configuring-codemagic — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited configuring-codemagic (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Implements Codemagic YAML configurations for Flutter deployment. Codemagic natively understands Flutter, requires no extra tooling for code signing, and provides Apple M-series machines for fast iOS compilation.
The recommended approach is using codemagic.yaml for "Infrastructure as Code," maintaining it within the project repository alongside the source code.
Place codemagic.yaml in the project root. A single file can contain multiple Workflows (e.g., executing iOS deployments and Android deployments separately).
Best Caching Practice: Caching is fundamental to saving CI costs. Be sure to cache Dart dependencies and native build tools.
# 🌟 codemagic.yaml
workflows:
android-release:
name: Android Release Workflow
instance_type: mac_mini_m1 # Specify M1 machine for acceleration
environment:
# 🌟 Specify the Flutter version
flutter: stable
cache:
cache_paths:
- $HOME/.pub-cache # Dart packages
- $HOME/.gradle/caches # Gradle dependenciesNEVER hardcode Keystore passwords or API Keys in the YAML file. Codemagic provides highly secure UI dashboards to create variable groups, encrypt them, and consume them via scripts.
environment:
flutter: stable
groups:
# Pre-configured group names on the Codemagic UI
- keystore_credentials # Contains $KEY_PASSWORD, $ALIAS_PASSWORD
- google_play_credentials # Contains the JSON key path for the Google Service AccountBefore building, utilize the scripts block to execute commands sequentially.
scripts:
- name: ⬇️ Fetch Dependencies
script: flutter packages pub get
- name: ⚙️ Code Generation (build_runner)
script: dart run build_runner build --delete-conflicting-outputs
- name: 🚨 Static Analysis
script: flutter analyze
- name: 🧪 Unit & Widget Tests
script: flutter test
# 🌟 Codemagic automatically parses the test results and displays them on a sleek Web Dashboard
test_report: build/test-results/flutter.json Codemagic's greatest strength lies in condensing complex Code Signing flows into extremely minimalist declarative syntax.
#### 4.1 Android Building (with Keystore)
- name: 🔨 Build Android App Bundle
script: |
# Generate a key.properties for android/app/build.gradle to read
echo "storePassword=$KEYSTORE_PASSWORD" >> android/key.properties
echo "keyPassword=$KEY_PASSWORD" >> android/key.properties
echo "keyAlias=$KEY_ALIAS" >> android/key.properties
echo "storeFile=$KEYSTORE_PATH" >> android/key.properties
# 🌟 The build action
flutter build appbundle --release#### 4.2 iOS Code Signing You typically do not need to manually configure Fastlane Match. Upload your App Store Connect API Key via Codemagic's Web Dashboard, and it automatically handles certificate fetching:
environment: # Declare before Workflow logic: Enable Auto Signing
ios_signing:
distribution_type: app_store
bundle_identifier: com.yourcompany.app
scripts:
- name: 🍏 Build iOS IPA
script: flutter build ipa --releaseOnce the build concludes, declare the target artifacts, and automatically push directly to the stores utilizing built-in modules—no upload scripting required!
artifacts:
- build/app/outputs/bundle/release/**/*.aab
- build/ios/ipa/*.ipa
publishing:
# Auto-email the team
email:
recipients:
- [email protected]
# 🌟 Publish to Google Play (Internal Track)
google_play:
credentials: $GCP_SERVICE_ACCOUNT_CREDENTIALS # The JSON key variable
track: internal
# 🌟 Publish to App Store Connect / TestFlight
app_store_connect:
auth: integration # Corresponds to the integrated Apple account from the Dashboard
submit_to_testflight: truecodemagic.yaml over the Codemagic UI workflow editor — keeping pipeline configuration in the repository alongside source code is the recommended "Infrastructure as Code" approach.bundle exec fastlane <lane> from its scripts block; the two tools are not mutually exclusive.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.