Flutter: CI/CD Automation
Manual releases are a breeding ground for human error — automation makes every step repeatable, traceable, and trustworthy.
📋 Prerequisites: You should have mastered the following first
- Lesson 23: Web and Desktop Multi-Platform Deployment
1. What You Will Learn
- GitHub Actions workflows: flutter test / flutter build multi-matrix builds
- Code Signing automation: Android keystore / iOS certificates and Provisioning Profile management
- Fastlane integration: automated screenshots / automated TestFlight / Play Console uploads
- Codemagic / Bitrise cloud CI solutions comparison
- ShopApp: GitHub Actions cross-platform automated build + Slack notification + auto-tag release
2. A Real Story of a Manual Release Disaster
(1) The Pain: 4-Hour Manual Releases + 3 Rework Cycles
Every time Bob releases a new ShopApp version, he must: manually run flutter build → sign → upload to Play Console → take screenshots → fill in release notes → submit for review. The iOS process is even more complex: Archive → export IPA → upload to App Store Connect → wait for review. The entire process takes 4 hours, with at least 2 rework cycles (forgot to bump version / wrong signing config / non-compliant screenshots). Every release day, Bob works late into the night.
(2) CI/CD Pipeline Solution
GitHub Actions automation: push a tag → automatic testing → automatic build → automatic signing → automatic upload → Slack notification. Zero manual intervention throughout.
YAML
# Push tag v1.2.3 → automatic release pipeline
on: push: tags: ['v*']
# → flutter test → flutter build → sign → upload → notify
(3) The Result: 1-Hour Releases + Zero Rework
After setting up CI/CD, Bob's release time dropped from 4 hours to 1 hour (mostly waiting for review), and the rework rate dropped from 60% to 0%.
3. CI/CD Pipeline Overview
graph LR
subgraph GitHub Actions Pipeline
P[Push / PR] --> LINT[Lint & Analyze]
LINT --> TEST[flutter test]
TEST --> BUILD[Build APK/IPA/Web]
BUILD --> SIGN[Code Signing]
SIGN --> DIST[Distribute]
DIST --> |Slack| NOTIFY[Team Notification]
end
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
(1) CI/CD Solutions Comparison
| Solution | Price | Platform Support | Configuration | Best For |
|---|---|---|---|---|
| GitHub Actions | Free (2000 min/month) | All platforms | YAML | First choice |
| Codemagic | Free (500 min/month) | All platforms | YAML | Better macOS builds |
| Bitrise | Free (200 min/month) | All platforms | UI + YAML | iOS-specific |
| Fastlane | Free (local) | iOS/Android | Ruby | Local automation |
| Cirrus CI | Free (open source) | All platforms | YAML | Community projects |
4. GitHub Actions Workflows
▶ Example
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
: PR check workflow
YAML
# .github/workflows/pr-check.yml
name: PR Check
on:
pull_request:
branches: [main]
jobs:
analyze-and-test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Flutter
uses: subosito/flutter-action@v2
with:
flutter-version: '3.x'
channel: 'stable'
- name: Install dependencies
run: flutter pub get
- name: Analyze code
run: flutter analyze --no-fatal-infos
- name: Run unit and widget tests
run: flutter test --coverage
- name: Upload coverage
uses: codecov/codecov-action@v3
with:
files: coverage/lcov.info
▶ Example
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
: Multi-matrix build workflow
YAML
# .github/workflows/build.yml
name: Build All Platforms
on:
push:
tags: ['v*']
jobs:
build-android:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: subosito/flutter-action@v2
with: { flutter-version: '3.x' }
- run: flutter pub get
- run: flutter test
- name: Build APK
run: flutter build apk --release
- name: Build AAB
run: flutter build appbundle --release
env:
KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
- name: Upload to Play Console
uses: r0adkll/upload-google-play@v1
with:
serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT }}
packageName: com.shopapp.app
releaseFiles: build/app/outputs/bundle/release/app-release.aab
track: production
build-ios:
runs-on: macos-latest
steps:
- uses: actions/checkout@v4
- uses: subosito/flutter-action@v2
with: { flutter-version: '3.x' }
- run: flutter pub get
- name: Install CocoaPods
run: cd ios && pod install
- name: Build IPA
run: flutter build ipa --release --export-options-plist=ios/ExportOptions.plist
- name: Upload to App Store Connect
uses: apple/upload-testflight@v1
with:
app-path: build/ios/ipa/shopapp.ipa
issuer-id: ${{ secrets.APPSTORE_ISSUER_ID }}
api-key-id: ${{ secrets.APPSTORE_KEY_ID }}
api-private-key: ${{ secrets.APPSTORE_PRIVATE_KEY }}
build-web:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: subosito/flutter-action@v2
with: { flutter-version: '3.x' }
- run: flutter pub get
- run: flutter build web --wasm
- name: Deploy to Firebase Hosting
uses: FirebaseExtended/action-hosting-deploy@v0
with:
repoToken: ${{ secrets.GITHUB_TOKEN }}
firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
channelId: live
notify:
needs: [build-android, build-ios, build-web]
runs-on: ubuntu-latest
steps:
- name: Slack Notification
uses: slackapi/slack-github-action@v1
with:
payload: |
{"text": "ShopApp ${{ github.ref_name }} released successfully!"}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
5. Code Signing Automation
▶ Example
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
: Android signing configuration
YAML
# GitHub Secrets needed:
# KEYSTORE_BASE64: base64 encoded .jks file
# KEY_PASSWORD: keystore password
# KEY_ALIAS: key alias
- name: Decode keystore
run: echo "$KEYSTORE_BASE64" | base64 --decode > android/app/keystore.jks
env:
KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
GROOVY
// android/app/build.gradle
android {
signingConfigs {
release {
storeFile file('keystore.jks')
storePassword System.getenv("KEY_PASSWORD")
keyAlias System.getenv("KEY_ALIAS")
keyPassword System.getenv("KEY_PASSWORD")
}
}
buildTypes {
release {
signingConfig signingConfigs.release
minifyEnabled true
shrinkResources true
proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
}
}
}
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
6. Fastlane Integration
▶ Example
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
: Fastlane configuration
RUBY
# ios/fastlane/Fastfile
default_platform(:ios)
platform :ios do
desc "Build and upload to TestFlight"
lane :beta do
build_app(
workspace: "Runner.xcworkspace",
scheme: "Runner",
export_method: "app-store",
)
upload_to_testflight(
skip_waiting_for_build_processing: true,
)
end
desc "Take screenshots"
lane :screenshots do
capture_screenshots(
scheme: "Runner",
devices: ["iPhone 15 Pro", "iPad Pro (12.9-inch)"],
)
end
end
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
RUBY
# android/fastlane/Fastfile
default_platform(:android)
platform :android do
desc "Build and upload to Play Console"
lane :beta do
gradle(task: "bundleRelease")
upload_to_play_store(
track: "internal",
aab: "../build/app/outputs/bundle/release/app-release.aab",
)
end
end
TEXT
> Output: Run on a local Flutter SDK (Flutter 3.x / Dart 3.x). The Piston server does not have Flutter installed; please use `flutter run` on your local machine for comparison. Actual UI/state may vary slightly by platform.
