@daemux/store-automator 0.7.0 → 0.8.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "App Store & Google Play automation for Flutter apps",
-    "version": "0.7.0"
+    "version": "0.7.1"
   },
   "plugins": [
     {
       "name": "store-automator",
       "source": "./plugins/store-automator",
       "description": "3 agents for app store publishing: reviewer, meta-creator, media-designer",
-      "version": "0.7.0",
+      "version": "0.7.1",
       "keywords": ["flutter", "app-store", "google-play", "fastlane", "codemagic"]
     }
   ]

package/README.md

@@ -27,7 +27,7 @@ npm install @daemux/store-automator
 
 The postinstall script will:
 
-1. Prompt for MCP server tokens (Stitch, Cloudflare, Codemagic)
+1. Prompt for bundle ID and MCP server tokens (Stitch, Cloudflare, Codemagic)
 2. Configure `.mcp.json` with MCP servers (Playwright, mobile-mcp, Stitch, Cloudflare, Codemagic)
 3. Install the plugin marketplace and register agents
 4. Copy `CLAUDE.md` template to `.claude/CLAUDE.md`
@@ -122,13 +122,14 @@ For CI/CD environments or scripted setups, pass tokens as CLI flags to skip inte
 
 ```bash
 npx @daemux/store-automator \
+  --bundle-id=com.company.app \
   --codemagic-token=YOUR_CM_TOKEN \
   --stitch-key=YOUR_STITCH_KEY \
   --cloudflare-token=YOUR_CF_TOKEN \
   --cloudflare-account-id=YOUR_CF_ACCOUNT_ID
 ```
 
-Any tokens provided via flags will skip the corresponding interactive prompt. If all four tokens are provided, the entire interactive session is skipped.
+Any tokens provided via flags will skip the corresponding interactive prompt. If all four tokens are provided, the entire interactive session is skipped. The bundle ID, if provided, is automatically written to `bundle_id` and `package_name` in `ci.config.yaml`.
 
 ## CLI Options
 
@@ -142,6 +143,9 @@ Options:
   -v, --version                  Show version number
   -h, --help                     Show help
 
+App Configuration:
+  --bundle-id=ID                 Bundle ID / Package Name (e.g., com.company.app)
+
 MCP Token Flags (skip interactive prompts):
   --codemagic-token=TOKEN        Codemagic API token
   --stitch-key=KEY               Stitch MCP API key

package/bin/cli.mjs

@@ -27,12 +27,15 @@ function flagValue(arg, prefix) {
   return arg.startsWith(prefix) ? arg.slice(prefix.length) : undefined;
 }
 
-const tokenFlags = {
+const valueFlags = {
   '--codemagic-token=': 'codemagicToken',
   '--codemagic-team-id=': 'codemagicTeamId',
   '--stitch-key=': 'stitchApiKey',
   '--cloudflare-token=': 'cloudflareToken',
   '--cloudflare-account-id=': 'cloudflareAccountId',
+  '--bundle-id=': 'bundleId',
+  '--match-deploy-key=': 'matchDeployKey',
+  '--match-git-url=': 'matchGitUrl',
 };
 
 for (const arg of args) {
@@ -41,15 +44,11 @@ for (const arg of args) {
   if ((v = flagValue(arg, '--branch=')) !== undefined) { cmBranch = v; continue; }
   if ((v = flagValue(arg, '--workflow=')) !== undefined) { cmWorkflowId = v; continue; }
 
