@capgo/capgo-skills/skills/capacitor-best-practices/references/release-checklist.md

55 agent skills for Capacitor mobile development

# Release Checklist

Run top to bottom before a store build. Each item names the skill that owns the deep check.

## Config
- [ ] No `server.url`, `server.cleartext`, dev `allowNavigation`, or `webContentsDebuggingEnabled: true` in the synced `capacitor.config.json` (both platforms).
- [ ] `appId`, `appName`, and `webDir` correct; the web build is fresh (`npm run build && npx cap sync` from a clean shell or CI).
- [ ] Only one of `capacitor.config.ts|js|json` exists.

## Versions
- [ ] `@capacitor/core`, `cli`, `ios`, `android` on the same version; plugin majors match (`npx cap doctor`).
- [ ] No Capacitor 9 `next` packages in a production release unless the team has accepted alpha risk.

## Security (`capacitor-security`)
- [ ] `npx @capgo/capgo-sec@latest scan --ci` passes or findings are triaged.
- [ ] No secrets in the built bundle; tokens stored in Keychain/Keystore, not Preferences/localStorage.
- [ ] No `NSAllowsArbitraryLoads`, no `usesCleartextTraffic="true"`; `allowBackup` reviewed.

## iOS
- [ ] UIScene lifecycle adopted (required for Xcode 27 builds) and custom AppDelegate code moved (`capacitor-uiscene-migration`).
- [ ] Every permission the plugins use has an `NS*UsageDescription` string.
- [ ] Privacy manifest (`PrivacyInfo.xcprivacy`) present and accurate (`capacitor-apple-review-preflight`).
- [ ] SPM in use or migration planned before CocoaPods Trunk goes read-only (`cocoapods-to-spm`).
- [ ] Version (`MARKETING_VERSION`) and build number (`CURRENT_PROJECT_VERSION`) bumped.

## Android
- [ ] `targetSdkVersion` meets current Google Play policy; matches the Capacitor major's template.
- [ ] Release build signed with the upload key; keystore not in git.
- [ ] R8 decision made; if enabled, all plugin features tested on a release build.
- [ ] `versionCode` incremented, `versionName` set.

## Behavior on real devices
- [ ] Each plugin feature works, including permission denial and "denied forever" paths.
- [ ] Offline and poor network handled (`capacitor-offline-first`).
- [ ] Background/foreground (`resume`/`pause`) and cold start from a deep link or notification (`capacitor-deep-linking`, `capacitor-push-notifications`).
- [ ] Safe areas, keyboard, splash screen behave (`safe-area-handling`, `capacitor-keyboard`, `capacitor-splash-screen`).
- [ ] Crash reporting wired (`capacitor-native-observability`).

## Live updates (`capgo-live-updates`)
- [ ] `CapacitorUpdater.notifyAppReady()` called on every launch so failed bundles roll back.
- [ ] Channel for this native build set; bundles encrypted if the content is sensitive.
- [ ] Native-only changes (new plugins, permissions, SDK bumps) shipped through the store, not OTA.

## Submission
- [ ] Store metadata, screenshots, and review notes (`capacitor-app-store`, `capacitor-apple-review-preflight`).