From merged pull request to tester, without anyone touching a laptop.
Conductor builds, signs, tests and ships mobile apps on machines you own. One pipeline for Flutter, React Native, Expo and native — and no signing key ever leaves your infrastructure.
Free to self-host, forever. What Cloud costs — and what we refuse to charge for.
What it does
- Merge
a pull request lands
- Build
on your own Macs
- Sign
credentials never touch the repo
- Test
simulators and devices
- Distribute
TestFlight, Play, Firebase
One pipeline, every framework
The framework is detected at onboarding and re-checked on every run. A mismatch warns rather than silently switching, because a build that quietly changed how it was produced is worse than one that stopped.
- Flutter
- React Native
- Expo
- Swift / SwiftUI
- Kotlin / Compose
Your Macs, and honest scheduling
macOS capacity is the scarce resource, and machines are not interchangeable — architecture, Xcode version and measured speed are all scheduling inputs, not footnotes. Emulator images are matched to the host rather than assumed.
Pull-request builds are unsigned and skip archiving. That is a capacity decision and a safety one at the same time.
Credentials are the hard part, so they are the designed part
Never in the repository
No store-account identifier may appear in your config at all. That rule is what makes moving a project between Apple teams or Play accounts possible later, instead of a rewrite.
Never readable
No API returns credential plaintext, to anyone, including you. Jobs get short-lived, single-use material scoped to exactly what the step declared.
Never on an untrusted build
A fork’s pull request runs with zero credentials and cannot distribute. Fork-safety is derived from what a step actually needs, not from a flag somebody remembered to set.
42 steps, and you can read what each one is allowed to touch
Every claim above about credential scoping is checkable. The step library page is generated from the same file the validator, the scheduler and the secret scoper read — so it lists, for all 42 steps, exactly which credentials each can ask for and whether it may run on a fork’s pull request.
24 of them are fork-safe under every possible invocation. Not because somebody ticked a box — because the credentials they resolve carry no standing privilege, and that is computed rather than declared.
Run it on your own hardware
Postgres, Redis, an object store and one binary. Nothing in the stack is something you could not plausibly operate yourself — that constraint is why there is no workflow engine to run alongside it.
docker compose -f deploy/docker-compose.yml up -d