Skip to main content

React Native quickstart

A React Native repository has one moatgator.yml for the app, usually at the project root (the folder with package.json). The android/ and ios/ folders belong to the same app.

1. Create the policy​

npx moatgator init

init detects React Native from package.json and reads the Android applicationId from android/app/build.gradle. Add --bundle-id com.acme.pay for iOS if it is not detected.

2. Android​

npm ci
cd android && ./gradlew bundleRelease && cd ..
npx moatgator scan android/app/build/outputs/bundle/release/app-release.aab --min-grade C
npx moatgator protect android/app/build/outputs/bundle/release/app-release.aab --app-version 1.8.0

3. iOS​

Archive and export the .ipa with your pipeline (see the iOS guide), then:

npx moatgator protect build/ipa/MyApp.ipa --app-version 1.8.0

Notes​

  • JavaScript bundle: your JS ships inside the app. Hermes bytecode is harder to read than a plain JS bundle, but it is not a secret store: keep keys and tokens out of it.
  • Monorepos: keep one moatgator.yml per app folder, check each with npx moatgator validate path/to/moatgator.yml, and set the Action's config: input to the right one. The GitHub App creates one per detected app.
  • Next: CI guides.