google-play-cli

KO | EN

gitlite — search

#redis #deep-learning #cloud-native #pdf #android #database #ui #awesome-list #generative-ai #llm

google-play-cli

(★ 9)

gplay: publish to Google Play from CI or a coding agent. One static binary, JSON output that mirrors the Play Developer API verbatim, semantic exit codes. Replaces Fastlane supply.

File Explorer

ZIP Download

- - bug_report.yml
  - config.yml
  - feature_request.yml
- - discovery-blast-radius.sh
- - ci.yml
  - codeql.yml
  - deploy-site.yml
  - discovery-verdict.yml
  - discovery-watch.yml
  - govulncheck.yml
  - release-please.yml
  - release-rehearsal.yml
  - release.yml
- CODEOWNERS
- dependabot.yml
- PULL_REQUEST_TEMPLATE.md
- SECURITY.md
- - main.go
  - main_test.go
  - repeated_test.go
- - fetch.go
  - install.go
  - installskills.go
  - installskills_test.go
  - internal_test.go
  - pin.go
  - skills-pin.json
- - codes.go
  - codes_test.go
  - match_internal_test.go
  - schema.go
  - schema_test.go
  - schema_widen_test.go
- - .gitignore
  - README.md
  - worker.js
  - wrangler.toml
- - 0001-credential-storage.md
  - 0002-safe-production-defaults.md
  - 0003-json-passthrough.md
  - 0004-cascading-config.md
  - 0005-tty-aware-output.md
  - 0006-apps-add-validates-via-api.md
  - 0007-raw-http-not-google-go-sdk.md
  - 0008-release-pipeline.md
  - 0009-install-distribution-vanity-domain.md
  - 0010-versioning-public-contract-and-ga.md
  - 0011-metadata-apply-sync-model.md
  - 0012-app-details-writable-availability-readonly.md
  - 0013-image-slot-reconciliation.md
  - 0014-compliance-namespace-datasafety-write-only.md
  - 0015-developer-account-addressing-rides-on-account.md
  - 0016-permission-vocabulary.md
  - 0017-write-safety-and-agent-resolvable-refusals.md
  - 0018-shared-list-table-machinery.md
  - 0019-canonical-verb-vocabulary.md
  - 0020-resolution-error-surfacing.md
  - 0021-companion-skills-repo.md
  - 0022-schema-index-keyed-by-api-method.md
  - 0023-json-error-envelope.md
  - 0024-readonly-environment-policy.md
  - 0025-website-served-from-install-worker.md
  - 0026-maximal-admin-api-coverage.md
  - 0027-vitals-second-service-scope-readonly.md
  - 0028-install-skills-command.md
  - 0029-agent-discovery-surface.md
  - 0030-android-publisher-long-tail-surfaces.md
  - 0031-orders-commerce-reads-and-gated-refund.md
  - 0032-custom-apps-account-axis-gated-creation.md
  - 0033-games-services-configuration-draft-crud.md
  - 0034-generated-apks-binary-download-to-file.md
  - 0035-website-light-dark-system-theming.md
  - 0036-apk-upload-rides-releases-upload.md
  - 0037-reviews-history-gcs-csv-reports.md
  - 0038-app-icon-faithful-read-no-cache.md
  - 0039-accessible-apps-vs-local-registry.md
  - 0040-variadic-apps-add-partial-failure.md
  - 0041-declarative-monetization-catalog.md
  - 0042-one-zero-ga-and-stability-label-mechanism.md
  - 0043-appstore-hosted-app-env-cascade-and-gate-placement.md
  - 0044-structured-diagnostic-codes.md
