CI/CD

react-nativeDeveloper

Publish signed OTA updates automatically from GitHub Actions — generate the workflow with `scalebun ci init`, wire the pipeline secrets, and ship on every push with the signing key held only in CI.

Updated September 14, 2026

Shipping OTA from CI means every merge to your release branch publishes a signed bundle — no laptop, no manual publish. The signing key lives only in CI secrets and signs inside the runner; ScaleBun only ever receives the signature.

1. Generate the workflow#

Terminal

scalebun ci init --provider github

This writes .github/workflows/scalebun-ota.yml — a ready-made pipeline that installs deps, builds the bundle, and runs scalebun ota publish … --require-signing, with manual rollout / pause / rollback actions from the Actions tab.

You can also copy it from the dashboard: OTA → Settings → CI/CD integrations → GitHub Actions → Setup guide.

2. Add the pipeline secrets#

In your repo → Settings → Secrets and variables → Actions, add:

Secret	Value	Secret?
`SCALEBUN_API_TOKEN`	A personal access token, created on the dashboard's Access Tokens screen with provider GitHub Actions	🔴
`SCALEBUN_APP_ID`	Your app id	🟢
`SCALEBUN_SIGNING_PRIVATE_KEY`	The RSA private-key PEM (from `./.scalebun/ota-signing-key.pem`)	🔴
`SCALEBUN_KEY_ID`	Your signing key id	🟢
`SCALEBUN_SIGNING_KEY_PASSPHRASE`	Only if your key is encrypted	🔴

3. Push#

The workflow publishes on push to main and exposes manual controls. A run looks like:

Text

✅ Install dependencies✅ Hermes bytecode compiled🔏 Signed with RSA key (SB-OTA-RSA-SHA256-V1) (key from SCALEBUN_SIGNING_PRIVATE_KEY)✅ Bundle v24 published successfully!   Channel: production · Platform: android

The publish step#

At the heart of the generated workflow is one command — identical to what you'd run locally, with the signing material coming from env:

YAML

- name: Publish OTA update  env:    SCALEBUN_API_TOKEN: ${{ secrets.SCALEBUN_API_TOKEN }}    SCALEBUN_APP_ID: ${{ secrets.SCALEBUN_APP_ID }}    SCALEBUN_SIGNING_PRIVATE_KEY: ${{ secrets.SCALEBUN_SIGNING_PRIVATE_KEY }}    SCALEBUN_KEY_ID: ${{ secrets.SCALEBUN_KEY_ID }}  run: |    npx @scalebun/cli@latest ota publish \      --app-id "$SCALEBUN_APP_ID" \      --channel production \      --platform android \      --hermes \      --require-signing \      --rollout 10

Precedence for every value is CLI flag → environment variable → local .scalebun file, so the same commands work locally and in CI without change.

Other providers#

Bitrise, Codemagic, and any generic CI work the same way — the publish command is identical, only the secret store differs. Add the same secrets to your provider and run the scalebun ota publish step.

Next#

Signing — generate the key whose private half you put in CI.
Channels & rollouts — widen the rollout after a green run.