aarwitz/Tapp Release Gate

PR-aware app exploration and deterministic release-contract gates for iOS, Android, and web, with inspectable evidence.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Aug 23, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: aarwitz/tapp@7115e38d7aa3c3ed6e7c2b4d61b9f1e88589f7e8 # v0.17.3

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
platform	Target platform: ios, android, or web	no	ios
url	Web: URL of an already-running owned app. Omit to detect/build/start/stop one target from the repository.	no	""
web-target	Web: target name, id, or repository-relative path when more than one browser target is detected.	no	""
target-key	Stable application-model target id used to isolate baselines for multiple targets on the same platform.	no	default
android-app-id	Android: application id, e.g. com.example.app	no	""
android-serial	Android: optional adb device serial (the caller must start/connect the emulator)	no	""
bundle-id	Bundle identifier of the app under test. Auto-detected from the built .app when omitted.	no	""
app-path	iOS simulator .app or Android .apk. If omitted, the action builds from the platform project inputs.	no	""
project	Path to the .xcodeproj or .xcworkspace to build (used when app-path is not given)	no	""
scheme	Scheme to build (used when app-path is not given)	no	""
configuration	Build configuration	no	Debug
android-project	Android: Gradle project directory (defaults to the workspace)	no	""
android-task	Android: Gradle APK build task	no	assembleDebug
max-actions	Exploration budget (number of autonomous actions)	no	40
timeout	Exploration watchdog in seconds	no	600
flows	Glob of Flow YAMLs to replay (default: .tapp/flows/*.yml in the workspace, if present)	no	""
scenarios	Web: glob of multi-actor Scenario YAMLs (default: .tapp/scenarios/*.yml when present)	no	""
contracts	Glob of TypeScript release contracts (default: .tapp/contracts/*.contract.ts when present)	no	""
pr-selection	On pull requests, run critical/always contracts plus contracts selected from the real changed-file set and reviewed UI Map/Task ownership.	no	true
baseline	Path to a baseline report JSON. If omitted, .tapp/baseline.json wins; otherwise the latest successful, conclusive default-branch report is restored automatically.	no	""
fail-on	Gate policy: gate (regressions + failed release contracts/flows; default), absolute (any current-run deterministic findings-block or inconclusive run — no baseline needed), any (any finding)	no	gate
simulator-device	Simulator device to boot when none is booted	no	iPhone 16 Pro
test-email	Login email for apps behind an auth wall (pass via a secret). Used by the exploration login preamble.	no	""
test-password	Login password for apps behind an auth wall (pass via a secret).	no	""
launch-args	JSON array of app launch arguments, e.g. ["--uitesting"] to bypass login on a supporting build.	no	""
launch-env	JSON object of app launch environment, e.g. {"UI_TEST_BACKEND":"staging"}.	no	""
login-steps	JSON array of explicit login steps for a custom login UI (see .tapp.yml app.login.steps). $TEST_EMAIL/$TEST_PASSWORD are substituted.	no	""
comment-on-pr	Post the report as a sticky comment on the PR (only on pull_request events).	no	true
github-token	Token used to post the PR comment. Defaults to the workflow token.	no	${{ github.token }}

Outputs

name	description
report	Path to the full JSON report (usable as the next baseline)
outcome	The gate outcome: pass \| fail \| inconclusive (fail and inconclusive both block a merge)
gate-failed	true when the gate failed (merge should be blocked)
baseline-source	Baseline source: explicit \| committed \| automatic \| none
pr-plan	Path to the PR selection, coverage-gap, replay, and maintenance-candidate plan when PR selection ran