android-playstore-publishing
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The templates execute standard shell commands to build Android deployment artifacts using Gradle (e.g.,
./gradlew bundleRelease). It also performs routine environment setup tasks such as setting file permissions for the Gradle wrapper and managing the signing keystore file.- [EXTERNAL_DOWNLOADS]: The generated GitHub Action workflows reference established third-party actions to facilitate deployment and testing. This includes usingr0adkll/upload-google-playfor interacting with the Google Play Developer API,reactivecircus/android-emulator-runnerfor executing end-to-end tests on virtual devices, andsoftprops/action-gh-releasefor automating GitHub releases.- [CREDENTIALS_UNSAFE]: The skill requires the use of sensitive deployment secrets, including Play Store service account keys and Android signing keystores. The provided templates follow security best practices by recommending the use of GitHub Secrets for storage and implementing restricted file permissions (chmod 600) and cleanup routines (rm -f release.jks) within the workflows to minimize credential exposure.
Audit Metadata