-  let matched = false;
-  for (const [prefix, key] of Object.entries(tokenFlags)) {
-    if ((v = flagValue(arg, prefix)) !== undefined) {
-      cliTokens[key] = v;
-      matched = true;
-      break;
-    }
+  const valueFlagEntry = Object.entries(valueFlags).find(([prefix]) => arg.startsWith(prefix));
+  if (valueFlagEntry) {
+    cliTokens[valueFlagEntry[1]] = arg.slice(valueFlagEntry[0].length);
+    continue;
   }
-  if (matched) continue;
 
   switch (arg) {
     case '-g':
@@ -69,6 +68,9 @@ for (const arg of args) {
     case '--github-setup':
       action = 'github-setup';
       break;
+    case '--github-actions':
+      cliTokens.githubActions = true;
+      break;
     case '--trigger':
       cmTrigger = true;
       break;
@@ -86,6 +88,9 @@ Options:
   -v, --version                  Show version number
   -h, --help                     Show help
 
+App Configuration:
+  --bundle-id=ID                 Bundle ID / Package Name (e.g., com.company.app)
+
 MCP Token Flags (skip interactive prompts):
   --codemagic-token=TOKEN        Codemagic API token
   --codemagic-team-id=ID         Codemagic Team ID (from Teams page)
@@ -101,34 +106,57 @@ Codemagic:
   --trigger                      Trigger build after setup
   --wait                         Wait for build completion (implies --trigger)
 
+GitHub Actions CI mode:
+  --github-actions               Use GitHub Actions instead of Codemagic (skip MCP setup)
+  --match-deploy-key=PATH        Path to Match deploy key file (required with --github-actions)
+  --match-git-url=URL            Git URL for Match certificates repo (required with --github-actions)
+
 GitHub Actions (auto-configured during install if gh CLI available):
   --github-setup                 Set CM_API_TOKEN secret for GitHub Actions
   --token=TOKEN                  API token (or set CM_API_TOKEN env var)
 
 Examples:
-  npx @daemux/store-automator                          Install for project
+  npx @daemux/store-automator                          Install for project (Codemagic)
   npx @daemux/store-automator -g                       Install globally
   npx @daemux/store-automator -u                       Uninstall from project
   npx @daemux/store-automator -g -u                    Uninstall globally
   npx @daemux/store-automator --codemagic-setup        Register with Codemagic
   npx @daemux/store-automator --codemagic-setup --trigger --wait  Trigger and wait
-  npx @daemux/store-automator --github-setup           Configure GitHub Actions
+  npx @daemux/store-automator --github-setup           Configure GitHub Actions secret
+
+GitHub Actions install:
+  npx @daemux/store-automator --github-actions --bundle-id=ID --match-deploy-key=PATH --match-git-url=URL
 
-Non-interactive install (CI/CD):
-  npx @daemux/store-automator --codemagic-token=TOKEN --codemagic-team-id=ID --stitch-key=KEY
+Non-interactive install (Codemagic):
+  npx @daemux/store-automator --bundle-id=ID --codemagic-token=TOKEN --stitch-key=KEY
   npx @daemux/store-automator --cloudflare-token=TOKEN --cloudflare-account-id=ID`);
       process.exit(0);
-      break; // eslint: no-fallthrough
     case '-v':
     case '--version':
       console.log(pkg.version);
       process.exit(0);
-      break; // eslint: no-fallthrough
   }
 }
 
 if (cmWait) cmTrigger = true;
 
+if (cliTokens.githubActions) {
+  const missing = [];
+  if (!cliTokens.matchDeployKey) missing.push('--match-deploy-key');
+  if (!cliTokens.matchGitUrl) missing.push('--match-git-url');
+  if (!cliTokens.bundleId) missing.push('--bundle-id');
+  if (missing.length > 0) {
+    console.error(`Error: --github-actions requires: ${missing.join(', ')}`);
+    console.error('');
+    console.error('Example:');
+    console.error('  npx @daemux/store-automator --github-actions \\');
+    console.error('    --bundle-id=com.company.app \\');
+    console.error('    --match-deploy-key=creds/match_deploy_key \\');
+    console.error('    --match-git-url=git@github.com:org/certs.git');
+    process.exit(1);
+  }
+}
+
 notifier.notify();
 
