ops-mobile-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ops-mobile-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
# fastlane/Fastfile
default_platform(:ios)
platform :ios do
desc "Deploy to TestFlight"
lane :beta do
increment_build_number
build_app(scheme: "MyApp")
upload_to_testflight
end
desc "Deploy to App Store"
lane :release do
increment_build_number
build_app(scheme: "MyApp")
upload_to_app_store
end
end
platform :android do
desc "Deploy to Play Store Internal"
lane :beta do
gradle(task: "bundleRelease")
upload_to_play_store(track: "internal")
end
desc "Deploy to Play Store"
lane :release do
gradle(task: "bundleRelease")
upload_to_play_store
end
endname: Mobile Release
on:
push:
tags:
- 'v*'
jobs:
ios:
runs-on: macos-latest
steps:
- uses: actions/checkout@v7
- uses: ruby/setup-ruby@v1
with:
bundler-cache: true # runs bundle install, caches gems
- run: bundle exec fastlane ios release
env:
# JSON {"key_id", "issuer_id", "key"}: read as `api_key` by deliver/pilot
# (upload_to_app_store, upload_to_testflight)
APP_STORE_CONNECT_API_KEY: ${{ secrets.ASC_API_KEY_JSON }}
android:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-java@v6
with:
distribution: 'temurin'
java-version: '17'
- uses: ruby/setup-ruby@v1
with:
bundler-cache: true # fastlane runs through Bundler: Ruby + gems first
- run: bundle exec fastlane android release
env:
SUPPLY_JSON_KEY_DATA: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }} # read by supplyIf the app ships with Expo / EAS, Expo's own eas-app-stores skill (expo/skills, MIT, pin 13ad8e05) covers eas.json, signing, versions and store submission. EAS has a free tier and paid plans; the skill states their limits. Fastlane publishes no skill: the fastlane path stays here.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.