GitHub

Connect your repository once, and the app builds without your computer: Ploa checks every pull request against the stores' rules, builds on your GitHub Actions, and puts the build on TestFlight and Google Play testing, with an install link on the pull request. No key goes in the repository.

What to ask your agent

The tools behind these: Every MCP tool › GitHub.

Who does what

Connect and link

1. Install Ploa's GitHub App

   From the app's GitHub card on the dashboard, or the link your agent gives you. You choose which repositories it may read. It finds the apps in them.

2. Link the app

   The repository, the app's folder and the release branch. Your agent reads them from your checkout and asks; you approve on ploa.dev. The link decides which repository's runs can sign the app, so you approve it yourself (an autonomous agent's link is made at once).

3. Add Ploa's workflow

   Ploa commits its workflow file to the release branch (a pull request when the branch is protected), once the GitHub App has the Workflows permission. Until then, add it from the card, or let your agent add it in your checkout and open a pull request.

A platform whose build is in another folder of the same repository (a Mac app in mac/, say) gets that folder on the card.

Checks on pull requests

Every pull request is checked against what the stores reject, and the findings appear on the lines they're about. It's the same preflight as ploa preflight, run as a GitHub check, for each app whose folder the pull request changes. You can make it a required check in branch protection. A pull request from a fork passes with a notice, since its run can't sign in.

Builds on GitHub Actions

• Start one from the Build button on the dashboard, from your agent, or with a pull request label: ploa:android, ploa:ios or ploa:all builds the pull request's latest commit (turn labels on in the card). An agent asked to build anywhere builds on GitHub once that platform is ready there; agents on the web always build on GitHub.
• Android builds on GitHub's Linux runners.
• iOS builds on your own Mac registered as a self-hosted runner (ploa runner add), or on GitHub's Macs if allowed for the app (below). On GitHub's Macs the signing identity goes to GitHub's machine for that build only, in a keychain removed at the end; the App Store Connect key never leaves Ploa.
• No secrets in the repository. Ploa's workflow signs in as the run itself (GitHub's OIDC), so there's no token or key in the repository's secrets.
• Files that aren't in git, like .env or google-services.json: Ploa says which a build would miss. Add them on the card, or send them from your checkout with ploa files push (or your agent); you approve them once. Up to 20 files, 256 KB each, never a store or signing key. A build writes them before it starts and deletes them at the end, with a .env's values masked in the log.
• Install from the pull request. When the build reaches testers, the pull request gets one comment, edited on each new build: for iOS the TestFlight build, with its public link and QR code when the app has one; for Android a Play internal app sharing link and its QR code. A tester turns on internal app sharing once in the Play Store, and the app needs a release on some track first.

ploa runner add --repo owner/name   # this Mac as the repository's iOS runner
ploa runner status
ploa runner remove --repo owner/name
ploa files                          # build files: in git, kept by Ploa, or missing
ploa files push                     # send the missing ones, for your approval

What GitHub builds cost

Nothing from Ploa. GitHub counts the minutes on your own GitHub account: free on a public repository; on a private one they come out of your plan's free monthly minutes, where a Linux minute counts as one and a Mac minute as ten (an iOS build on GitHub's Macs uses about 150 to 200). Builds on your own Mac as a runner use none. Your agent tells you before an iOS build on GitHub's Macs.

The app's GitHub settings

The switches on the app's GitHub card. Your agent can ask to change them; you approve the change on ploa.dev.

The store page from the repository

One text file per store, language and field: store/apple/<language>/<field>.txt (name, subtitle, promotionalText, description, keywords, whatsNew, supportUrl, marketingUrl, privacyPolicyUrl) and store/google/<language>/<field>.txt (title, shortDescription, fullDescription, video). A push to the release branch that adds or changes one makes it a draft, checked against the store's limits, and a comment on the commit says what became a draft and what was refused and why. One way only: Ploa never writes to store/, a deleted file changes nothing, and you still send from Ploa. Export on the card opens a pull request with today's store page as files, to start from. Screenshots aren't in it. See The store page.

Issues from the stores

• App Review rejections: an issue with what Apple said and what to fix, closed when the version is approved.
• Low-star reviews: at most one issue a day per store, with the new one- and two-star reviews.
• Crashes: an issue while a crash or ANR rate on Google Play is over Play's bad-behavior threshold, closed when it's back under.
• TestFlight feedback: testers' comments, the device and build, and a crash's log.

An agent that works on issues (Claude Code's GitHub Action, GitHub's coding agent) can pick them up from there. Each source starts from when you turn it on.

Agents in GitHub Actions

An agent that runs in a workflow runs ploa mcp on the runner, and signs in as the run, with the draft level at most. Approvals stay with you.

What Ploa does in your repository

It reads the repositories you choose. It changes something only once you turn it on, and then only through a pull request, a check, an issue, a comment or a tag. It runs only its own workflow and never pushes to your branches. On a push, it looks at the names of the files changed (never their contents) for a store key, a certificate or a keystore, and alerts the workspace's owners if one was pushed; preflight checks the project's files before a build too. You can remove Ploa's GitHub App at any time.

On the dashboard

Each app's GitHub card, in its App settings, has the link, the workflow, where iOS builds, build files and the switches above. Settings › GitHub has the repositories linked to Ploa, their builds and the defaults for apps you link from now on.