What is the best CI/CD platform for Android apps?

For most teams the CI they already use is enough, because Android builds run on Linux. GitHub Actions, GitLab CI, CircleCI, and Azure DevOps handle Gradle well. Bitrise, Codemagic, and Appcircle add managed keystores and Play publishing. Capacitor teams can call Capgo Build to sign and upload without maintaining an Android toolchain.

Do I need a Mac for Android CI?

No. Android builds run on Linux runners, which are the cheapest runners on every platform. A Mac is only needed for the iOS half of a cross-platform app.

Should CI upload an APK or an AAB to Google Play?

An AAB. Google Play requires Android App Bundles for new apps and signs the final APKs itself with Play App Signing. Build APKs only for direct installs, MDM distribution, or other stores.

Where should I keep the Android keystore for CI?

Base64-encode it into a secret or a secure file on your CI, or use a platform that stores keystores for you. With Play App Signing your keystore is the upload key, so Google can reset it if it leaks, but keep an offline backup anyway.

How do I upload to Google Play from CI?

Create a Google Cloud service account, grant it access in Play Console, and use its JSON key with fastlane supply, the Gradle Play Publisher plugin, a CI integration such as Bitrise or Codemagic publishing, or Capgo Build's Play upload.

Best CI/CD Platforms for Android Apps in 2026, Compared

The best CI/CD platform for Android apps is often the one you already run, because Android builds only need Linux, Java, the Android SDK, and Gradle. The differences between platforms show up around the build: how they store your keystore, how they upload to Google Play tracks, how fast Gradle caching makes repeat builds, and whether the same platform also handles iOS. This comparison covers GitHub Actions, GitLab CI, Bitrise, Codemagic, Appcircle, CircleCI, Azure DevOps, and Capgo Build.

The Android release flow in 2026

Every Android pipeline does roughly the same thing:

Install a JDK and the Android SDK (or use an image that has them).
Run ./gradlew bundleRelease.
Sign the AAB with your upload key.
Upload it to a Play Console track (internal, closed, open, or production) through the Google Play Developer API.
Optionally roll out to a percentage of users.

Rules that every platform has to respect:

AAB is mandatory for new apps on Google Play, and Google re-signs the delivered APKs with the app signing key it holds (Play App Signing).
Target API level rises yearly. Google raises the minimum targetSdkVersion for updates every August. Capacitor 8 already targets API 36.
16 KB page sizes. Newer devices use 16 KB memory pages, and Play requires native libraries in updated apps to support them. See Android 16 KB page size for Capacitor plugins.
JDK 21 is the baseline for Capacitor 7 and 8 projects and recent Android Gradle Plugin versions.

Feature matrix

Platform	Runners	Keystore storage	Play upload	Gradle cache	iOS too	Pricing model
GitHub Actions	Hosted Linux, self-hosted	Encrypted secrets	fastlane, Gradle Play Publisher, or community actions	`gradle/actions/setup-gradle`	Yes, macOS runners	Per minute, Linux cheapest; free for public repos
GitLab CI	Hosted Linux, self-managed	CI/CD variables, secure files	fastlane, Google Play integration	`cache:` keys	Yes, macOS beta	Compute minutes per tier
Bitrise	Hosted Linux stacks	Managed code signing files	Google Play Deploy step	Built-in cache steps	Yes	Credits per build minute
Codemagic	Hosted Linux and Mac	Named keystore references	Built-in, tracks and rollout fraction	Built-in	Yes	Per minute or annual plans
Appcircle	Hosted or self-hosted server	Signing identity store	Publish module	Built-in	Yes	Plan tiers, enterprise self-hosted
CircleCI	Hosted Linux (`cimg/android`), self-hosted	Contexts and env vars	fastlane or scripts	`save_cache`/`restore_cache`	Yes	Credits per minute
Azure DevOps	Microsoft-hosted, self-hosted	Secure files	Google Play extension task	`Cache@2`	Yes	Parallel jobs
Capgo Build	Capgo-managed, called from any CI	Sent from your CI secrets per build	Built-in, track and status flags	Per-app build cache	Yes	Build minutes, see pricing

Xcode Cloud is not in the table because it only builds Apple platforms. Capgo Build only builds Capacitor apps; every other platform here builds native Kotlin and Java projects too.

Platform by platform

GitHub Actions

Linux runners with Java and the Android SDK preinstalled on ubuntu-latest, so ./gradlew bundleRelease works after actions/setup-java. gradle/actions/setup-gradle handles Gradle caching well. Emulator tests run on Linux runners with KVM through community actions such as reactivecircus/android-emulator-runner.

Signing means decoding the keystore from a secret and passing passwords through Gradle properties. Uploading uses fastlane supply, the Gradle Play Publisher plugin, or a community action. Nothing is managed, but nothing is hidden either, and Linux minutes are the cheapest you will find. Guide: Automatic Capacitor Android build with GitHub Actions.

GitLab CI

Same story on GitLab: any Docker image with the Android SDK works on shared Linux runners. GitLab’s Mobile DevOps features include secure files for keystores and a Google Play integration that exposes the service account to jobs, which removes some boilerplate from fastlane setups. Guide: Automatic Capacitor Android build on GitLab.

