Step registry v1

42 steps, and what each one is allowed to touch

Generated from the same file the validator, the scheduler and the secret scoper read. Not a summary of it — the file itself, rendered.

Looking for the file format instead? release.yaml and its diagnostics →

Fork safety is computed, not configured

A step may run on the untrusted pool — where a fork’s pull request builds — exactly when the credentials it resolves carry no standing privilege, it does not distribute, and its output is trusted. Nothing declares that. It follows from the rules each step states, which is why an unsigned pull-request build is safe by construction rather than by a checkbox somebody could set wrongly.

Of 42 steps: 24 are fork-safe under every invocation, 3 depend on their inputs, and 15 can never run there. That middle number is the interesting one — build/ios with signed: false is fork-safe and the same step with signed: true is not, and a system that answered with a boolean would have to pick a side.

Android

Step	Credentials it can ask for	On a fork
`android/bootstrap` Validate the Gradle wrapper and resolve dependencies.	none, under any inputs	Fork-safe
`android/build` Build an AAB or APK. produces aab, apk, mapping, symbols	`android_signing` sometimes	Depends on inputs
`android/bundletool` Generate APKs from an AAB for local install or ad-hoc distribution.	`android_signing` always	Never on forks
`android/test` Run JUnit tests, or instrumented tests on a managed emulator. produces test_report, screenshot, video	none, under any inputs	Fork-safe

Core

Step	Credentials it can ask for	On a fork
`core/artifact/download` Fetch artifacts produced by an upstream job in the same run.	none, under any inputs	Fork-safe
`core/artifact/upload` Upload files as run artifacts, content-addressed by sha256.	none, under any inputs	Fork-safe
`core/cache` Restore and save a content-keyed cache. Toolchain versions are folded into the key.	none, under any inputs	Fork-safe
`core/checkout` Clone the repository at the run's commit into the job workspace.	`repo_read` always	Fork-safe
`core/shell` Arbitrary command escape hatch. Deliberately unergonomic, and rejected by the validator (E031) in any job that also distributes.	none, under any inputs	Fork-safe
`core/symbols/upload` Upload dSYMs, mapping files, Hermes sourcemaps or Flutter split-debug symbols.	`symbol_upload` always	Never on forks
`core/toolchain` Resolve and install the toolchains the project pins. Usually implicit — the agent runs it automatically from detected pins — but can be declared to force a version.	none, under any inputs	Fork-safe
`core/version` Compute the version and build number for this run.	none, under any inputs	Fork-safe

Distribution

Step	Credentials it can ask for	On a fork
`distribute/appstore` Submit to the App Store, optionally with phased release. Gated by approval policy. runs on the control planeneeds approval	`asc_api` always	Never on forks
`distribute/fanout` Distribute one Release to several targets, resolving each target name to a store account, credential and provider app id at run time. Partial failure is reported per target; targets are independent, so there is no compensation to unwind. runs on the control plane	none, under any inputs	Never on forks
`distribute/firebase` Firebase App Distribution upload with tester groups. runs on the control plane	`firebase_api` always	Never on forks
`distribute/ota` Publish a JS-only Expo update to a channel. runs on the control plane	`ota_signing` always	Never on forks
`distribute/play` Play edits transaction — upload, assign track, set rollout, commit. runs on the control plane	`play_api` always	Never on forks
`distribute/s3` Ad-hoc or enterprise distribution via signed URLs and an itms-services manifest. runs on the control plane	none, under any inputs	Never on forks
`distribute/testflight` Upload to TestFlight, poll processing, assign beta groups. runs on the control plane	`asc_api` always	Never on forks

Fastlane

Step Credentials it can ask for On a fork

fastlane/import-match

One-time import of certificates and profiles from a match repository into managed storage, switching the project to managed signing.

asc_api always
ios_signing always

Never on forks

fastlane/lane

Invoke an existing lane from the repository Fastfile. Conductor supplies checkout, toolchains, credentials and artifact capture; the lane is unchanged.

