Prepare A Play Release

Release work starts before Play Console upload. Build a release artifact, protect signing keys, verify target API, and document policy-sensitive behavior.

Release Checklist

Step	Evidence
Versioning	`versionCode` increments and `versionName` is intentional
Build type	Release variant selected or `bundleRelease` run
Artifact	AAB for Play, APK only for local or non-Play distribution
Signing	Upload key configured outside source control
Play App Signing	Enabled or explicitly planned
Target API	Current Play requirement checked
Data safety	Matches actual storage, network, SMS, analytics, and sharing behavior
Restricted permissions	Declaration form and demo evidence ready if applicable
Internal test	Uploaded to internal testing or blocker documented

Build Locally

./gradlew :app:clean
./gradlew :app:testReleaseUnitTest
./gradlew :app:lintRelease
./gradlew :app:bundleRelease

Task names vary by project. Use ./gradlew tasks if a command does not exist.

Signing Model

Play App Signing uses two concepts:

Key	Held By	Used For
App signing key	Google when enrolled in Play App Signing	Signing APKs delivered to users
Upload key	Developer	Signing AAB/APK uploaded to Play

Keep the upload key secure. If it is compromised or lost, Play can reset the upload key, but that does not make committing it acceptable.

Files That Must Stay Out Of Git

*.jks
*.keystore
keystore.properties
play-service-account*.json
local.properties

Debug Versus Release

Android Studio’s Run button builds and installs a debug path. Official docs note that this path can use testOnly=true, which is not the same as a user-installable release.

Release proof needs a release task and artifact path:

Artifact: app/build/outputs/bundle/release/app-release.aab
Build command: ./gradlew :app:bundleRelease
Result: passed
Signing: upload key from local untracked keystore properties

Policy Review Package

For SMS finance apps, collect:

privacy policy URL
onboarding screenshots
system permission prompt path
demo video showing core SMS money-management flow
denied-permission fallback screenshots
store listing text that describes the core feature honestly
statement that unrelated SMS content is not collected or shared

Gotcha: A release can fail without a crash. Target API drift, missing declarations, misleading Data safety answers, or a debug-signed artifact can block shipping.