  - 0045-install-skills-pinned-git-install.md
  - 0046-artifact-preflight-hand-rolled-manifest-readers.md
- - discovery-triage.md
  - domain.md
  - issue-tracker.md
  - triage-labels.md
- - androidpublisher_v3.json
  - gamesConfiguration_v1configuration.json
  - paths.txt
  - playcustomapp_v1.json
  - playdeveloperreporting_v1beta1.json
  - README.md
- - header.png
  - POSITIONING.md
  - README.md
- CI_CD.md
- COVERAGE.md
- DESIGN.md
- - archgate_test.go
  - exclusions.go
  - registry.go
  - registry_test.go
  - resolve.go
  - resolve_test.go
- - artifact.go
  - artifact_test.go
  - binaryxml.go
  - fuzz_test.go
  - protomanifest.go
- - artifacttest.go
- - audit.go
  - audit_test.go
- - config.go
  - developerid_test.go
  - fs.go
  - global_test.go
  - init.go
  - init_test.go
  - load_test.go
  - memfs.go
  - save_containment_test.go
- - coveragedoc.go
  - integrity_test.go
- - discovery.go
  - discovery_test.go
  - integrity_test.go
- - containment_test.go
  - editpin.go
  - editpin_test.go
- - catalog.go
  - codetable.go
  - diagnostic.go
  - diagnostic_test.go
  - exit.go
  - exit_test.go
  - findings.go
  - policy.go
  - safety.go
  - usage.go
- - args.go
  - args_test.go
  - confirm_test.go
  - kernel.go
  - kernel_test.go
  - redaction_test.go
  - repeated.go
  - repeated_test.go
  - scope_test.go
  - stability.go
  - stability_test.go
- - columns.go
  - columns_test.go
  - envelope.go
  - envelope_test.go
  - output.go
  - output_test.go
  - percent.go
  - percent_test.go
  - sanitize.go
  - sanitize_test.go
- - escape_hatch_test.go
  - pathguard.go
  - pathguard_test.go
- - redact.go
  - redact_test.go
- - derive.go
  - derive_test.go
  - embedded_test.go
  - integrity_test.go
  - schema_index.json
  - schemaindex.go
- - teamtest.go
- - fuzz_test.go
  - retry.go
  - retry_test.go
  - scope.go
- - walkup.go
  - walkup_test.go
- dash-gate.sh
- install-test.sh
- stats.sh
- sync-labels.sh
- verb-gate.sh
- - apple-touch-icon.png
  - favicon.ico
  - favicon.svg
  - icon-192.png
  - icon-512.png
  - icon-maskable-512.png
  - og-default.png
  - site.webmanifest
- - gen-agent-skills.mjs
  - gen-reference.mjs
  - rehype-base-links.mjs
- - content.config.ts
- .gitignore
- astro.config.mjs
- package-lock.json
- package.json
- README.md
- tsconfig.json
.gitignore
.golangci.yml
.goreleaser.yaml
.release-please-manifest.json
AGENTS.md
CHANGELOG.md
CLAUDE.md
CODE_OF_CONDUCT.md
CONTEXT.md
CONTRIBUTING.md
go.mod
go.sum
install.sh
LICENSE
Makefile
README.md
release-please-config.json
skills-lock.json
SUPPORT.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Publish to Google Play from a CI pipeline or a coding agent (Claude Code,
Codex, Cursor), without Fastlane. Shipping `supply` means shipping a Ruby
runtime in your image, output meant for humans, and generic exit codes that
turn retry logic into guesswork. `gplay` replaces it with one static binary,
nothing to install alongside it, and exit codes you can branch on.

