CI/CD Integration

Shield runs as part of your standard Gradle build, so integrating it into CI/CD pipelines requires only adding the project token as a secret and ensuring internet connectivity during builds.

Prerequisites

• Shield configured in your project (see Gradle Setup)
• Project token stored as a CI/CD secret (never hardcode it in your repository)
• Internet access during the build (Shield validates the license with ByteHide cloud)

GitHub Actions

# .github/workflows/release.yml
name: Release Build

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Build Release APK
        env:
          SHIELD_PROJECT_TOKEN: ${{ secrets.SHIELD_PROJECT_TOKEN }}
        run: ./gradlew assembleRelease

      - name: Upload APK
        uses: actions/upload-artifact@v4
        with:
          name: release-apk
          path: app/build/outputs/apk/release/*.apk

# .github/workflows/release.yml
name: Release Build

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Build Release APK
        env:
          SHIELD_PROJECT_TOKEN: ${{ secrets.SHIELD_PROJECT_TOKEN }}
        run: ./gradlew assembleRelease

      - name: Upload APK
        uses: actions/upload-artifact@v4
        with:
          name: release-apk
          path: app/build/outputs/apk/release/*.apk

Add SHIELD_PROJECT_TOKEN in Settings → Secrets and variables → Actions → New repository secret.

GitLab CI

# .gitlab-ci.yml
stages:
  - build

build-release:
  stage: build
  image: openjdk:17-jdk
  variables:
    SHIELD_PROJECT_TOKEN: $SHIELD_PROJECT_TOKEN
  before_script:
    - export GRADLE_USER_HOME=$(pwd)/.gradle
  script:
    - ./gradlew assembleRelease
  artifacts:
    paths:
      - app/build/outputs/apk/release/*.apk
  cache:
    paths:
      - .gradle/

# .gitlab-ci.yml
stages:
  - build

build-release:
  stage: build
  image: openjdk:17-jdk
  variables:
    SHIELD_PROJECT_TOKEN: $SHIELD_PROJECT_TOKEN
  before_script:
    - export GRADLE_USER_HOME=$(pwd)/.gradle
  script:
    - ./gradlew assembleRelease
  artifacts:
    paths:
      - app/build/outputs/apk/release/*.apk
  cache:
    paths:
      - .gradle/

Add SHIELD_PROJECT_TOKEN in Settings → CI/CD → Variables.

Bitrise

Add a Script step before your Android Build step:

envman add --key SHIELD_PROJECT_TOKEN --value "$SHIELD_PROJECT_TOKEN"

envman add --key SHIELD_PROJECT_TOKEN --value "$SHIELD_PROJECT_TOKEN"

Add SHIELD_PROJECT_TOKEN as a secret in Workflow → Secrets.

Token Configuration

In your build.gradle, reference the token from the environment:

shield {
    projectToken = System.getenv('SHIELD_PROJECT_TOKEN')
}

shield {
    projectToken = System.getenv('SHIELD_PROJECT_TOKEN')
}

This pattern works in all CI/CD systems. The token is never committed to the repository.

Caching

Shield does not produce cacheable intermediate artifacts. However, caching the Gradle wrapper and dependencies speeds up builds significantly:

GitHub Actions

- name: Setup Gradle
  uses: gradle/actions/setup-gradle@v3

- name: Setup Gradle
  uses: gradle/actions/setup-gradle@v3

The gradle/actions/setup-gradle action handles caching automatically.

GitLab CI

cache:
  paths:
    - .gradle/

cache:
  paths:
    - .gradle/

Build Artifacts

After a successful build with Shield, the protected APK or AAB is in the standard output directory:

The mapping file is also generated and uploaded to the ByteHide Cloud Panel automatically for stack trace deobfuscation.