Mobile App CI/CD with Fastlane & GitHub Actions

## ROLE
You are a DevOps engineer specializing in mobile CI/CD pipelines. You have configured automated build and deployment systems for teams shipping weekly releases to the App Store and Google Play. You are an expert in Fastlane, GitHub Actions, code signing management, and release train automation that eliminates manual deployment steps.

## OBJECTIVE
Build a complete CI/CD pipeline for a [APP_TYPE: React Native/Flutter/native iOS+Android] mobile application using Fastlane and GitHub Actions. The pipeline must automate everything from pull request validation through App Store and Google Play deployment, handling code signing, versioning, beta distribution, and production releases for a team of [TEAM_SIZE] developers.

## TASK

### Step 1: GitHub Actions Workflow Architecture
Design the workflow structure:
- PR workflow: triggers on pull_request to [BRANCHES: main/develop], runs lint + unit tests + build verification
- Beta workflow: triggers on push to develop, builds and deploys to TestFlight and Firebase App Distribution
- Release workflow: triggers on version tag (v*.*.*), builds and deploys to App Store and Google Play
- Nightly workflow: scheduled cron for full E2E test suite on [SCHEDULE]
- Workflow dependencies and job matrix for parallel iOS and Android builds
- Self-hosted runner configuration if build times exceed GitHub-hosted limits
- Caching strategy: CocoaPods/SPM cache, Gradle cache, node_modules cache, derived data cache
- Secret management for signing certificates, API keys, and store credentials

### Step 2: iOS Build & Signing with Fastlane
Configure the iOS pipeline:
- Fastlane Match setup for centralized code signing using [STORAGE: git repo/S3/Google Cloud Storage]
- Certificate types: development, ad-hoc (for Firebase App Distribution), and App Store distribution
- Provisioning profile management for [APP_BUNDLE_IDS] including extensions and widgets
- Fastfile lanes:
  - lane :test — run XCTest suite with scan, generate coverage report
  - lane :beta — increment build number, build with gym, upload to TestFlight with pilot
  - lane :release — build release archive, upload to App Store Connect, submit for review
- Xcode version management using xcodes or xcode-select on the runner
- Build number auto-increment using current timestamp or CI build number
- dSYM upload to [CRASH_REPORTING: Sentry/Firebase Crashlytics/Bugsnag]
- App Store Connect API key authentication (avoiding Apple ID 2FA issues in CI)

### Step 3: Android Build & Signing with Fastlane
Configure the Android pipeline:
- Keystore management: secure storage of release keystore in [SECRET_STORE: GitHub Secrets/Vault/AWS Secrets Manager]
- Keystore decoding from base64-encoded secret in CI environment
- Fastfile lanes:
  - lane :test — run JUnit and instrumentation tests with gradle
  - lane :beta — assemble release APK/AAB, distribute via Firebase App Distribution with release notes
  - lane :release — build signed AAB, upload to Google Play internal/production track with supply
- Google Play Service Account JSON for automated uploads
- Build variant management: debug, staging, release with different [CONFIG: API URLs/feature flags/app icons]
- ProGuard/R8 mapping file upload for crash symbolication
- AAB size monitoring with threshold alert at [MAX_SIZE_MB] MB

### Step 4: Automated Testing Pipeline
Integrate testing into CI:
- Unit test execution with JUnit XML report generation for both platforms
- Code coverage collection and enforcement: minimum [COVERAGE_THRESHOLD]% on new code
- Static analysis: SwiftLint (iOS), detekt/ktlint (Android), ESLint (React Native)
- iOS UI tests with Xcode Test Plans on [SIMULATOR: iPhone 15/iPad Air]
- Android instrumentation tests on [DEVICE_FARM: Firebase Test Lab/AWS Device Farm/local emulator]
- Snapshot test comparison with [TOLERANCE]% pixel difference threshold
- Test result aggregation and PR comment with summary using danger or custom action
- Flaky test detection and quarantine workflow

### Step 5: Version Management & Release Automation
Automate the release lifecycle:
- Semantic versioning: [MAJOR].[MINOR].[PATCH] with build number suffix
- Changelog generation from conventional commits using [TOOL: git-cliff/auto-changelog/fastlane-changelog]
- Version bump lanes: fastlane bump_patch, bump_minor, bump_major
- Release branch creation and PR automation
- Git tag creation on successful release deployment
- Slack/Teams notification on build success/failure with [CHANNEL] integration
- Release notes formatting for App Store and Google Play metadata
- Phased rollout configuration: [ROLLOUT_PERCENTAGE]% initial, increasing over [DAYS] days

### Step 6: Environment & Configuration Management
Handle multiple environments:
- Environment-specific configurations: development, staging, production
- iOS: xcconfig files or build configuration with preprocessor macros
- Android: build flavors with different applicationIdSuffix and resource directories
- React Native: .env files with react-native-config or expo-constants
- Feature flag synchronization from [FLAG_SERVICE: LaunchDarkly/Firebase Remote Config]
- API endpoint switching per environment without code changes
- App icon and display name variation per environment for easy identification

### Step 7: Security & Compliance
Secure the CI/CD pipeline:
- Secret rotation schedule for certificates, API keys, and service accounts
- Dependency vulnerability scanning with [TOOL: Dependabot/Snyk/OWASP dependency-check]
- Binary analysis for privacy manifest compliance (iOS) and data safety section (Android)
- Build artifact signing and verification
- Audit log of all deployments with deployer, version, timestamp, and environment
- Rollback procedure documentation for failed releases
- Compliance checks for [REGULATIONS: HIPAA/SOC2/PCI-DSS] if applicable

Provide the complete Fastfile, Gemfile, GitHub Actions YAML workflows, and configuration files.