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemux/store-automator",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Full App Store & Google Play automation for Flutter apps with Claude Code agents",
   "type": "module",
   "bin": {

package/plugins/store-automator/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "store-automator",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "App Store & Google Play automation agents for Flutter app publishing",
   "author": {
     "name": "Daemux"

package/src/ci-config.mjs

@@ -5,6 +5,10 @@ const CI_CONFIG_FILE = 'ci.config.yaml';
 const FIELD_PATTERNS = {
   app_id: /^(\s*app_id:\s*)"[^"]*"/m,
   team_id: /^(\s*team_id:\s*)"[^"]*"/m,
+  bundle_id: /^(\s*bundle_id:\s*)"[^"]*"/m,
+  package_name: /^(\s*package_name:\s*)"[^"]*"/m,
+  deploy_key_path: /^(\s*deploy_key_path:\s*)"[^"]*"/m,
+  git_url: /^(\s*git_url:\s*)"[^"]*"/m,
 };
 
 function writeCiField(projectDir, field, value) {
@@ -16,7 +20,8 @@ function writeCiField(projectDir, field, value) {
     const content = readFileSync(configPath, 'utf8');
     if (!pattern.test(content)) return false;
 
-    const updated = content.replace(pattern, `$1"${value}"`);
+    const safeValue = value.replace(/\$/g, '$$$$');
+    const updated = content.replace(pattern, `$1"${safeValue}"`);
     if (updated === content) return false;
 
     writeFileSync(configPath, updated, 'utf8');
@@ -33,3 +38,30 @@ export function writeCiAppId(projectDir, appId) {
 export function writeCiTeamId(projectDir, teamId) {
   return writeCiField(projectDir, 'team_id', teamId);
 }
+
+export function writeCiBundleId(projectDir, bundleId) {
+  return writeCiField(projectDir, 'bundle_id', bundleId);
+}
+
+export function writeCiPackageName(projectDir, packageName) {
+  return writeCiField(projectDir, 'package_name', packageName);
+}
+
+export function writeMatchConfig(projectDir, { deployKeyPath, gitUrl }) {
+  const wrote1 = writeCiField(projectDir, 'deploy_key_path', deployKeyPath);
+  const wrote2 = writeCiField(projectDir, 'git_url', gitUrl);
+  return wrote1 || wrote2;
+}
+
+export function readFlutterRoot(projectDir) {
+  const configPath = join(projectDir, CI_CONFIG_FILE);
+  if (!existsSync(configPath)) return '.';
+
+  try {
+    const content = readFileSync(configPath, 'utf8');
+    const match = content.match(/^flutter_root:\s*"([^"]*)"/m);
+    return match ? match[1] : '.';
+  } catch {
+    return '.';
+  }
+}