7. Complete Example: ShopApp CI/CD Configuration
YAML
# .github/workflows/release.yml
name: Release ShopApp
on:
push:
tags: ['v*.*.*']
concurrency:
group: release-${{ github.ref }}
cancel-in-progress: true
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: subosito/flutter-action@v2
with: { flutter-version: '3.x', channel: 'stable' }
- run: flutter pub get
- run: flutter analyze --no-fatal-infos
- run: flutter test --coverage
- uses: codecov/codecov-action@v3
build-android:
needs: test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: subosito/flutter-action@v2
with: { flutter-version: '3.x' }
- run: flutter pub get
- name: Decode keystore
run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > android/app/keystore.jks
- name: Build AAB
run: flutter build appbundle --release
env:
KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
- name: Upload AAB artifact
uses: actions/upload-artifact@v4
with: { name: app-release-aab, path: build/app/outputs/bundle/release/app-release.aab }
build-ios:
needs: test
runs-on: macos-latest
steps:
- uses: actions/checkout@v4
- uses: subosito/flutter-action@v2
with: { flutter-version: '3.x' }
- run: flutter pub get
- run: cd ios && pod install
- name: Build IPA
run: flutter build ipa --release --export-options-plist=ios/ExportOptions.plist
- uses: actions/upload-artifact@v4
with: { name: app-release-ipa, path: build/ios/ipa/*.ipa }
build-web:
needs: test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: subosito/flutter-action@v2
with: { flutter-version: '3.x' }
- run: flutter pub get
- run: flutter build web --wasm --base-href "/app/"
- uses: actions/upload-artifact@v4
with: { name: web-release, path: build/web/ }
release:
needs: [build-android, build-ios, build-web]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Create GitHub Release
uses: softprops/action-gh-release@v1
with:
generate_release_notes: true
draft: false
- name: Slack notify
uses: slackapi/slack-github-action@v1
with:
payload: '{"text": "ShopApp ${{ github.ref_name }} released to all platforms!"}'
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
❓ FAQ
Q Is the GitHub Actions free tier sufficient?
A Open-source projects have unlimited minutes. Private projects get 2000 minutes/month — a full cross-platform build takes about 30-40 minutes, so roughly 50 builds per month.
Q Must iOS builds use a macOS runner?
A Yes, Xcode only runs on macOS. GitHub provides macOS runners, but billing is 10x the Linux rate. Use Codemagic to save macOS minutes.
Q How should I securely store signing keys?
A Use GitHub Secrets (Base64-encode keystore/certificates), never commit them to the repository. Enable Secret scanning.
Q How do I speed up Flutter builds with caching?
A Use
actions/cache to cache pub-cache and gradle-cache — build time drops from 5 minutes to 2 minutes.Q How do Fastlane and GitHub Actions work together?
A GitHub Actions triggers the build, Fastlane handles signing and uploading. Fastlane runs most conveniently on a macOS runner.
Q How do I roll back a live version?
A Google Play Console supports rolling back to a previous version; App Store requires submitting a new version. CI/CD should retain all historical build artifacts.
📖 Summary
- GitHub Actions is the first choice for Flutter CI/CD — YAML configuration + multi-matrix builds
- Android signing uses Base64-encoded keystore stored in GitHub Secrets
- iOS builds require a macOS runner; certificates are stored in Secrets
- Fastlane automates screenshots and uploads to TestFlight/Play Console
- Complete pipeline: test → build → sign → upload → notify
📝 Exercises
- Basic (Difficulty ⭐): Configure a GitHub Actions PR check workflow: flutter analyze + flutter test.
- Intermediate (Difficulty ⭐⭐): Add an Android AAB build step, manage signing keys with GitHub Secrets, and upload the artifact after building.
- Challenge (Difficulty ⭐⭐⭐): Implement a complete CI/CD pipeline: PR checks (lint + test) + tag-triggered cross-platform builds (Android AAB + iOS IPA + Web) + automatic signing + GitHub Release + Slack notification.
← Previous Lesson | Next Lesson →
