CI/CD Pipeline: GitHub Actions and Firebase App Distribution

Every push or pull request to the main, master, or test branches triggers the Android CI Build GitHub Actions workflow defined in .github/workflows/android-ci.yml. The workflow runs on ubuntu-latest, configures a Java 17 environment with Gradle caching, performs static analysis and tests, produces debug and release APKs, and distributes the debug build to testers via Firebase App Distribution on pushes to main or master.

Workflow Triggers

on:
  push:
    branches: [ "main", "master", "test" ]
  pull_request:
    branches: [ "main", "master", "test" ]

The release APK build and Firebase App Distribution steps only execute on direct pushes to main or master (not on pull requests or the test branch).

Job Steps

Checkout the code

Fetches the repository at the current commit using actions/checkout@v4.

- name: Checkout del código
  uses: actions/checkout@v4

Configure Java 17

Sets up the JDK using the Temurin distribution with Gradle dependency caching enabled. This significantly speeds up subsequent Gradle invocations by reusing cached dependencies across workflow runs.

- name: Configurar Java 17
  uses: actions/setup-java@v4
  with:
    distribution: 'temurin'
    java-version: '17'
    cache: 'gradle'

Create google-services.json per build variant

Decodes the base64-encoded GOOGLE_SERVICES_JSON secret and writes it to all three variant source sets. If the secret is missing, a warning is printed and an empty JSON object is written to allow the build to continue.

- name: Crear archivos google-services.json por variant
  env:
    GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
  run: |
    if [ -z "$GOOGLE_SERVICES_JSON" ]; then
      echo "Warning: GOOGLE_SERVICES_JSON secret is missing"
      echo "{}" > app/google-services.json
    else
      mkdir -p app/src/debug
      mkdir -p app/src/staging
      mkdir -p app/src/release
      echo "$GOOGLE_SERVICES_JSON" | base64 --decode > app/google-services.json
      cp app/google-services.json app/src/debug/google-services.json
      cp app/google-services.json app/src/staging/google-services.json
      cp app/google-services.json app/src/release/google-services.json
    fi

Create local.properties

Writes the Firebase API key into local.properties so the Android Gradle build can read it as a build config field.

- name: Crear archivo local.properties
  env:
    FIREBASE_API_KEY: ${{ secrets.FIREBASE_API_KEY }}
  run: |
    echo "firebase.api.key=$FIREBASE_API_KEY" > local.properties

Make Gradle executable

Grants execute permission to the Gradle wrapper script before any Gradle tasks are invoked. Required on Linux runners where the file may not carry the executable bit after checkout.

- name: Dar permisos al ejecutable Gradle
  run: chmod +x ./gradlew

Run Detekt static analysis

Executes the detekt Gradle task for Kotlin static analysis. The || echo fallback ensures the workflow continues even if the Detekt task is not configured in the project, preventing a hard failure for optional setup.

- name: Ejecutar análisis estático con Detekt
  run: ./gradlew detekt || echo "Detekt task failed or not found, continuing..."

Detekt reports are uploaded as artifacts at the end of the workflow from app/build/reports/detekt/.

Run Android Lint

Runs lintDebug to catch Android-specific code quality issues, XML errors, and resource warnings on the debug variant.

- name: Ejecutar Análisis Estático (Lint)
  run: ./gradlew lintDebug

Lint HTML and XML reports are uploaded as artifacts from app/build/reports/lint-results-debug.*.

Run unit tests

Executes all unit tests for the debug variant. Test reports are uploaded as artifacts from app/build/reports/tests/.

- name: Ejecutar Tests Unitarios
  run: ./gradlew testDebugUnitTest

Build debug APK

Assembles the debug APK. This step runs on every trigger (push and pull request, all configured branches).

- name: Compilar APK de depuración
  run: ./gradlew assembleDebug

Output: app/build/outputs/apk/debug/app-debug.apk

Build release APK (main/master only)

Assembles the release APK only when the workflow is triggered by a push to main or master.

- name: Compilar APK Release
  if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
  run: ./gradlew assembleRelease

Output: app/build/outputs/apk/release/app-release.apk

Upload APK artifacts

Both debug and release APKs are uploaded as GitHub Actions artifacts for download from the workflow run summary.

- name: Subir APK generado
  uses: actions/upload-artifact@v4
  with:
    name: app-debug-apk
    path: app/build/outputs/apk/debug/app-debug.apk

- name: Subir APK Release
  if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
  uses: actions/upload-artifact@v4
  with:
    name: app-release-apk
    path: app/build/outputs/apk/release/app-release.apk

Detekt reports, Lint reports, and test reports are also uploaded under the reports artifact on every run (including failed runs via if: always()).

Distribute via Firebase App Distribution

On pushes to main or master, the debug APK is distributed to the testers group using wzieba/Firebase-Distribution-Github-Action@v1. The release notes include the branch name and the GitHub run number for traceability.

- name: Distribuir APK con Firebase App Distribution
  if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
  uses: wzieba/Firebase-Distribution-Github-Action@v1
  with:
    appId: ${{ secrets.FIREBASE_APP_ID }}
    token: ${{ secrets.FIREBASE_TOKEN }}
    groups: testers
    file: app/build/outputs/apk/debug/app-debug.apk
    releaseNotes: "Build automático desde rama ${{ github.ref_name }} - ${{ github.run_number }}"

Version Code Auto-Increment

The releaseNotes field embeds ${{ github.run_number }}, which is the GITHUB_RUN_NUMBER environment variable — an integer that increments automatically with every workflow run in the repository. This value can also be used as the versionCode in your build.gradle to ensure each distributed build has a unique, monotonically increasing version code:

// In app/build.gradle.kts
android {
    defaultConfig {
        versionCode = System.getenv("GITHUB_RUN_NUMBER")?.toInt() ?: 1
    }
}

Required GitHub Secrets

Configure the following secrets in your repository under Settings → Secrets and variables → Actions → New repository secret:

Secret	Description
`GOOGLE_SERVICES_JSON`	Base64-encoded content of `app/google-services.json`. Encode with `base64 -w 0 app/google-services.json` on Linux or `[Convert]::ToBase64String([IO.File]::ReadAllBytes("app\google-services.json"))` on Windows.
`FIREBASE_API_KEY`	Firebase Web API key. Found in `google-services.json` under `clients[].api_key[].current_key`.
`FIREBASE_APP_ID`	Firebase Android App ID. Found in `google-services.json` under `clients[].client_info.mobilesdk_app_id`.
`FIREBASE_TOKEN`	Firebase CI token used to authenticate App Distribution uploads. Generate with `firebase login:ci`.

Setting Up Secrets Step by Step

Navigate to repository settings

Go to your GitHub repository and click Settings in the top navigation bar.

Open Secrets and variables

In the left sidebar, select Secrets and variables → Actions.

Add each secret

Click New repository secret, enter the secret name exactly as shown in the table above, paste the value, and click Add secret. Repeat for all four secrets.

Verify by triggering the workflow

Push a commit to the test branch. The workflow will run and the secret availability step will print a warning (not fail) if any secret is missing, making it easy to identify which one needs to be added.

Keep FIREBASE_TOKEN secure. It grants full Firebase CLI access to your project, including the ability to deploy Hosting, Firestore rules, and App Distribution builds. Rotate the token periodically using firebase login:ci and delete old tokens from the Firebase console under Project Settings → Service accounts.

Fastlane Lanes

In addition to the GitHub Actions workflow, three Fastlane lanes are available for local development tasks defined in fastlane/Fastfile:

Lane	Command	Description
`validate`	`bundle exec fastlane validate`	Compiles the debug Kotlin sources (`compileDebugKotlin`) to verify the code builds without running a full APK assembly.
`build_debug`	`bundle exec fastlane build_debug`	Assembles a debug APK locally using `assembleDebug`.
`clean`	`bundle exec fastlane clean`	Runs `gradle clean` to delete all build outputs and caches.

platform :android do
  desc "Valida que el codigo Kotlin de debug compile correctamente"
  lane :validate do
    gradle(
      task: ":app:compileDebugKotlin",
      project_dir: "."
    )
  end

  desc "Genera un APK debug local"
  lane :build_debug do
    gradle(
      task: ":app:assembleDebug",
      project_dir: "."
    )
  end

  desc "Limpia archivos de build del proyecto"
  lane :clean do
    gradle(
      task: "clean",
      project_dir: "."
    )
  end
end

Use fastlane validate in pre-commit hooks or local development to quickly verify Kotlin compilation before pushing. It is significantly faster than a full assembleDebug since it skips resource processing and APK packaging.

REST API

Infrastructure

CI/CD Pipeline: GitHub Actions and Firebase App Distribution

Workflow Triggers

Job Steps

Version Code Auto-Increment

Required GitHub Secrets

Setting Up Secrets Step by Step

Fastlane Lanes

Build docs developers (and LLMs) love

REST API

Infrastructure

Documentation Index

​Workflow Triggers

​Job Steps

​Version Code Auto-Increment

​Required GitHub Secrets

​Setting Up Secrets Step by Step

​Fastlane Lanes

Build docs developers (and LLMs) love

Workflow Triggers

Job Steps

Version Code Auto-Increment

Required GitHub Secrets

Setting Up Secrets Step by Step

Fastlane Lanes