package/src/install-paths.mjs

@@ -0,0 +1,93 @@
+import { execSync, execFileSync } from 'node:child_process';
+import { installGitHubActionsTemplates, installMatchfile } from './templates.mjs';
+import { findAppByRepo, addApp, normalizeRepoUrl } from './codemagic-api.mjs';
+import {
+  writeCiAppId, writeCiTeamId, writeMatchConfig, readFlutterRoot,
+} from './ci-config.mjs';
+import { updateMcpAppId, updateMcpTeamId } from './mcp-setup.mjs';
+
+function setupGitHubActionsSecret(codemagicToken) {
+  if (!codemagicToken) return false;
+
+  try {
+    execFileSync('which', ['gh'], { encoding: 'utf8', stdio: 'pipe' });
+    const authStatus = execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: 'pipe' });
+    if (authStatus.includes('not logged')) return false;
+
+    execFileSync('gh', ['secret', 'set', 'CM_API_TOKEN', '--body', codemagicToken], {
+      encoding: 'utf8',
+      stdio: 'pipe',
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function setupCodemagicApp(projectDir, codemagicToken, codemagicTeamId) {
+  if (!codemagicToken) return;
+
+  let repoUrl;
+  try {
+    const raw = execSync('git remote get-url origin', {
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    if (!raw) return;
+    repoUrl = normalizeRepoUrl(raw);
+  } catch {
+    return;
+  }
+
+  try {
+    let app = await findAppByRepo(codemagicToken, repoUrl);
+    if (!app) {
+      app = await addApp(codemagicToken, repoUrl, codemagicTeamId);
+      console.log(`Codemagic app created: ${app.appName || app._id}`);
+    } else {
+      console.log(`Codemagic app found: ${app.appName || app._id}`);
+    }
+
+    const written = writeCiAppId(projectDir, app._id);
+    if (written) {
+      console.log(`Codemagic app_id written to ci.config.yaml`);
+    }
+
+    updateMcpAppId(projectDir, app._id);
+
+    if (codemagicTeamId) {
+      writeCiTeamId(projectDir, codemagicTeamId);
+      updateMcpTeamId(projectDir, codemagicTeamId);
+    }
+  } catch (err) {
+    console.log(`Codemagic auto-setup skipped: ${err.message || err}`);
+  }
+}
+
+export function installGitHubActionsPath(projectDir, packageDir, cliTokens) {
+  console.log('Configuring GitHub Actions mode...');
+  installGitHubActionsTemplates(projectDir, packageDir);
+
+  const flutterRoot = readFlutterRoot(projectDir);
+  installMatchfile(projectDir, packageDir, flutterRoot, {
+    matchGitUrl: cliTokens.matchGitUrl,
+    bundleId: cliTokens.bundleId,
+  });
+
+  const wrote = writeMatchConfig(projectDir, {
+    deployKeyPath: cliTokens.matchDeployKey,
+    gitUrl: cliTokens.matchGitUrl,
+  });
+  if (wrote) console.log('Match credentials written to ci.config.yaml');
+}
+
+export async function installCodemagicPath(projectDir, tokens) {
+  await setupCodemagicApp(projectDir, tokens.codemagicToken, tokens.codemagicTeamId);
+
+  const ghConfigured = setupGitHubActionsSecret(tokens.codemagicToken);
+  if (ghConfigured) {
+    console.log('GitHub Actions: CM_API_TOKEN secret configured.');
+  } else if (tokens.codemagicToken) {
+    console.log('GitHub Actions: secret not set (gh CLI unavailable or not authenticated).');
+  }
+}

package/src/install.mjs

@@ -1,7 +1,7 @@
 import { existsSync, rmSync, cpSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { execSync, execFileSync } from 'node:child_process';
+import { execSync } from 'node:child_process';
 import {
   MARKETPLACE_DIR, KNOWN_MP_PATH, CACHE_DIR,
   MARKETPLACE_NAME, PLUGIN_REF,
@@ -9,10 +9,10 @@ import {
 } from './utils.mjs';
 import { injectEnvVars, injectStatusLine } from './settings.mjs';
 import { promptForTokens } from './prompt.mjs';
-import { getMcpServers, writeMcpJson, updateMcpAppId, updateMcpTeamId } from './mcp-setup.mjs';
+import { getMcpServers, writeMcpJson } from './mcp-setup.mjs';
 import { installClaudeMd, installCiTemplates, installFirebaseTemplates } from './templates.mjs';
-import { findAppByRepo, addApp, normalizeRepoUrl } from './codemagic-api.mjs';
-import { writeCiAppId, writeCiTeamId } from './ci-config.mjs';
+import { writeCiBundleId, writeCiPackageName } from './ci-config.mjs';
+import { installGitHubActionsPath, installCodemagicPath } from './install-paths.mjs';
 
 function checkClaudeCli() {
   const result = exec('command -v claude') || exec('which claude');
@@ -94,61 +94,19 @@ function printSummary(scope, oldVersion, newVersion) {
   }
 }
 
