hjemmesidekongen/expo-cicd
plugins/smedjen/skills/expo-cicd/SKILL.md
CI/CD with EAS, GitHub Actions, app distribution, and automated build/deploy pipelines for Expo.
development
Updated Apr 5, 2026
$ install --global
skillsauthnpx skillsauth add hjemmesidekongen/ai expo-cicdInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:41 PM2.3s1 file scanned
SKILL.md
- name:
- expo-cicd
- description:
- >
- user_invocable:
- false
- interactive:
- false
- model_tier:
- senior
- depends_on:
- []
- reads:
- []
- writes:
- []
- type:
- data_validation
- - name:
- channel_matches_branch
- verify:
- Production EAS Update channel only receives pushes from the production/main branch
- fail_action:
- Gate eas update --channel production behind a branch condition in the workflow
- on_fail:
- CI/CD pipeline has gaps that risk bad builds reaching users — fix before enabling automation
- on_pass:
- Expo CI/CD pipeline is correctly configured
- origin:
- smedjen
- inspired_by:
- original
- ported_date:
- 2026-03-10
- iteration:
- 1
- changes:
- Original skill, no port
expo-cicd
EAS + GitHub Actions is the standard Expo CI/CD stack. The split is clear: GitHub Actions handles the workflow orchestration; EAS handles the actual build and update infrastructure.
Workflow Topology
Three workflows cover the full lifecycle:
PR workflow — triggers on pull_request. Runs lint, type-check, and tests. Triggers a preview EAS Build (internal distribution). Posts build URL or QR as a PR comment via expo-github-action.
Main branch workflow — triggers on push to main. Runs tests, then publishes an OTA update to the staging channel via eas update. Optionally triggers a production build if native changes are detected.
Release workflow — triggers on version tag or manual dispatch. Runs a production EAS Build and submits to stores via eas submit.
Key Rules
EXPO_TOKENgoes in GitHub Secrets — never in YAML. The token is account-scoped and rotatable.- Cache
node_moduleskeyed onpackage-lock.jsonhash. EAS also has its own remote build cache — enable it ineas.jsonwith"cache": { "disabled": false }. - For monorepos, set
"buildArtifactPaths"and pointworkingDirectoryineas.jsonprofiles to the app package. - Detect native changes between commits using
git diff --name-only HEAD~1 HEADpiped through a path filter — only trigger full native builds whenios/,android/,package.json, orapp.jsonchange. - OTA updates (
eas update) are fast (under 2 min). Native builds take 10-20 min. Avoid triggering native builds unnecessarily.
Testing in CI
Run unit tests before any build step. For E2E: Maestro runs on real devices via EAS; Detox runs on simulators and is harder to configure in CI. Prefer Maestro for Expo E2E in CI.
App Distribution
- Internal testers: use
--profile previewwith"distribution": "internal"— no store review. - TestFlight: EAS Submit with
--platform iosafter a production iOS build. - Play Console internal track: EAS Submit with
--platform androidsubmits an AAB.
Versioning Automation
Expo can auto-increment buildNumber (iOS) and versionCode (Android) in EAS by setting "autoIncrement": true in the eas.json build profile. Keep version in app.json as the human-readable semver; let EAS manage the store integers.
See references/process.md for full workflow YAML examples, EAS config snippets, monorepo CI setup, secrets management, Detox/Maestro CI setup, and anti-patterns.
Related Skills
hjemmesidekongen/brand-strategy
development
VerifiedTrustedCommunity
Creates a brand from scratch through market research and interactive sparring. Runs competitive research via Perplexity, then guides the user through positioning, audience, voice, values, and content pillars. Produces the full brand guideline set at .ai/brand/{name}/. Use when building a new brand, defining brand strategy for a product, or when /våbenskjold:create is invoked.
SKILL.mdUpdated Apr 5, 2026
hjemmesidekongen/brand-loader
testing
VerifiedTrustedCommunity
Loads brand guidelines from .ai/brand/{name}/ and makes them available to the current context. Progressive disclosure: L1 confirms brand exists, L2 loads summary, L3 loads specific files on demand. Use when a downstream skill or user needs brand context, or when /våbenskjold:apply is invoked.
SKILL.mdUpdated Apr 5, 2026
hjemmesidekongen/brand-evolve
documentation
VerifiedTrustedCommunity
Guided reinvention of an existing brand guideline. Loads current brand from .ai/brand/{name}/, identifies what to keep vs change, and walks the user through targeted evolution. Preserves brand equity while updating positioning, voice, or values. Use when refreshing a brand or when /våbenskjold:evolve is invoked.
SKILL.mdUpdated Apr 5, 2026
hjemmesidekongen/brand-audit
development
VerifiedTrustedCommunity
Codifies an existing brand from materials, samples, and references. Analyzes provided content to extract voice patterns, values, and positioning. Produces the same guideline format as brand-strategy. Use when a brand already exists but isn't documented, or when /våbenskjold:audit is invoked.
SKILL.mdUpdated Apr 5, 2026