Bitrise — Key Concepts, Workflows, and Continuous Integration

What is Bitrise?

Bitrise is a CI/CD platform launched in 2016 and fully focused on mobile development. Unlike universal solutions like GitHub Actions and GitLab CI, Bitrise was originally designed for automating iOS and Android app builds. The platform runs in the cloud and provides its own hosted runners with macOS and Linux. Bitrise supports all popular mobile stacks: Swift, Kotlin, Flutter, React Native, Cordova, and Xamarin.

The main advantage of Bitrise is pre-configured Step templates for typical mobile development tasks: Xcode build, Gradle assemble, Fastlane, Firebase Distribution, TestFlight, Google Play. Pipeline setup takes minutes through the visual editor, and YAML configuration is generated automatically in the bitrise.yml file. For experienced users, a YAML editor with autocomplete is available.

Bitrise Architecture: Workflows and Steps

Bitrise architecture is built on two key concepts: Workflow and Step. A Workflow is a sequence of Steps that defines the pipeline. Each project can have multiple Workflows: primary (main build), deploy (publishing), test (testing only). A Workflow is triggered by events: push, PR, tag, or on a schedule. Workflows can also be launched manually from the web interface, which is useful for ad-hoc builds.

A Step is an atomic module that performs a single task. Steps can be dragged in the visual editor, with their order and configuration adjustable. Bitrise provides Steps for Xcode Archive & Export, Gradle Runner, CocoaPods Install, Firebase Distribution, and Slack notifications. The community also creates Steps — they are available through the Step Library. Each Step has mandatory and optional input parameters, as well as output variables that can be used by subsequent Steps.

Bitrise supports the concept of a Pipeline — combining multiple Workflows into a single pipeline. A Pipeline can include primary builds for all platforms and separate workflows for deployment and testing. This enables complex CI/CD processes where one build triggers another. Bitrise Stacks determine the pre-installed software on the runner: Xcode, Android SDK, Flutter, Node.js, and other tools.

Popular Steps for Mobile Projects

• Xcode Archive & Export — build and export IPA with provisioning profile management
• Gradle Runner — run Gradle tasks with arguments and caching
• Flutter Build — build Flutter apps for iOS and Android
• Firebase App Distribution — publish builds for testers
• Certificate and Profile Installer — automatic installation of code signing certificates

Bitrise Integration with Git Repositories

Bitrise integrates with GitHub, GitLab, Bitbucket, and Azure DevOps. When connecting a repository, Bitrise automatically detects the project type (iOS, Android, Flutter) and suggests a Workflow template. For private repositories, Bitrise requests access via OAuth or SSH key. Multiple repositories can be connected to a single application.

After connecting, Bitrise creates a webhook in the repository to automatically trigger builds on push and PR. Each build receives a unique number, logs, and artifacts. The interface allows browsing build history, comparing changes, and restarting failed builds. Bitrise also supports scheduled builds for regular nightly builds and integration with Jira for commit tracking.

Code Signing and Publishing to App Store and Google Play

Code signing for iOS is one of the most challenging CI/CD tasks, and Bitrise solves it as simply as possible. The platform stores certificates and provisioning profiles in encrypted form, automatically installs them into the appropriate keychain before the build, and exports the signed IPA. The Certificate and Profile Installer Step downloads files from the Bitrise storage and configures Xcode. Development, AdHoc, AppStore, and Enterprise certificate types are supported.

For publishing to App Store Connect, Bitrise provides Steps for uploading IPA via Xcode Archive & Export. Google Play publishing uses Gradle Runner with Keystore signing, after which the APK/AAB is uploaded to Google Play Console via the Google Play Deploy Step. For Firebase App Distribution, simply specify the Firebase Token and tester group. Bitrise automates version number and build number updates before each publication.

Setting Up Code Signing in Bitrise

Certificates are uploaded in the Code Signing section of the web interface: P12 with private key, provisioning profile (.mobileprovision), and Keystore (.jks/.keystore) for Android. Bitrise automatically installs iOS certificates into the keychain on each Workflow run and exports the signed application. For Android, simply upload the Keystore file — Bitrise passes it to Gradle through environment variables during the build.