-function setupGitHubActions(codemagicToken) {
-  if (!codemagicToken) return false;
-
-  try {
-    execFileSync('which', ['gh'], { encoding: 'utf8', stdio: 'pipe' });
-    const authStatus = execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: 'pipe' });
-    if (authStatus.includes('not logged')) return false;
-
-    execFileSync('gh', ['secret', 'set', 'CM_API_TOKEN', '--body', codemagicToken], {
-      encoding: 'utf8',
-      stdio: 'pipe',
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function setupCodemagicApp(projectDir, codemagicToken, codemagicTeamId) {
-  if (!codemagicToken) return;
-
-  let repoUrl;
-  try {
-    const raw = execSync('git remote get-url origin', {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
-    if (!raw) return;
-    repoUrl = normalizeRepoUrl(raw);
-  } catch {
-    return;
-  }
-
-  try {
-    let app = await findAppByRepo(codemagicToken, repoUrl);
-    if (!app) {
-      app = await addApp(codemagicToken, repoUrl, codemagicTeamId);
-      console.log(`Codemagic app created: ${app.appName || app._id}`);
-    } else {
-      console.log(`Codemagic app found: ${app.appName || app._id}`);
-    }
-
-    const written = writeCiAppId(projectDir, app._id);
-    if (written) {
-      console.log(`Codemagic app_id written to ci.config.yaml`);
-    }
-
-    updateMcpAppId(projectDir, app._id);
-
-    if (codemagicTeamId) {
-      writeCiTeamId(projectDir, codemagicTeamId);
-      updateMcpTeamId(projectDir, codemagicTeamId);
-    }
-  } catch (err) {
-    console.log(`Codemagic auto-setup skipped: ${err.message || err}`);
+function printNextSteps(isGitHubActions) {
+  console.log('');
+  console.log('Next steps:');
+  if (isGitHubActions) {
+    console.log('  1. Fill ci.config.yaml with credentials');
+    console.log('  2. Add creds/AuthKey.p8 and creds/play-service-account.json');
+    console.log('  3. Set MATCH_PASSWORD secret in GitHub repository settings');
+    console.log('  4. Start Claude Code');
+  } else {
+    console.log('  1. Fill ci.config.yaml (codemagic.app_id is auto-configured if token was provided)');
+    console.log('  2. Add creds/AuthKey.p8 and creds/play-service-account.json');
+    console.log('  3. Start Claude Code');
+    console.log('  Note: For auto-trigger, install gh CLI and run "gh auth login"');
   }
 }
 
@@ -157,11 +115,18 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
 
   console.log('Installing/updating Daemux Store Automator...');
 
-  const tokens = await promptForTokens(cliTokens);
+  const isGitHubActions = Boolean(cliTokens.githubActions);
+
+  const tokens = isGitHubActions
+    ? { bundleId: cliTokens.bundleId ?? '' }
+    : await promptForTokens(cliTokens);
 
   const projectDir = process.cwd();
-  const servers = getMcpServers(tokens);
-  writeMcpJson(projectDir, servers);
+
+  if (!isGitHubActions) {
+    const servers = getMcpServers(tokens);
+    writeMcpJson(projectDir, servers);
+  }
 
   const oldVersion = readMarketplaceVersion();
   const packageDir = getPackageDir();
@@ -183,7 +148,17 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
   installCiTemplates(projectDir, packageDir);
   installFirebaseTemplates(projectDir, packageDir);
 
-  await setupCodemagicApp(projectDir, tokens.codemagicToken, tokens.codemagicTeamId);
+  if (tokens.bundleId) {
+    const written = writeCiBundleId(projectDir, tokens.bundleId);
+    if (written) console.log(`Bundle ID set in ci.config.yaml: ${tokens.bundleId}`);
+    writeCiPackageName(projectDir, tokens.bundleId);
+  }
+
+  if (isGitHubActions) {
+    installGitHubActionsPath(projectDir, packageDir, cliTokens);
+  } else {
+    await installCodemagicPath(projectDir, tokens);
+  }
 
   const scopeLabel = scope === 'user' ? 'global' : 'project';
   console.log(`Configuring ${scopeLabel} settings...`);
@@ -191,20 +166,6 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
   injectEnvVars(settingsPath);
   injectStatusLine(settingsPath);
 
