Skip to main content

Expo quickstart

Moatgator works on the built artifact, so how you build with Expo does not matter: produce an .aab/.apk or .ipa, then register it.

1. Create the policy​

npx moatgator init

init detects Expo from package.json and reads android.package and ios.bundleIdentifier from app.json.

2. Produce the artifact​

Locally (prebuild + Gradle):

npm ci
npx expo prebuild --platform android
cd android && ./gradlew bundleRelease && cd ..

With EAS Build: build with eas build --platform android --profile production, then download the artifact (eas build:download or the build page) in the same CI job.

3. Scan and register​

npx moatgator scan android/app/build/outputs/bundle/release/app-release.aab --min-grade C
npx moatgator protect android/app/build/outputs/bundle/release/app-release.aab --app-version 1.8.0

Notes​

  • Prebuild output: expo prebuild regenerates android/ and ios/. Keep moatgator.yml in the project root, not inside them.
  • EAS and signing: EAS manages your signing credentials. Moatgator never needs them.
  • Next: CI guides.