Flutter ci cd

CI/CD for Flutter

Instructions

A healthy Flutter project runs analyze + test on every PR, produces installable artifacts on main, and ships to the stores with one click (or automatically on a tag).

1. The Three Pipelines

1. PR pipeline — fast feedback: format check, flutter analyze, flutter test, optionally widget goldens. Target < 5 minutes.
2. Main pipeline — produces debug APK, iOS simulator build, integration tests on an emulator, coverage upload.
3. Release pipeline — signs release builds, uploads to internal testing tracks, optionally promotes on approval.

2. GitHub Actions — PR Workflow

.github/workflows/pr.yml:

name: PR
on: { pull_request: { branches: [main] } }

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.22.0'
          channel: stable
          cache: true
      - run: flutter pub get
      - run: dart format --set-exit-if-changed .
      - run: flutter analyze --fatal-infos
      - run: dart run build_runner build --delete-conflicting-outputs
      - run: flutter test --coverage
      - uses: codecov/codecov-action@v4
        with: { file: coverage/lcov.info }

3. Caching

• Cache ~/.pub-cache, ~/.gradle/caches, ~/Library/Caches/CocoaPods, and the Flutter SDK (the subosito/flutter-action does this with cache: true).
• Cache by pubspec.lock hash for Pub, Gemfile.lock for Fastlane, Podfile.lock for Pods.

4. Android Release Signing

• Generate upload-keystore.jks once; never commit it.
• Base64-encode and store as a GitHub secret ANDROID_KEYSTORE_BASE64, plus KEYSTORE_PASSWORD, KEY_ALIAS, KEY_PASSWORD.
• In CI, decode into android/upload-keystore.jks and write android/key.properties at runtime.
• In android/app/build.gradle, read from key.properties for the release signingConfig.
• Prefer Play App Signing — you only keep the upload key; Google manages the actual signing key.

5. iOS Release Signing

• Use match (fastlane) or App Store Connect API keys — never check in .p12 or provisioning profiles.
• Store APP_STORE_CONNECT_KEY_ID, APP_STORE_CONNECT_ISSUER_ID, and the base64 .p8 as secrets.
• fastlane match appstore --readonly in CI fetches certs into a temporary keychain.

6. Fastlane Lanes

ios/fastlane/Fastfile:

platform :ios do
  desc "Push a new beta build to TestFlight"
  lane :beta do
    setup_ci
    match(type: "appstore", readonly: true)
    build_app(workspace: "Runner.xcworkspace", scheme: "prod")
    upload_to_testflight(skip_waiting_for_build_processing: true)
  end
end

Android counterpart uses supply to upload an AAB to the internal track.

7. Release Workflow (Tag-Triggered)

on:
  push:
    tags: ['v*.*.*']
jobs:
  android:
    runs-on: ubuntu-latest
    steps:
      # decode keystore, flutter build appbundle --flavor prod -t lib/main_prod.dart
      # fastlane supply --aab build/app/outputs/bundle/prodRelease/app-prod-release.aab --track internal
  ios:
    runs-on: macos-14
    steps:
      # flutter build ipa --flavor prod -t lib/main_prod.dart --export-options-plist=ios/ExportOptions.plist
      # cd ios && bundle exec fastlane beta

Derive the version from the tag (v1.4.2 → buildName=1.4.2, buildNumber=$GITHUB_RUN_NUMBER) via flutter build ... --build-name=... --build-number=....

8. Codemagic / Bitrise (alternative)

If you want managed mac runners and a UI, Codemagic has first-class Flutter templates and handles signing end-to-end. Use when the team prefers not to maintain self-hosted macOS runners.

9. Web, Desktop, WASM

• Web: flutter build web --wasm (Flutter 3.22+) and deploy to Firebase Hosting / Cloudflare Pages / GitHub Pages.
• macOS: codesign + notarize via codesign + xcrun notarytool submit in the pipeline.
• Windows: build MSIX with msix package; sign with EV cert in CI.
• Linux: package as AppImage, Snap, or Flatpak.

10. Secrets Hygiene

• No secret in --dart-define that appears in logs (GitHub Actions masks known secrets, but mis-named env vars leak).
• Rotate signing passwords yearly.
• Use environment protection rules on the release workflow (require manual approval).
• Strip debug symbols and obfuscate release builds: --obfuscate --split-debug-info=build/symbols.

11. Checklist

• PR pipeline runs analyze + test < 5 min.
• Coverage uploaded and enforced (e.g., minimum 70%).
• Release pipeline signs and uploads to an internal track automatically on tags.
• Versioning derived from tags or monotonic CI number — never hand-edited.
• Dependabot / Renovate updates pubspec.yaml, Gradle, Pods, and Actions weekly.