Desktop and mobile release pipelines

Organizes platform builds, signing materials and release channels into traceable CI artifacts.

desktop-mobile-release-pipelines

Team members using this skill

AgentOtto

See how it helps

When is it useful?

Use when distributing applications across operating systems and CPU architectures.

What does it help you do?

Maps platform builds and required signing or notarization steps.
Keeps certificates and provisioning material in controlled CI secret storage.
Verifies artifact identity and update-channel consistency before publication.

Try asking this

Design a macOS and Windows build matrix with temporary signing access and clearly separated release artifacts. Verify each platform artifact's signature and architecture, then match it to its update entry. Signing material must disappear when the CI job ends.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Desktop & Mobile Release Pipelines

Unlike web servers where a rollback takes seconds, a broken desktop installer or mobile store binary stays on user devices until they update—and a missing signature, entitlement, or store metadata check blocks release for days.

Code Signing, Notarization & Ephemeral Keychains in CI

Never commit signing certificates or provisioning profiles to unencrypted git:
- Inject certificates (.p12, .pfx, Android .jks/.keystore, ASC API keys) from protected CI environment secrets into an ephemeral temporary directory or keychain created for the job, and destroy it in an always() / finally cleanup step.
Platform signing & notarization requirements:
- macOS (DMG / .app / PKG): Enable Hardened Runtime, declare only the minimal required entitlements (entitlements.mac.plist), sign all nested binaries/frameworks inside-out before signing the outer bundle, submit to Apple notarytool (--wait), and staple the ticket (xcrun stapler staple).
- Windows (MSIX / NSIS / Squirrel): Sign executables and installers with an Authenticode / Azure Trusted Signing certificate and a timestamp server (http://timestamp.digicert.com) so signatures remain valid after certificate expiry.
- iOS & Android: Monotonically increment build numbers (CFBundleVersion / versionCode) alongside semantic versionName, enforce release ProGuard/R8 mapping file upload (Android) and dSYM upload (iOS) for crash symbolication, and build Android App Bundles (.aab) for Play Store distribution.

Cross-Platform Build Matrix & Auto-Update Channels

Release Surface	Critical Pipeline Checks
Universal / Multi-Arch Binaries	Build and verify native modules for target architectures (`darwin-arm64`, `darwin-x64`, `win32-x64`, `linux-x64`) rather than cross-compiling untested native addons without smoke verification.
Staged Release Channels	Publish through progressive channels (`internal` / `alpha` $\rightarrow$ `beta` / `TestFlight` / `Play Internal Track` $\rightarrow$ staged `production` rollout at 5% $\rightarrow$ 25% $\rightarrow$ 100%).
Auto-Update Metadata Integrity	Verify that auto-updater manifests (`latest-mac.yml`, `latest.yml`, `appcast.xml`, Tauri update JSON, or Expo OTA runtimeVersion) match the exact uploaded binary filename, SHA-512 checksum, and signature before making the release public.
OTA / JS Bundle Compatibility (`runtimeVersion`)	When using over-the-air updates (Expo Updates / CodePush), bind `runtimeVersion` to the native binary fingerprint so a JS bundle expecting a new native module is never pushed to an older native binary in the wild.

Included files 1

SKILL.md