-  const ghConfigured = setupGitHubActions(tokens.codemagicToken);
-  if (ghConfigured) {
-    console.log('GitHub Actions: CM_API_TOKEN secret configured.');
-  } else if (tokens.codemagicToken) {
-    console.log('GitHub Actions: secret not set (gh CLI unavailable or not authenticated).');
-  }
-
   printSummary(scope, oldVersion, newVersion);
-  console.log('');
-  console.log('Next steps:');
-  console.log('  1. Fill ci.config.yaml (codemagic.app_id is auto-configured if token was provided)');
-  console.log('  2. Add creds/AuthKey.p8 and creds/play-service-account.json');
-  console.log('  3. Start Claude Code');
-  if (!ghConfigured) {
-    console.log('  Note: For auto-trigger, install gh CLI and run "gh auth login"');
-  }
+  printNextSteps(isGitHubActions);
 }

package/src/prompt.mjs

@@ -22,8 +22,16 @@ function allTokensProvided(cliTokens) {
   );
 }
 
+function allPromptsProvided(cliTokens) {
+  return (
+    cliTokens.bundleId !== undefined &&
+    allTokensProvided(cliTokens)
+  );
+}
+
 export async function promptForTokens(cliTokens = {}) {
   const result = {
+    bundleId: cliTokens.bundleId ?? '',
     stitchApiKey: cliTokens.stitchApiKey ?? '',
     cloudflareToken: cliTokens.cloudflareToken ?? '',
     cloudflareAccountId: cliTokens.cloudflareAccountId ?? '',
@@ -31,14 +39,14 @@ export async function promptForTokens(cliTokens = {}) {
     codemagicTeamId: cliTokens.codemagicTeamId ?? '',
   };
 
-  if (allTokensProvided(cliTokens)) {
-    console.log('All MCP tokens provided via CLI flags, skipping prompts.');
+  if (allPromptsProvided(cliTokens)) {
+    console.log('All configuration provided via CLI flags, skipping prompts.');
     return result;
   }
 
   if (!isInteractive()) {
-    console.log('Non-interactive terminal detected, skipping token prompts.');
-    console.log('Run "npx store-automator" manually to configure MCP tokens.');
+    console.log('Non-interactive terminal detected, skipping prompts.');
+    console.log('Run "npx store-automator" manually to configure.');
     return result;
   }
 
@@ -47,12 +55,28 @@ export async function promptForTokens(cliTokens = {}) {
     output: process.stdout,
   });
 
-  console.log('');
-  console.log('MCP Server Configuration');
-  console.log('Press Enter to skip any token you do not have yet.');
   console.log('');
 
   try {
+    if (cliTokens.bundleId === undefined) {
+      console.log('App Configuration');
+      console.log('');
+      result.bundleId = await ask(
+        rl,
+        'Bundle ID / Package Name (e.g., com.company.app): '
+      );
+      console.log('');
+    }
+
+    if (allTokensProvided(cliTokens)) {
+      console.log('All MCP tokens provided via CLI flags.');
+      return result;
+    }
+
+    console.log('MCP Server Configuration');
+    console.log('Press Enter to skip any token you do not have yet.');
+    console.log('');
+
     if (cliTokens.stitchApiKey === undefined) {
       result.stitchApiKey = await ask(
         rl,

package/src/templates.mjs

@@ -1,4 +1,4 @@
-import { existsSync, cpSync, copyFileSync } from 'node:fs';
+import { existsSync, cpSync, copyFileSync, chmodSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { ensureDir } from './utils.mjs';
 
@@ -22,6 +22,17 @@ const FIREBASE_COPIES = [
   ['firebase/.firebaserc.template', 'backend/.firebaserc'],
 ];
 
