Skip to main content

CircleCI

1. Store the key​

Create a context (for example moatgator) in Organization Settings and add MOATGATOR_API_KEY (mg_live_…, scopes builds:write, builds:read). Restrict the context to the security group that owns releases.

2. Add the job​

.circleci/config.yml
version: 2.1

jobs:
  build:
    docker: [{ image: cimg/android:2024.01 }]
    steps:
      - checkout
      - run: ./gradlew bundleRelease
      - persist_to_workspace:
          root: .
          paths: [app/build/outputs/bundle/release]
  moatgator:
    docker: [{ image: cimg/node:22.5 }]
    steps:
      - attach_workspace: { at: . }
      - checkout
      - run: npx moatgator scan app/build/outputs/bundle/release/app-release.aab --min-grade C
      - run: npx moatgator protect app/build/outputs/bundle/release/app-release.aab --app-version "$CIRCLE_TAG" --commit "$CIRCLE_SHA1"

workflows:
  release:
    jobs:
      - build:
          filters: { tags: { only: /^v.*/ }, branches: { ignore: /.*/ } }
      - moatgator:
          context: moatgator
          requires: [build]
          filters: { tags: { only: /^v.*/ }, branches: { ignore: /.*/ } }

Notes​

  • Only tag builds run, and only the moatgator job gets the context. Jobs from forked pull requests never see the key.
  • Pin images by digest in production.
  • Exit codes are in the CI overview.