NOVEMBER 2, 2026

Mobile App CI/CD for React Native, Expo and Flutter: Build, Sign and Ship in 2026

A practical guide to mobile app CI/CD for cross-platform apps: EAS Build and Submit, Fastlane, Codemagic, GitHub Actions macOS runners, code signing, TestFlight, OTA update limits and staged rollouts.

Omer Shalom

Posted By Omer Shalom

5 Minutes read

Short answer: Mobile app CI/CD automates four jobs that teams otherwise do by hand: building the iOS and Android binaries, signing them, sending them to testers and releasing them to the stores in stages. For React Native with Expo, EAS Build and EAS Submit cover most of it; for Flutter or bare React Native, Fastlane on GitHub Actions or Codemagic is the common setup. Code signing is usually the hard part.

Key takeaways

  • iOS needs a Mac: iOS builds run on macOS, and GitHub-hosted macOS minutes cost roughly ten times the Linux rate.
  • Signing belongs in the pipeline: fastlane match keeps certificates and provisioning profiles encrypted in a private git repo, so CI and every developer sign with the same identity.
  • OTA updates have limits: EAS Update and Shorebird ship JavaScript or Dart changes without a store release, but native changes still need a new build.
  • Release in stages: App Store phased release spreads an update over seven days; Google Play staged rollouts reach a percentage of users that the team raises manually.

The pipeline, step by step

A typical pipeline runs on every merge to main: install dependencies, run lint and unit tests, build a signed iOS .ipa and Android .aab, and upload both to testers. Google Play has required new apps to publish as Android App Bundles with Play App Signing since August 2021. TestFlight accepts up to 10,000 external testers and each build expires after 90 days; the Play internal testing track takes up to 100 testers and is the fastest route to real devices.

Choosing the tools

ToolFitsWhat it does
EAS Build + EAS SubmitExpo and React NativeCloud builds; uploads the .ipa to App Store Connect and the .aab to a chosen Play track
FastlaneAny stackOpen-source lanes for building, signing with match, and uploading to TestFlight and Play
CodemagicFlutter, React Native, nativeHosted CI on Apple silicon Macs, configured in codemagic.yaml
GitHub ActionsAny stackHosted macOS runners that usually run Fastlane or the EAS CLI

Let's Talk About Your Project

OTA updates, rollouts and where to start

Over-the-air updates save the most time and break store rules most easily. EAS Update matches each update to a build by runtime version, so a JavaScript bundle never lands on a binary with incompatible native code; Shorebird does the same for Flutter's Dart code. Apple guideline 2.5.2 bars downloaded code that introduces or changes features, so OTA is best kept for bug fixes, copy and layout, with new features going through review.

Apple's phased release can be paused for up to 30 days in total. A halted Google Play rollout stops new installs but leaves users who already updated on that version, so the fix is a new release. Crash monitoring in those days also feeds onboarding and retention work.

Setting up the pipeline in the first sprint costs a few days up front and removes manual work from every release after it. Schedule effects are covered in how long it takes to build an app, and on budget in app development cost in Israel. The same pipeline is where security scans run, as described in mobile app security best practices. For startups preparing a first release, the pipeline belongs on the software development roadmap as an early task. To review an existing setup, book a release-pipeline review call.

Frequently asked questions

Do I need a Mac to build an iOS app in CI?

iOS builds need macOS and Xcode, but the Mac does not have to be on the desk. EAS Build, Codemagic and GitHub-hosted macOS runners provide one in the cloud, and EAS Submit can upload iOS builds from Windows or Linux.

Can a React Native app be updated without App Store review?

JavaScript and asset changes can ship through EAS Update, provided they do not add or change features (Apple guideline 2.5.2). Native code changes require a new build and a normal review.

Should a team use EAS or Fastlane?

Expo projects get build, credentials and submission from EAS with little configuration. Fastlane suits Flutter, bare React Native or teams that want full control on their own runners, and the two combine well.

What is the difference between TestFlight and Play internal testing?

TestFlight allows up to 10,000 external testers, and each build is available for 90 days. Play internal testing is limited to 100 testers and suits quick early checks.

More articles that may interest you

Mobile App Security Best Practices for Business Apps in 2026: A DevSecOps Checklist

Mobile app security best practices for 2026: OWASP MASVS and the Mobile Top 10, Keychain and Keystore storage, certificate pinning tradeoffs, secrets kept out of the binary, CI scanning and Israeli privacy rules.

Omer Shalom

By Omer Shalom

5 Minutes read

Read More

App Onboarding and User Retention in 2026: Activation, Cohorts and Nudges

A practical guide to app onboarding and user retention: define one activation event, shorten time-to-value, design empty states, read retention cohorts in PostHog, Mixpanel or Amplitude, and send nudges users agreed to.

Omer Shalom

By Omer Shalom

5 Minutes read

Read More

App Development Cost in Israel (2026): What Drives the Price of an MVP, Mobile App and Enterprise System

What an app costs in Israel depends on complexity, team model and AI components. This guide breaks down the real cost drivers, what Israeli agencies quote vs. what projects actually cost, and how to scope a project before talking to any vendor.

Omer Shalom

By Omer Shalom

7 Minutes read

Read More

Tell us what you need

One of our engineers will get back to you within 24 hours.