+const GH_ACTIONS_WORKFLOWS = [
+  ['github/workflows/ios-release.yml', '.github/workflows/ios-release.yml'],
+  ['github/workflows/android-release.yml', '.github/workflows/android-release.yml'],
+];
+
+const GH_ACTIONS_SCRIPT_DIRS = [
+  'scripts/ci/common',
+  'scripts/ci/android',
+  'scripts/ci/ios',
+];
+
 function copyIfMissing(srcPath, destPath, label, isDirectory) {
   if (!existsSync(srcPath)) return;
   if (existsSync(destPath)) {
@@ -81,3 +92,62 @@ export function installFirebaseTemplates(projectDir, packageDir) {
     copyIfMissing(join(templateDir, src), join(projectDir, dest), dest, false);
   }
 }
+
+function copyOrUpdate(srcPath, destPath, label) {
+  if (!existsSync(srcPath)) return;
+  ensureDir(join(destPath, '..'));
+  if (existsSync(destPath)) {
+    console.log(`  ${label} exists, overwriting.`);
+  }
+  copyFileSync(srcPath, destPath);
+}
+
+function chmodShFiles(dirPath) {
+  if (!existsSync(dirPath)) return;
+  for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+    const fullPath = join(dirPath, entry.name);
+    if (entry.isDirectory()) {
+      chmodShFiles(fullPath);
+    } else if (entry.name.endsWith('.sh')) {
+      chmodSync(fullPath, 0o755);
+    }
+  }
+}
+
+export function installGitHubActionsTemplates(projectDir, packageDir) {
+  console.log('Installing GitHub Actions templates...');
+  const templateDir = join(packageDir, 'templates');
+
+  for (const [src, dest] of GH_ACTIONS_WORKFLOWS) {
+    copyOrUpdate(join(templateDir, src), join(projectDir, dest), dest);
+  }
+
+  for (const scriptDir of GH_ACTIONS_SCRIPT_DIRS) {
+    const scriptsSrc = join(templateDir, scriptDir);
+    const scriptsDest = join(projectDir, scriptDir);
+    if (existsSync(scriptsSrc)) {
+      ensureDir(scriptsDest);
+      cpSync(scriptsSrc, scriptsDest, { recursive: true });
+      chmodShFiles(scriptsDest);
+      console.log(`  ${scriptDir}/ copied.`);
+    }
+  }
+}
+
+export function installMatchfile(projectDir, packageDir, flutterRoot, { matchGitUrl, bundleId }) {
+  console.log('Installing Matchfile...');
+  const src = join(packageDir, 'templates', 'Matchfile.template');
+  if (!existsSync(src)) return;
+
+  const destDir = join(projectDir, flutterRoot, 'ios', 'fastlane');
+  ensureDir(destDir);
+  const dest = join(destDir, 'Matchfile');
+
+  copyOrUpdate(src, dest, 'Matchfile');
+
+  const content = readFileSync(dest, 'utf8');
+  const updated = content
+    .replace('{{MATCH_GIT_URL}}', matchGitUrl)
+    .replace('{{BUNDLE_ID}}', bundleId);
+  writeFileSync(dest, updated, 'utf8');
+}

package/templates/Matchfile.template

@@ -0,0 +1,8 @@
+git_url(ENV["MATCH_GIT_URL"] || "{{MATCH_GIT_URL}}")
+storage_mode("git")
+type("appstore")
+app_identifier(ENV["BUNDLE_ID"] || "{{BUNDLE_ID}}")
+git_branch("main")
+
+# Set to true after initial cert creation for faster CI runs
+# readonly(true)

package/templates/ci.config.yaml.template

@@ -12,6 +12,9 @@ credentials:
     service_account_json_path: creds/play-service-account.json
   android:
     keystore_password: "REPLACE_WITH_PASSWORD"
+  match:
+    deploy_key_path: ""
+    git_url: ""
 
 # === APP IDENTITY ===
 app: