skills/app-store-submission-automator/SKILL.md
App Store and Google Play submission automator with Fastlane, screenshot automation, metadata management, and TestFlight/internal testing. Activate on: app store submission, Fastlane, TestFlight, Google Play Console, screenshot automation, metadata management, app review, code signing, provisioning profiles. NOT for: CI/CD pipeline setup (use github-actions-pipeline-builder), app architecture (use react-native-architect), analytics (use mobile-analytics-crash-reporting-expert).
npx skillsauth add curiositech/windags-skills app-store-submission-automatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Expert in automating App Store and Google Play submissions with Fastlane, screenshot generation, metadata management, and review optimization.
IF first app version OR major feature changes:
└── Use staged rollout: 10% → 50% → 100% over 7 days
└── Monitor crash rates and user feedback at each stage
ELSE IF hotfix or minor update:
└── IF critical security fix:
└── Full rollout immediately
ELSE:
└── Use 50% → 100% over 2-3 days
| Scenario | Days Until Expiry | Action |
|----------|------------------|---------|
| Distribution cert | < 30 days | Run fastlane match nuke distribution, then regenerate |
| Development cert | < 30 days | Run fastlane match nuke development |
| Provisioning profile | < 14 days | Run match with force_for_new_devices: true |
| Push cert | < 30 days | Regenerate in Apple Developer Portal, update server |
IF internal testing needed:
├── iOS: Use TestFlight external groups (up to 10,000 testers)
└── Android: Use internal track (up to 100 testers)
ELSE IF public beta:
├── iOS: Use TestFlight public link
└── Android: Use closed track with opt-in URL
ELSE IF production ready:
├── Check if all store requirements met (see Quality Gates)
└── Use production/release track
Match Credential Mismatch
fastlane match nuke, regenerate all certificates, commit to match repoApp Review Rejection - Missing Info
Build Timeout on Large Apps
build_app stepbuild_timeout: 7200 to build_app action, enable incremental buildsScreenshot Generation Fails
Metadata Character Limit Exceeded
fastlane precheck before submission, trim descriptions to platform limitsScenario: Setting up automated submission for a React Native app with iOS and Android targets
Initial Assessment:
Step 1: Setup Decision
# In project root
fastlane init
# Choose option 4 (Manual setup)
Decision Point Hit: Certificate management strategy
Step 2: Configure Match
# fastlane/Matchfile
git_url("https://github.com/company/certificates")
storage_mode("git")
type("appstore") # Also supports: development, adhoc
Step 3: Create Lanes (Key Decision: Beta vs Production)
# fastlane/Fastfile
desc "TestFlight submission with build number increment"
lane :beta do
setup_ci if ENV['CI']
match(type: "appstore", readonly: true)
# Decision: Always increment build, version only for releases
increment_build_number(build_number: ENV['BUILD_NUMBER'])
build_app(workspace: "ios/MyApp.xcworkspace", scheme: "MyApp")
upload_to_testflight(skip_waiting_for_build_processing: true)
end
Expert Insight: Always use skip_waiting_for_build_processing: true in CI to avoid timeouts
Step 4: Validation Before First Run
fastlane precheck to validate metadataResult: Automated pipeline reducing submission time from 45 minutes to 8 minutes
Pre-submission checklist that must pass before running production lanes:
fastlane precheck passes without warningsDo NOT use this skill for:
CI/CD Pipeline Setup → Use github-actions-pipeline-builder instead
App Architecture Decisions → Use react-native-architect instead
Analytics and Crash Reporting → Use mobile-analytics-crash-reporting-expert instead
App Store Optimization (ASO) → Use dedicated ASO specialist
Backend API Development → Use api-architect instead
When to delegate:
react-native-architectgithub-actions-pipeline-buildermobile-analytics-crash-reporting-experttools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.