

# Android: use CI build number
# In build.gradle, read versionCode from environment:
# versionCode System.getenv("BUILD_NUMBER")?.toInteger() ?: 1

# Generate changelog from conventional commits
npx standard-version --release-as minor

# Or with Changesets for monorepos
npx changeset version
npx changeset publish

Internal Testing → Closed Beta → Open Beta → Production (staged)

# fastlane/Fastfile — staged rollout to production
lane :staged_release do
  supply(
    track: "production",
    rollout: "0.01",  # Start at 1%
    json_key: ENV['GOOGLE_SERVICE_ACCOUNT_KEY_PATH']
  )
end

lane :increase_rollout do |options|
  supply(
    track: "production",
    rollout: options[:percentage],  # e.g., "0.1", "0.5", "1.0"
    json_key: ENV['GOOGLE_SERVICE_ACCOUNT_KEY_PATH']
  )
end

# Increase rollout to 10%
fastlane increase_rollout percentage:0.1

# Full rollout
fastlane increase_rollout percentage:1.0

# EAS Update: rollback by re-publishing the last known good update
eas update:republish --group <previous-update-group-id> --branch production

# CodePush: built-in rollback
appcenter codepush rollback -a "Company/MyApp-iOS" -d "Production"

# Google Play: halt a staged rollout
fastlane supply --track production --rollout 0 --json_key key.json

# Install the visualizer
yarn add --dev react-native-bundle-visualizer

# Generate a report
npx react-native-bundle-visualizer

# Or use Metro directly
npx react-native bundle \
  --platform ios \
  --dev false \
  --entry-file index.js \
  --bundle-output /tmp/bundle.js \
  --sourcemap-output /tmp/bundle.js.map

# Check raw size
ls -lh /tmp/bundle.js
# Check gzipped size (what actually transfers for OTA)
gzip -c /tmp/bundle.js | wc -c

// Bad: imports all of lodash (~70 KB minified)
import { debounce } from 'lodash';

// Good: import only the function you need (~1 KB)
import debounce from 'lodash/debounce';

// Better: use a tree-shakeable alternative
import { debounce } from 'lodash-es'; // still no Metro tree shaking
// Best: write it yourself — debounce is 10 lines

#!/bin/bash
# ci/check-bundle-size.sh

MAX_SIZE_KB=2048  # 2 MB budget

npx react-native bundle \
  --platform ios \
  --dev false \
  --entry-file index.js \
  --bundle-output /tmp/bundle.js \
  --sourcemap-output /tmp/bundle.js.map \
  2>/dev/null

SIZE_KB=$(( $(wc -c < /tmp/bundle.js) / 1024 ))

echo "Bundle size: ${SIZE_KB} KB (budget: ${MAX_SIZE_KB} KB)"

if [ "$SIZE_KB" -gt "$MAX_SIZE_KB" ]; then
  echo "FAIL: Bundle exceeds size budget by $(( SIZE_KB - MAX_SIZE_KB )) KB"
  echo "Run 'npx react-native-bundle-visualizer' to identify heavy modules"
  exit 1
fi

echo "PASS: Bundle within budget"

# Optimize PNGs (lossless)
find assets/ -name "*.png" -exec pngquant --quality=65-80 --skip-if-larger --ext .png --force {} \;

# Convert large PNGs to WebP (supported on Android; iOS 14+)
find assets/ -name "*.png" -size +50k -exec cwebp -q 80 {} -o {}.webp \;

# Use @expo/image-utils for Expo managed workflow
# It automatically optimizes icons and splash screens during prebuild

// src/core/monitoring/sentry.ts
import * as Sentry from '@sentry/react-native';

export function initSentry() {
  Sentry.init({
    dsn: Config.SENTRY_DSN,
    environment: Config.APP_VARIANT,
    release: `${Application.applicationId}@${Application.nativeApplicationVersion}+${Application.nativeBuildVersion}`,
    dist: Application.nativeBuildVersion,
    tracesSampleRate: __DEV__ ? 1.0 : 0.2,
    profilesSampleRate: 0.1,
    enableAutoSessionTracking: true,
    sessionTrackingIntervalMillis: 30000,

    // Filter noisy errors
    beforeSend(event) {
      // Ignore network errors in development
      if (__DEV__ && event.exception?.values?.[0]?.type === 'TypeError') {
        return null;
      }
      return event;
    },

    integrations: [
      Sentry.reactNativeTracingIntegration({
        routingInstrumentation:
          Sentry.reactNavigationIntegration({
            enableTimeToInitialDisplay: true,
          }),
      }),
    ],
  });
}

# Upload source maps to Sentry (bare workflow)
npx sentry-cli react-native appcenter \
  --org your-org \
  --project your-project \
  --release "com.company.app@2.3.1+147" \
  --dist "147" \
  --sourcemap /tmp/bundle.js.map \
  --bundle /tmp/bundle.js

# For Expo / EAS, use the Sentry Expo plugin — it uploads automatically
# In app.json or app.config.ts:
# plugins: [
#   ["@sentry/react-native/expo", {
#     organization: "your-org",
#     project: "your-project",
#   }]
# ]

// src/core/monitoring/crashlytics.ts
import crashlytics from '@react-native-firebase/crashlytics';

export function initCrashlytics() {
  // Identify user for crash reports
  crashlytics().setUserId(userId);
  crashlytics().setAttribute('environment', Config.APP_VARIANT);

  // Log non-fatal errors
  crashlytics().recordError(new Error('Payment declined'), 'PaymentFlow');

  // Breadcrumbs
  crashlytics().log('User tapped checkout button');
}

// Global error handler
const defaultHandler = ErrorUtils.getGlobalHandler();
ErrorUtils.setGlobalHandler((error, isFatal) => {
  crashlytics().recordError(error, isFatal ? 'FatalJS' : 'NonFatalJS');
  defaultHandler(error, isFatal);
});

// Measure screen render time
import { PerformanceObserver, performance } from 'react-native-performance';

export function useScreenPerformance(screenName: string) {
  useEffect(() => {
    const mark = `${screenName}_mount`;
    performance.mark(mark);

    return () => {
      performance.measure(`${screenName}_visible`, mark);
      const entries = performance.getEntriesByName(`${screenName}_visible`);
      const duration = entries[entries.length - 1]?.duration;

      if (duration && duration > 1000) {
        Sentry.captureMessage(`Slow screen: ${screenName} took ${duration}ms`, {
          level: 'warning',
          extra: { duration, screenName },
        });
      }
    };
  }, [screenName]);
}