Bitrise

Bitrise’s Android support centers on steps: Android Build, Android Sign, Google Play Deploy, plus test and emulator steps. Keystores are uploaded once in the app’s code signing settings. The Google Play Deploy step supports tracks and staged rollout fractions. You pay in credits, so Android builds are cheaper than iOS but still more than a raw Linux runner. Good for mobile teams that want a UI-driven workflow editor.

Codemagic

Codemagic stores keystores as named references that codemagic.yaml points to, so the file never appears in your repository or logs. The google_play publishing block sets the track, rollout fraction, and whether to submit as draft. It builds native Android, Flutter, React Native, Ionic, and Capacitor. Billing is per build minute or a fixed annual plan.

Appcircle

Appcircle stores keystores in its signing identities module and publishes to Google Play through its publish flow, alongside tester distribution and an enterprise app store. The self-hosted Appcircle Server option is the main reason regulated teams pick it: code and keys never leave their network.

CircleCI

CircleCI publishes cimg/android Docker images with the SDK installed, plus an Android orb with helpers for emulator tests and caching. Signing and upload are scripts or fastlane. Billing uses credits, and Linux Docker executors are the cheapest resource classes. A reasonable choice when CircleCI already runs the rest of your stack.

Azure DevOps

Azure Pipelines has first-party tasks for each step: Gradle@3 to build, AndroidSigning@3 to sign and zipalign, secure files for the keystore, and the Google Play extension’s release task for track uploads and staged rollouts. Pricing is per parallel job. It is the natural landing spot for teams that used App Center’s Android builds.

Capgo Build

Capgo Build is a build service for Capacitor apps that your CI calls. The job runs bun run build and bunx cap sync android, then:

bunx @capgo/cli@latest build request com.example.app \
  --platform android \
  --build-mode release \
  --android-track internal

Capgo runs Gradle on its build machines, signs with your keystore, reads the highest versionCode from Google Play and increments it, and uploads the AAB to the track you chose. --android-release-status, --android-flavor, and --submit-to-store-review control the rest. For APK builds outside Google Play (kiosk devices, MDM), --no-playstore-upload --output-upload returns a download link instead.

Setup is guided: bunx @capgo/cli@latest build init --platform android creates or imports the keystore, and can provision the Google Cloud service account and Play Console invite through Google sign-in, which is the step most teams get wrong by hand.

To be fair about it: Android is the platform where Capgo Build saves the least, because Linux runners are cheap everywhere. Its value on Android is consistency with the iOS pipeline, automatic version codes, no Android SDK or JDK upkeep in CI, and the same CLI shipping live updates for web-only changes. A single build is limited to 10 minutes.

Android pain points and how each platform handles them

Keystore loss

Losing the keystore used to mean you could never update the app again. With Play App Signing, the keystore you hold is only the upload key, and Play Console support can register a new upload key. Still, keep an offline backup. Every platform above stores the keystore encrypted; the risk is usually the copy on a developer’s laptop. If you need a fresh one, the Android keystore generator creates it in the browser.

Version code collisions

Play rejects an upload whose versionCode was already used. Options: derive it from the CI run number (GitHub, GitLab, CircleCI), use the platform’s build number variable (Bitrise, Codemagic, Appcircle), or let Capgo Build read the latest value from Play and increment it.

Slow Gradle builds

A cold Capacitor Android build downloads hundreds of megabytes of dependencies. Caching ~/.gradle/caches and ~/.gradle/wrapper makes repeat builds much faster. Give Gradle enough memory in gradle.properties (org.gradle.jvmargs=-Xmx4g) on hosted runners, and build iOS and Android in parallel jobs instead of one after the other.

Plugin and AGP upgrades

New Android Gradle Plugin versions break older plugins. Pin AGP in your project and upgrade on a branch. Specific fixes are in Fix Capacitor plugin build errors with AGP 9 and How to resolve Android build errors in Capacitor.

Play service account permissions

“The caller does not have permission” is the most common upload error. The service account must be invited in Play Console under Users and permissions with release rights for the app, and the Google Play Android Developer API must be enabled in its Google Cloud project. New service accounts can take a while before the API accepts them.

How to choose

Your situation	Good fit
Android only, already on GitHub or GitLab	GitHub Actions or GitLab CI
Native Android team that wants a visual workflow editor	Bitrise
Cross-platform team that wants managed keystores and Play publishing in YAML	Codemagic
Must self-host everything	Appcircle Server or self-hosted runners
Coming from App Center, Microsoft stack	Azure DevOps
Capacitor app, want Android and iOS through one CLI from any CI	Capgo Build

For the iOS side of the same decision, read Comparing CI/CD platforms for iOS apps. For Capacitor apps specifically, including live updates, see Comparing CI/CD platforms for Capacitor apps.

A quick checklist before you migrate

Confirm you have the upload keystore file and both passwords, and that the alias matches.
Check in Play Console which certificate is registered as the upload key, and compare its SHA-1 with keytool -list -v -keystore release.jks.
Create a dedicated service account for the new CI instead of reusing a personal one.
Make sure the new platform builds with JDK 21 for Capacitor 8 projects.
Run one internal-track upload before switching production releases.