produces ipa, aab, apk, dsym, mapping, test_report, log

whatever credentials lists

Never on forks

Flutter

Step	Credentials it can ask for	On a fork
`flutter/analyze` Static analysis.	none, under any inputs	Fork-safe
`flutter/bootstrap` Run pub get with lockfile enforcement, honouring the FVM/SDK pin.	none, under any inputs	Fork-safe
`flutter/build` Build an IPA or AAB. Capability and credential needs depend on the platform input. produces ipa, aab, dsym, mapping, symbols	`android_signing` sometimes `asc_api` sometimes `ios_signing` sometimes	Depends on inputs
`flutter/integration-test` Run integration_test on a simulator or emulator. produces test_report, screenshot, video	none, under any inputs	Fork-safe
`flutter/test` Run flutter test with optional sharding. produces test_report	none, under any inputs	Fork-safe

iOS

Step	Credentials it can ask for	On a fork
`ios/bootstrap` Resolve SPM dependencies and run pod install.	none, under any inputs	Fork-safe
`ios/build` Archive and export an iOS build. With signed=false, produces an unsigned app for PR checks. produces ipa, dsym	`asc_api` sometimes `ios_signing` sometimes	Depends on inputs
`ios/sign` Sign or re-sign an existing app bundle against managed signing material.	`ios_signing` always	Never on forks
`ios/test` Run XCTest/XCUITest on simulators, with shard assignment and .xcresult parsing. produces xcresult, test_report, screenshot, video	none, under any inputs	Fork-safe

Notifications

Step	Credentials it can ask for	On a fork
`notify/github/check` Write a Check Run back to the commit. runs on the control plane	`notify_github` always	Never on forks
`notify/github/comment` Comment on the pull request with build links and install QR codes. runs on the control plane	`notify_github` always	Never on forks
`notify/slack` Post a run or release notification, optionally with approval buttons. runs on the control plane	`notify_slack` always	Never on forks
`notify/webhook` HMAC-signed outbound webhook. runs on the control plane	none, under any inputs	Fork-safe

Devices and UI testing

Step	Credentials it can ask for	On a fork
`qa/detox` Run Detox end-to-end tests for React Native. produces test_report, screenshot, video	none, under any inputs	Fork-safe
`qa/emulator/boot` Create and boot an AVD, waiting on sys.boot_completed. System image architecture is validated at creation: an x86 image on Apple Silicon fails fast rather than booting a software-rendered emulator.	none, under any inputs	Fork-safe
`qa/maestro` Run Maestro flows against a booted simulator or emulator. produces test_report, screenshot, video	none, under any inputs	Fork-safe
`qa/simulator/boot` Boot a simulator from the warm pool and hard-reset it between shards.	none, under any inputs	Fork-safe

React Native and Expo

Step	Credentials it can ask for	On a fork
`rn/bootstrap` Install JS dependencies with the detected package manager, then pod install on macOS.	none, under any inputs	Fork-safe
`rn/bundle` Produce the JS bundle and Hermes sourcemap. produces sourcemap	none, under any inputs	Fork-safe
`rn/prebuild` Expo CNG prebuild into an ephemeral directory. Committed native directories are never trusted (plan v3 §4.2), so this runs every build.	none, under any inputs	Fork-safe
`rn/test` Run Jest with optional sharding. produces test_report	none, under any inputs	Fork-safe

Credential purposes

What a step can ask for. A purpose minted per job carries no standing privilege, which is exactly why a fork’s build can have one.

Purpose	Scope	Privilege	What it is
`android_signing`	project	standing	Upload keystore with store and key passwords.
`asc_api`	store_account	standing	App Store Connect API key (.p8) with issuer and key id.
`fastlane_env`		standing	Composite. Expands to whatever the adopted lane declares it needs, in fastlane's expected variable names. Never granted implicitly — a fastlane/lane step must list the underlying purposes explicitly.
`firebase_api`	store_account	standing	Firebase service account JSON.
`ios_signing`	store_account	standing	Distribution certificate (store-account singleton) plus the app's provisioning profile.
`notify_github`	org	standing	GitHub App installation token, minted per job.
`notify_slack`	org	standing
`ota_signing`	project	standing	Expo Updates signing key.
`play_api`	store_account	standing	Google Play service account JSON.
`repo_read`		minted per job	Short-lived, read-only clone token minted per job. Forks get a public-scope token.
`symbol_upload`	org	standing	Sentry or Crashlytics upload token.