Home / CI integration
CI integration

Android package registration check with Fastlane

Place an Android developer verification preflight before Fastlane upload or promotion lanes.

Operational summary

Fastlane can treat registration as a release prerequisite alongside signing, metadata and store upload checks. Keep the network check close to promotion so it reflects the package being released.

Built for: Mobile release teams using Fastlane supply, gradle or custom lanes.
Best placementAfter signing, before upload or promotion
Failure outputStable status and remediation URL
Do not logSecrets or private signing material

Recommended sequence

  1. Read the release application ID from the same configuration used by the lane.
  2. Extract the certificate fingerprint from the signed APK produced by the lane.
  3. Call a protected checker endpoint and parse the stable state field.
  4. Stop the lane on NOT_REGISTERED or certificate mismatch and link remediation.
Field note: Use retries only for network or quota errors. A stable registration mismatch needs human remediation, not repeated calls.

Put the check after signing

A Fastlane lane should extract identity from the artifact it is about to promote. Running earlier can check the wrong flavor, package suffix or certificate.

Use sh or a small Ruby action to call the official API, parse JSON and raise a clear UI.user_error! for stable registration failures. Keep transient network handling separate so repeated calls do not hide a real mismatch.

  • Build and sign first.
  • Check the production application ID.
  • Link the failure message to a remediation guide.
Fastlane lane fragment
status = sh("curl --fail --silent -H 'X-Goog-Api-Key: #{ENV.fetch('ANDROID_DEVELOPER_ID_API_KEY')}' '#{endpoint}' | jq -r .state").strip
UI.user_error!("Android package is #{status}") unless status == "REGISTERED"

Frequently asked questions

Should the lane retry a certificate mismatch?

No. That is a stable identity result requiring investigation.

Can the public fingerprint appear in logs?

It is not the private key, but teams can still minimize logs and retain it only in controlled release evidence.

Sources and review

PkgReady summarizes operational implications but does not replace an official console or Android documentation. Reviewed 2026-08-14.