Forem: Aleksandr Ilinskiy

How to Set Up Android CI/CD with GitHub Actions — Firebase Distribution & Play Store

Aleksandr Ilinskiy — Thu, 19 Feb 2026 21:35:24 +0000

Setting up CI/CD for Android apps on GitHub Actions is straightforward once you know the gotchas. This guide covers everything: building signed APKs/AABs, caching Gradle, deploying to Firebase Distribution for testers, and publishing to Play Store.

Prerequisites

An Android project with Gradle (Groovy or Kotlin DSL)
A GitHub repository
For Firebase: a Firebase project with your app added
For Play Store: a Google Play Console account with your app set up

Step 1: Make Gradlew Executable

This trips up almost everyone on their first CI run. Your gradlew file might not be executable in Git:

git update-index --chmod=+x gradlew
git commit -m "Make gradlew executable"

Or add this step to your workflow (we'll include it below).

Step 2: Create a Signing Keystore

If you don't have one yet:

keytool -genkeypair -v \
  -keystore release.jks \
  -keyalg RSA -keysize 2048 \
  -validity 10000 \
  -alias release \
  -storepass YOUR_STORE_PASSWORD \
  -keypass YOUR_KEY_PASSWORD \
  -dname "CN=Your Name, O=Your Org"

Never commit the keystore to Git. Instead, base64-encode it:

base64 -i release.jks | pbcopy   # macOS
base64 -w 0 release.jks          # Linux

Step 3: Add GitHub Secrets

Go to your repo → Settings → Secrets and variables → Actions and create:

Secret	Value
`KEYSTORE_BASE64`	Base64-encoded .jks file
`KEYSTORE_PASSWORD`	Your keystore password
`KEY_ALIAS`	Your key alias (e.g. "release")
`KEY_PASSWORD`	Your key password

For Firebase Distribution, also add:

Secret	Value
`FIREBASE_APP_ID`	Firebase Console → Project Settings → Your Android app ID
`FIREBASE_SERVICE_ACCOUNT`	JSON content of a Firebase service account key

For Play Store, add:

Secret	Value
`PLAY_SERVICE_ACCOUNT_JSON`	Google Play Console → API access → Service account JSON

Step 4: The Workflow — Firebase Distribution

Create .github/workflows/android-firebase.yml:

name: Android — Build & Deploy to Firebase

on:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build & Upload to Firebase
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Make gradlew executable
        run: chmod +x ./gradlew

      - name: Decode Keystore
        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > app/release.jks

      - name: Build Release APK
        run: ./gradlew assembleRelease
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}

      - name: Upload to Firebase Distribution
        uses: wzieba/Firebase-Distribution-Github-Action@v1
        with:
          appId: ${{ secrets.FIREBASE_APP_ID }}
          serviceCredentialsFileContent: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
          groups: testers
          file: app/build/outputs/apk/release/app-release.apk

Step 5: The Workflow — Play Store

For Play Store deployment, the workflow is similar but uses AAB (Android App Bundle) instead of APK:

name: Android — Build & Publish to Play Store

on:
  push:
    tags:
      - 'v*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build & Publish to Play Store
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Make gradlew executable
        run: chmod +x ./gradlew

      - name: Decode Keystore
        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > app/release.jks

      - name: Build Release AAB
        run: ./gradlew bundleRelease
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}

      - name: Upload to Play Store
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: com.yourcompany.yourapp
          releaseFiles: app/build/outputs/bundle/release/app-release.aab
          track: internal

Note: Replace com.yourcompany.yourapp with your actual package name. The track can be internal, alpha, beta, or production.

Step 6: Configure build.gradle for CI Signing

Your app/build.gradle.kts needs to read signing config from environment variables:

android {
    signingConfigs {
        create("release") {
            storeFile = file("release.jks")
            storePassword = System.getenv("KEYSTORE_PASSWORD")
            keyAlias = System.getenv("KEY_ALIAS")
            keyPassword = System.getenv("KEY_PASSWORD")
        }
    }

    buildTypes {
        release {
            signingConfig = signingConfigs.getByName("release")
            isMinifyEnabled = true
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro"
            )
        }
    }
}

Common Issues

"Permission denied: gradlew" — Either run chmod +x ./gradlew in your workflow or fix it in Git with git update-index --chmod=+x gradlew.

"JAVA_HOME is not set" — Make sure the setup-java step comes before any Gradle commands.

Build takes too long — The Gradle cache step should cut build times significantly after the first run. First build downloads all dependencies and can take 5-10 minutes.

"No key with alias found in keystore" — Double-check your KEY_ALIAS secret matches exactly what you used when creating the keystore.

"Failed to read key from store" — Your base64 encoding might be corrupted. Re-encode the keystore and update the secret.

Pro Tips

Concurrency groups prevent wasted CI minutes. If you push twice quickly, the first run cancels automatically.

Tag-based triggers for Play Store are ideal — push a v1.0.0 tag when you're ready to release, and CI handles the rest.

Firebase Distribution is great for internal testing — testers get a notification with each new build, no Play Store review required.

The Easy Way

Don't want to write YAML by hand? I built Run Lane — a free visual configurator that generates GitHub Actions workflows for Android and iOS. Pick your platform, choose your distribution target, and download a ready-to-use workflow. No account needed.