Two properties do the heavy lifting for a non-human caller. `--output json`
returns the Google Play Developer API response verbatim: an agent that knows
Google's API already knows gplay's output, field for field, including the
zero values a typed re-marshal would drop. And every command declares its
contract: unmarked means frozen under the Public contract, `[experimental]`
means free to evolve. `--help` tells you which, per command.

**Two ways to drive it:** the raw CLI (flags, scripts, CI) or
[agent skills](#agent-skills) that run it from natural-language prompts.

> **Generally available.** The Public contract is in force: for every command
> *not* marked `[experimental]`, names, flags, semantics and exit codes will not
> change without a major bump. That covers auth, apps, the core release loop,
> tracks, testers, team, edits, metadata, compliance, vitals, and
> `reviews list` / `view` / `reply`. Newer or less-exercised commands ship
> `[experimental]` and stay free to evolve: monetization, `games`, `recovery`,
> `orders`, `reviews history`, and the side namespaces under `releases`.
> **`--help` is the source of truth**: the label is on the command itself.
> See [Stability and the Public contract](https://gplay.sh/docs/concepts/stability/),
> [Migrating to 1.0](https://gplay.sh/docs/guides/migrate-to-1-0/), and
> the [parking issues](https://github.com/PollyGlot/google-play-cli/issues?q=is%3Aissue+label%3Atype%3Aparking) for what's out of scope.

## Why

- **Standalone Go binary.** No Ruby, no Node, no Python: one file in your CI
  image.
- **Built for CI and agents.** TTY-aware output (`table` by default, `json`
  in pipes), explicit flags, semantic exit codes for retry decisions.
- **API-faithful.** `--output json` returns the raw Google Play Developer
  API response shape, with no custom envelope to learn. The Google docs *are*
  the schema docs.
- **Safe by default on production.** Uploading or promoting to the
  `production` track creates a `draft` release unless you explicitly
  `--complete` or `--staged <fraction>`.
  See [ADR-0002](docs/adr/0002-safe-production-defaults.md).

## Install

Pick `go install`, Homebrew, or the install script. Pre-built binaries for
Linux, macOS, and Windows are on the
[releases page](https://github.com/PollyGlot/google-play-cli/releases).

```bash
# go install
go install github.com/PollyGlot/google-play-cli/cmd/gplay@latest

# Homebrew
brew install PollyGlot/tap/gplay

# Install script
curl -fsSL https://gplay.sh/install | sh
```

The install script verifies the archive's SHA-256 against the release
`checksums.txt` and **fails closed**: a missing, ambiguous, or mismatched
checksum aborts the install before anything is written, and so does a host with
no sha256 tool. Set `GPLAY_INSTALL_NO_VERIFY=1` to bypass (prints
a warning, greppable in CI). To add cosign and provenance checks on top, see
[Verify a release](#verify-a-release).

## Agent skills

`gplay` is shaped for a non-human caller: explicit flags, no interactive
prompts, machine-readable output. A skill turns a natural-language prompt into
the matching invocation, safe defaults included:

> *"Promote the latest internal build of com.example.myapp to beta."*
> → the `gplay-release-flow` skill runs `gplay releases promote --from
> internal --to beta` for you.

Install them in one step. It needs `git` on your PATH, and nothing else:

```bash
gplay install-skills
```

The skills are fetched with `git` from a commit pinned inside the binary, never
from a branch, so two runs of the same gplay version install the same reviewed
files. Every installed file is verified against that checkout, unrelated skills
in the target directory are left alone, and a failed install is rolled back to
its previous state. They land in `~/.claude/skills` by default (`--dir` moves
them elsewhere). A new pack ships in a normal gplay release.

Skills live in a companion repo,
[**PollyGlot/google-play-cli-skills**](https://github.com/PollyGlot/google-play-cli-skills).
Each is a folder with a `SKILL.md` documenting its intent, the commands it
runs, and the limits it enforces.
[ADR-0021](docs/adr/0021-companion-skills-repo.md) fixes the roster: one skill
per shipped namespace, plus a `gplay-cli-usage` foundation.

| Skill | Drives |
|---|---|
| `gplay-cli-usage` | Cross-cutting conventions (foundation) |
| `gplay-setup` | Auth onboarding |
| `gplay-apps` | Apps registry + details |
| `gplay-release-flow` | upload / promote / rollout |
| `gplay-tracks` | Tracks + testers |
| `gplay-reviews` | reviews list / reply |
| `gplay-metadata-sync` | Listings + images |
| `gplay-compliance` | Data Safety |
| `gplay-team` | users / grants / permissions |
| `gplay-vitals` | Crash / ANR rates, error reports, anomalies (read-only) |
| `gplay-monetization` | Subscriptions and one-time products as declarative files |
| `gplay-orders` | Order lookup and refunds |
| `gplay-recovery` | App recovery actions for a bad release |
| `gplay-games` | Play Games Services achievements and leaderboards |
| `gplay-device-tiers` | Device tier configs for tiered delivery |
| `gplay-customapps` | Managed Google Play private apps |
| `gplay-appstore` | Alternative app store catalog and update feed |
| `gplay-signing` | Play App Signing with a self-hosted Cloud KMS key (enroll, rotate) |

