Install
$ agentstack add skill-lukedj78-dev-flow-rn-eas-build-submit-update ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
rn-eas-build-submit-update — guardrail for EAS Build / Submit / Update / Workflows
The 5 rules (non-negotiable)
- 3 profiles in
eas.json:development(dev client, internal),preview(TestFlight / Play Internal — test on real devices),production(the store). NEVER ship from a profile not pre-tested in preview. - Credentials server-side via
eas credentials. NEVER commit.p12,.p8,*.keystore,*.jks, orgoogle-services.jsonfor production accounts. EAS holds them; local Apple/Google CLI never touches them. - OTA only for JS-only changes. If the diff touches
app.jsonconfig plugins, native modules, or anything that would changeprebuildoutput → it's a new build, not an Update. - Channels separate environments.
previewchannel for QA,productionchannel for end users. Ship updates topreviewfirst, promote toproductiononly after smoke-test. expo-updatesconfig inapp.jsonis the source of truth for runtime version (runtimeVersion: { policy: "appVersion" }or"sdkVersion"). Mismatched runtime versions = OTAs ignored.
Quick decision tree
- "Build, Submit, or Update — which do I need now?" →
references/decision-tree.md - "How do I write the eas.json profiles?" →
references/eas-json.md - "How do credentials work — where does the cert live?" →
references/credentials.md - "How do I set up EAS Workflows for CI?" →
references/workflows.md - "Did the build/OTA I just shipped actually land OK — do I need a hotfix or rollback?" →
rn-eas-deploy/references/observability.md(EAS Observe for build performance, EAS Update Insights for OTA rollout health)
Common anti-patterns (NEVER do)
- ❌ Committing certificates / keystores to git.
- ❌
eas build --profile productionwithout ever having built--profile previewfor that commit. - ❌
eas update --channel productionwithout--branchand without testing onpreviewchannel first. - ❌ Updating
app.jsonconfig plugins and shipping via OTA — fails silently or crashes on user devices. - ❌ Bumping
versioninapp.jsonwithout also bumpingios.buildNumber/android.versionCode— store reject. - ❌
expo-updateswith defaultruntimeVersion(none) — OTA gets applied to incompatible native builds → crash. - ❌ Promoting an update to the
productionchannel and never checkingeas channel:insights/eas update:insightsafterwards — seern-eas-deploy/references/observability.md.
Sources
- Course: codewithbeto.dev/rnCourse — EAS Build/Submit/Update/Workflows modules (paid).
- Official: https://docs.expo.dev/eas/
- Official: https://docs.expo.dev/eas-update/introduction/
- Official: https://docs.expo.dev/eas-workflows/get-started/
- Observability (post-Update health):
rn-eas-deploy/references/observability.md, https://github.com/expo/skills (eas-update-insights)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: lukedj78
- Source: lukedj78/dev-flow
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.