Skip to main content

iOS quickstart

1. Create the policy​

npx moatgator init --bundle-id com.acme.pay

init reads PRODUCT_BUNDLE_IDENTIFIER from your Xcode project when it is a literal value. If the project uses a variable (for example $(APP_ID)), pass --bundle-id.

moatgator.yml
version: 1
extends: moatgator:recommended
app:
  ios:
    bundleId: com.acme.pay

2. Produce the .ipa​

Moatgator does not build your iOS app: archiving and exporting depend on your project, certificates and provisioning profiles, which Moatgator never holds. Use your usual pipeline, for example:

xcodebuild -scheme MyApp -configuration Release -archivePath build/MyApp.xcarchive archive
xcodebuild -exportArchive -archivePath build/MyApp.xcarchive \
  -exportOptionsPlist ExportOptions.plist -exportPath build/ipa

3. Scan and register​

npx moatgator scan build/ipa/MyApp.ipa --min-grade C
export MOATGATOR_API_KEY=mg_live_...   # scopes: builds:write, builds:read
npx moatgator protect build/ipa/MyApp.ipa --app-version 2.0.0

Notes​

  • Runners: iOS builds need macOS runners. The Moatgator CLI itself only needs Node 20 or newer.
  • Signing stays yours. Certificates and profiles live in your pipeline.
  • The GitHub App's pull request does not add an iOS build step, because it cannot know your scheme or signing setup. Once you have the .ipa, call the CLI or the Action with artifact: path/to/App.ipa.
  • Next: CI guides and detections. On iOS, root means jailbreak.