## Quick start

```bash
# Point gplay at a Google Cloud service account JSON.
gplay auth login --service-account ./service_account.json

# List configured accounts and see which one is active.
gplay auth list
gplay auth status

# Verify the SA actually has access to your app.
gplay auth doctor --package com.example.myapp

# Bootstrap a project-local config (cascading: project → user → defaults).
gplay init
```

Full command reference: `gplay --help` (or `gplay <subcommand> --help`).

## Replacing Fastlane

The commands the skills above drive. All shipped, all in the frozen contract:

```bash
# Upload an AAB to the internal track, with localized release notes.
gplay releases upload app.aab \
  --package com.example.myapp \
  --track internal \
  --release-notes-dir ./whatsnew

# Promote the latest internal build to beta.
gplay releases promote --package com.example.myapp --from internal --to beta

# Stage a production rollout, then advance it.
gplay releases rollout --package com.example.myapp --track production --to 0.10

# Read the most recent reviews (API exposes the last 7 days only) and reply.
gplay reviews list --package com.example.myapp --stars 1-2
gplay reviews reply --review-id REVIEW_ID --reply "Thanks for the feedback!"
```

## How it's set up

Every decision lands in a document before it lands in code, so contributors
and agents start from the same page.

- [**CLAUDE.md**](CLAUDE.md): project context and agent working
  instructions (read order, conventions, build/test, PR gate).
- [**CONTEXT.md**](CONTEXT.md): glossary of canonical terms (Edit,
  Account, Project, ...). Use them verbatim.
- [**docs/DESIGN.md**](docs/DESIGN.md): CLI conventions across commands
  (auth precedence, exit codes, output format, verbosity, edit lifecycle).
- [**docs/CI_CD.md**](docs/CI_CD.md): how to wire `gplay` into a CI
  pipeline (GitHub Actions example).
- [**docs/adr/**](docs/adr/): Architecture Decision Records.

## Verify a release

<details>
<summary>Confirm an artifact came from this repo's release pipeline (cosign + provenance).</summary>

Every release publishes a cosign signature over `checksums.txt` and a GitHub
build-provenance attestation over each archive. Two independent checks, and
either one confirms the archive came from this repo's release pipeline before
you trust it in CI.

```bash
# 1. Build-provenance attestation (needs the GitHub CLI; no extra download).
#    Proves the archive was built by this repo's release workflow.
gh attestation verify gplay_<version>_<os>_<arch>.tar.gz \
  -R PollyGlot/google-play-cli

# 2. cosign signature over checksums.txt (needs cosign). The checksum file
#    transitively covers every archive it lists, so verify it, then check
#    your archive against it.
cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/PollyGlot/google-play-cli/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
shasum -a 256 -c <(grep " gplay_<version>_<os>_<arch>.tar.gz$" checksums.txt)
```

Download `checksums.txt` and `checksums.txt.sigstore.json` from the same
[release](https://github.com/PollyGlot/google-play-cli/releases) as the
archive. The install script already checks the SHA-256 against `checksums.txt`
and [fails closed](#install); these commands add provenance and signature
verification on top.

</details>

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md). TL;DR: open an issue first for
anything bigger than a typo, branch from `main`, open a PR.

## License

## Not affiliated with Google

`gplay` is an independent open-source project. It calls the public Google
Play Developer API. Google LLC does not endorse, sponsor, or maintain it. "Google Play" is a trademark of Google LLC.

google-play-cli

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README