Local vault
Values you type are encrypted with this passphrase (AES-256-GCM, key derived by PBKDF2) before they are cached in this browser or exported as a file. CI keeps the working copy; the vault is for re-entry and moving between machines. Nothing here is sent anywhere except to CI when you press Save to CI.
No vault cached in this browser.
Credentials the pipeline uses
Each field is one of the CI variables of . Check CI shows which are set (values are never read back into the page).
Signing keys, store accounts, the web bucket and the icon can differ per brand; they are stored as BRAND_<SLUG>_… and used when that brand is built. Everything else is shared.
Jobs that need a variable appear on the next release once it is set:
- Frontend builds: the API address, or the web bundle points at localhost and the web deploy refuses it.
- Package catalog and the release board: the AWS keys and the release bucket.
- Android: keystore variables sign the bundle; the Play key uploads it to the internal track.
- Cloud Run: the service-account key and the env file create the no-traffic candidate; promote is a button on the pipeline.
- iPhone: certificate and profile sign the .ipa; the App Store Connect key uploads it to TestFlight.
Release bucket access
The pipeline's AWS user needs rights on the release bucket for the package catalog, the deployment records and the board's tables. Enter an administrator key for the account that owns the bucket; ; it never enters the vault.
Grants: objects under releases/, listing that prefix, the bucket's CORS and policy, and CloudFront invalidations for the web distribution. Policy text: deploy/aws/release-catalog-policy.json.