Shipping Tauri Android APKs That Play Nice With the Play Store
Any team distributing a Tauri Android app outside Google Play—on their own site or GitHub Releases—will ship APKs that the Play Store refuses to update unless they adopt this Google-signed download step. It turns a recurring support headache into a one-time CI configuration.
Tauri Android builds hit a wall when the locally signed APK can't overwrite or update a Play Store install. The culprit is Play App Signing: developers hold only an Upload Key, while Google holds the App Signing Key that signs the final APK users receive. The fix is not to match signatures locally, but to let Google do the signing and then download the result.
The workflow uses a service account and the Google Play Android Developer API inside GitHub Actions. Tauri builds the AAB, the action uploads it as a draft, polls for the generated signed Universal APK, and attaches that APK to a GitHub Release or other distribution channel. The locally signed APK stays for development testing only.
This sidesteps the private-key problem entirely. Every APK users get from an official website or GitHub Release carries Google's signature, so the Play Store can update it without friction. The service account JSON lives exclusively in GitHub Secrets, keeping the pipeline secure.
The signature mismatch is not a Tauri bug but a structural consequence of Play App Signing, and many mobile CI guides gloss over the need to pull the Google-signed artifact back out for external distribution.
Treating the Play Console as a signing service—upload an unsigned or upload-key-signed bundle, download the Google-signed APK—turns a perceived limitation into a reliable distribution step that also future-proofs against Google's key upgrades.
The pipeline's security posture is unusually clean for a mobile CI setup: the only secret is a service account JSON, and the signing material that touches end users never leaves Google's infrastructure.