Tags: android, github, cicd, kotlin

How to Deploy Your iOS App to TestFlight with GitHub Actions (Step-by-Step)

Aleksandr Ilinskiy — Wed, 18 Feb 2026 20:15:56 +0000

Setting up CI/CD for iOS is significantly harder than for web apps. You need macOS runners, the right Xcode version, code signing certificates, provisioning profiles, and App Store Connect API keys — all configured correctly in a YAML file.

This guide walks you through the complete setup, from zero to a working GitHub Actions workflow that builds your app and uploads it to TestFlight on every push to main.

Prerequisites

Before you start, make sure you have:

An Apple Developer account ($99/year)
Your app set up in App Store Connect
An Xcode project that builds locally
A GitHub repository

Step 1: Create an App Store Connect API Key

Apple deprecated password-based authentication. You need an API key.

Go to App Store Connect → Users and Access → Keys
Click Generate API Key
Name it "GitHub Actions CI" and give it Developer role
Download the .p8 file (you can only download it once!)
Note the Key ID and Issuer ID from the page

Step 2: Export Your Code Signing Certificate

You need your distribution certificate as a base64-encoded .p12 file.

Open Keychain Access on your Mac
Find your "Apple Distribution" certificate
Right-click → Export → save as .p12 with a password
Base64-encode it:

base64 -i Certificates.p12 | pbcopy

This copies the encoded string to your clipboard.

Step 3: Add GitHub Secrets

Go to your repo → Settings → Secrets and variables → Actions and add these secrets:

Secret Name	Value
`CERTIFICATES_P12`	Base64-encoded .p12 certificate
`CERTIFICATES_P12_PASSWORD`	Password you set when exporting
`APPSTORE_ISSUER_ID`	From App Store Connect API page
`APPSTORE_KEY_ID`	From App Store Connect API page
`APPSTORE_PRIVATE_KEY`	Full contents of the .p8 file
`APPLE_TEAM_ID`	Your 10-character Team ID

You can find your Team ID at developer.apple.com/account → Membership.

Step 4: Create the Workflow File

Create .github/workflows/ios-testflight.yml in your repository:

name: iOS — Build & Deploy to TestFlight

on:
  push:
    branches: [main]

jobs:
  build:
    name: Build & Upload to TestFlight
    runs-on: macos-14

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Cache CocoaPods
        uses: actions/cache@v4
        with:
          path: Pods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Install CocoaPods
        run: pod install --repo-update

      - name: Select Xcode 15.2
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: '15.2'

      - name: Import Code-Signing Certificate
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}

      - name: Import Provisioning Profile
        uses: apple-actions/download-provisioning-profiles@v1
        with:
          bundle-id: 'com.yourcompany.yourapp'
          issuer-id: ${{ secrets.APPSTORE_ISSUER_ID }}
          api-key-id: ${{ secrets.APPSTORE_KEY_ID }}
          api-private-key: ${{ secrets.APPSTORE_PRIVATE_KEY }}

      - name: Build & Archive
        run: |
          xcodebuild archive \
            -scheme YourApp \
            -configuration Release \
            -archivePath $RUNNER_TEMP/YourApp.xcarchive \
            -destination "generic/platform=iOS" \
            CODE_SIGN_STYLE=Manual \
            DEVELOPMENT_TEAM=${{ secrets.APPLE_TEAM_ID }}

      - name: Export IPA
        run: |
          xcodebuild -exportArchive \
            -archivePath $RUNNER_TEMP/YourApp.xcarchive \
            -exportPath $RUNNER_TEMP/export \
            -exportOptionsPlist ExportOptions.plist

      - name: Upload to TestFlight
        uses: apple-actions/upload-testflight-build@v1
        with:
          app-path: ${{ runner.temp }}/export/YourApp.ipa
          issuer-id: ${{ secrets.APPSTORE_ISSUER_ID }}
          api-key-id: ${{ secrets.APPSTORE_KEY_ID }}
          api-private-key: ${{ secrets.APPSTORE_PRIVATE_KEY }}

Important: Replace YourApp with your actual Xcode scheme name and com.yourcompany.yourapp with your Bundle ID.

Step 5: Create ExportOptions.plist

Create ExportOptions.plist in your project root:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>method</key>
    <string>app-store</string>
    <key>destination</key>
    <string>export</string>
    <key>signingStyle</key>
    <string>manual</string>
    <key>teamID</key>
    <string>YOUR_TEAM_ID</string>
    <key>uploadSymbols</key>
    <true/>
</dict>
</plist>

Step 6: Push and Watch

git add .
git commit -m "Add TestFlight CI/CD workflow"
git push origin main

Go to your repo → Actions tab. You should see the workflow running. First build takes 10-15 minutes. If everything is configured correctly, your app will appear in TestFlight within 15-30 minutes after the build completes.

Common Issues

"No signing certificate found" — Your P12 wasn't imported correctly. Make sure you base64-encoded the entire file and the password matches.

"No provisioning profile found" — Check that your Bundle ID in the workflow matches exactly what's in App Store Connect. Also verify your API key has the Developer role.

"xcodebuild: error: The run destination is not valid" — You're using the wrong macOS runner. Xcode 15.x needs macos-14, Xcode 14.x needs macos-13.

Build succeeds but no TestFlight upload — Check that ExportOptions.plist has method set to app-store and your Team ID is correct.

The Easy Way

If you don't want to write YAML by hand, I built Run Lane — a free visual configurator that generates these workflows for you. Pick iOS + TestFlight, fill in your scheme and Bundle ID, and download a ready-to-use workflow file. No account needed.

It also supports Firebase Distribution and Android (Play Store, Firebase).

Tags: ios, github, cicd, swift