[TheStreamCode]

Summary

Automates Android production publishing from the existing version-tag EAS Workflow:

• builds the production AAB;
• submits it to Google Play as a draft with EAS Submit;
• runs scripts/play-release-notes.mjs, which validates the short Play Store notes, sets them on the production track, and promotes the draft to a completed release.

Play Store notes live in store/play/release-notes/<version>/it-IT.txt and en-US.txt, separate from the technical CHANGELOG.md. A release without valid notes stays in draft and the workflow fails.

Validation

• bun run lint
• bun run format:check
• node --check scripts/play-release-notes.mjs
• YAML and eas.json parse checks
• scripts/play-release-notes.mjs --dry-run against the live Play API
• The same script was used to promote the current 3.3.2/132 build after EAS Submit; Play review is pending
• The 3.3.2/132 AAB was checked with bundletool: targetSdkVersion 36, versionCode 132

External prerequisites already configured

• Google service account with Play release permissions
• EAS Android credentials for it.mikesoft.keysoft using keysoft-play-publisher@keysoft-play-publisher.iam.gserviceaccount.com
• EAS production environment variables GOOGLE_SERVICE_ACCOUNT_JSON (secret) and GOOGLE_SERVICE_ACCOUNT_KEY_PATH
• Managed publishing disabled
• Play Store notes for 3.3.2 applied to the release in review

Known limitation

The EAS Workflow after_submit hook has not run end-to-end yet; the first tagged release after merge will be its first real execution. The underlying submit profile, API authentication, note validation and promotion path were exercised manually with build 3.3.2/132.

Security notes

No service account material is committed. The key is stored in EAS credentials and in the EAS production environment secret; both copies must be rotated together if the service account key changes.