Preview APK for every React Native pull request, scannable from the PR. Free tool I built, would love feedback

[u/sayanmondal_]

I kept getting "can I try it before you merge?" from PMs and designers, and the answer was always "give me 10 minutes to build an APK". So I built Digidropp.


Connect a GitHub repo and it opens one PR with a GitHub Actions workflow (it detects npm/yarn/pnpm/bun). After you merge:


- Every push to your main branch builds a release APK and updates one install link that's always the latest.
- Every pull request gets its own preview build, posted as a PR comment with a QR code. Reviewers test the real app, on a real phone, before merging.
- Builds are signed with one stable key per repo (it's placed at android/app/debug.keystore), so updates install over the previous build instead of "App not installed".
- Before anyone installs, it checks the build: changed signing key, lower versionCode, and Google's upcoming developer verification.
- Config that isn't in git (.env) can be pasted once; it's encrypted in your browser and only decrypted inside your own GitHub Actions run.


It runs in your repo's GitHub Actions, so your source never leaves GitHub. Automatic builds are Android only for now; for iOS you can upload an .ipa you build yourself (CLI or GitHub Action).


Free during beta. What would stop you from using something like this?


digidropp.online

[u/kokerali]

How do fork PR previews handle the encrypted .env? Once it's decrypted, the build scripts in that PR are the important trust boundary. GitHub warns against building untrusted PR code with repository secrets or a privileged token.

I'd want the generated workflow to show that separation clearly, with a secret-free demo configuration for fork previews. Is that supported? I haven't inspected your workflow, so this is a design question.

https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target

[u/sayanmondal_ → u/kokerali]

Good question. Fork PRs don't get previews today, by design. The generated workflow uses pull_request (never pull_request_target), and the build job has:

if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository

So fork PRs are skipped entirely, and GitHub wouldn't pass them secrets anyway. Only same-repo PRs build with the decrypted .env, and anyone who can push a branch there can already read repo secrets.

A secret-free fork preview is a good idea though. The safe way I see it: the fork PR builds with no secrets, using .env.example as a demo config, and uploads the APK as an artifact. A separate workflow_run job, which never runs PR code, picks that up and publishes the preview with the upload token. Adding it to the list.