Example Bitrise Configuration for Flutter

Let us look at a Workflow for a Flutter application that builds and publishes releases for iOS and Android. Bitrise automatically detects a Flutter project and suggests the appropriate Steps. The Workflow includes Flutter installation, pub-cache caching, build, testing, and deployment. For iOS builds, code signing certificates are additionally required, which Bitrise loads automatically.

When building Flutter apps, Bitrise supports separate configuration for each platform. Android builds run on a Linux runner with Flutter SDK, iOS on a macOS runner. A Workflow can include conditional Steps: build_android and build_ios, which run only on their respective platforms. For React Native projects, Bitrise offers a similar set of Steps with npm/nvm and Metro bundler.

format_version: 13
default_step_lib_source: https://github.com/bitrise-io/bitrise-steplib.git

trigger_map:
- push_branch: main
  workflow: primary

workflows:
  primary:
    steps:
    - activate-ssh-key@4:
        run_if: true
    - git-clone@8: {}
    - flutter-installer@0:
        inputs:
        - version: 3.24.0
    - flutter-build@0:
        inputs:
        - platform: both
        - ios_output_type: archive
    - deploy-to-bitrise-io@2: {}

Custom Step for Deployment

After the build, you can add a Firebase App Distribution Step for iOS and Android. The Step accepts firebase_token, app_id, and testers_group. Bitrise substitutes values from Secrets — secure token storage ensures they do not end up in logs.

- firebase-app-distribution@1:
    inputs:
    - firebase_token: $FIREBASE_TOKEN
    - app_id: $FIREBASE_IOS_APP_ID
    - testers_group: qa-team
    - release_notes: |
        Build $BITRISE_BUILD_NUMBER

Secrets and Environment Management

Proper management of confidential data is the foundation of CI/CD process security. Bitrise Secrets are encrypted and unreadable after saving. When creating a new application, Bitrise offers to import secrets from another project or set them manually. For larger teams, the Environment Groups feature is available — centralized management of variables and secrets for a group of applications.

Bitrise provides built-in Secrets storage for confidential data: API keys, Firebase tokens, Keystore passwords, Apple ID. Secrets are defined as key-value pairs in the web interface and are masked in build logs. They are available at both application and Workflow levels. Secrets cannot be read after saving — they can only be overwritten.

Environment Variables (without the Secret flag) are used for configuration: Xcode version, project path, build scheme. Bitrise environment variables (BITRISE_BUILD_NUMBER, BITRISE_APP_TITLE) provide meta-information about the build. Secrets are encrypted at rest and decrypted only on the runner during Workflow execution. For group variable management, Bitrise supports Environment Groups — sets of variables applicable to multiple applications simultaneously.

Special attention deserves iOS certificate management through Bitrise. The platform automatically installs P12 and provisioning profiles into the system keychain before the build. For Android, the Keystore file is used, uploaded in the Code Signing section. Each certificate file is stored encrypted and decrypted only during the build.

Example of Using Secrets

- google-play-deploy@3:
    inputs:
    - package_name: com.example.app
    - service_account_json_key: $SERVICE_ACCOUNT_KEY
    - app_file: $BITRISE_APK_PATH

Bitrise Stacks and Environments

Bitrise offers various stacks for building — pre-installed images with tools and SDKs. Available stacks include Xcode (versions 14, 15, 16 with iOS SDK 17, 18), Android (with different SDK and NDK versions), Flutter, React Native, and Kotlin Multiplatform. Each stack has a description of pre-installed tools and versions.

Stack selection affects build time and project compatibility. Bitrise regularly updates stacks, adding new tool versions. You can pin a specific stack version in bitrise.yml to avoid unexpected changes when the platform updates. For custom dependencies, the Script Step is used to install necessary packages before the main build. Bitrise also supports Docker images for Linux stacks, allowing custom environments for Android builds.