Operational summary
Gradle knows the application ID and build variant, making it the right place to export reliable checker inputs. The status call itself should remain a release task, not run on every local debug build.
Recommended sequence
- Resolve applicationId from the selected release variant.
- Run the check only after the production artifact has been signed.
- Extract the certificate SHA-256 with Android build tools.
- Emit a small machine-readable result for CI without exposing credentials.
Resolve values from the selected variant
Modern Android builds can have multiple application IDs and signing configurations. Wire a release-only task to the selected variant and the signed output instead of maintaining a second hard-coded identity list.
Keep the network request outside normal compile and test tasks. Export package name and fingerprint as a small machine-readable artifact, then let CI perform the protected API call.
- Do not run on every developer debug build.
- Do not assume namespace equals applicationId.
- Do not read a debug signing configuration for release checks.
./gradlew assembleRelease
apksigner verify --print-certs app/build/outputs/apk/release/app-release.apkFrequently asked questions
Why not call the API directly from every Gradle build?
It wastes quota, slows local builds and requires credentials in more environments. Run it as a controlled release preflight.
How should flavors be represented?
Use the final variant application ID and the certificate on that variant's signed artifact.
Sources and review
PkgReady summarizes operational implications but does not replace an official console or Android documentation. Reviewed 2026-08-14.