Flutter release pipelines that don't wake you up at 2am

The first time a keystore mismatch blocked a release, it cost half a day. The fix isn't clever — it's making the pipeline boring and repeatable.

What actually goes wrong

• Keystores stored on a laptop instead of the CI provider's encrypted store.
• iOS provisioning profiles expiring silently between releases.
• Version bumps done by hand, inconsistently, across pubspec.yaml and the store listings.

The setup

Codemagic handles the Android keystore and iOS signing as encrypted environment values, not files committed anywhere. The pipeline itself is small on purpose:

scripts:
  - flutter packages pub get
  - flutter build appbundle --release
  - flutter build ipa --release

Version bumping is tied to the CI build number, not a manual edit — one less thing to forget before tagging a release.

What I'd still change

Provisioning profile expiry is the one failure mode that's still manual: a calendar reminder, not an automated check. That's the next thing to fix — a scheduled job that pings before a profile lapses, not after a build fails.