Gate hot-updater

hot-updater has no token of its own. hot-updater deploy writes bundles with the credentials of the storage and database you configured, such as Supabase, Cloudflare R2 and D1, AWS S3 with CloudFront, or Firebase. hot-updater init saves them to .env.hotupdater. Whoever holds those credentials can publish, so they are what Mocco keeps. Set up Release a token to your pipeline first.

Store the credentials

Create credentials for CI that can do as little as your provider allows, separate from the ones you used for setup. hot-updater's own docs recommend this for AWS. For Supabase the deploy needs the service-role key, which is broad, so keep it only in Mocco.

Mocco stores one secret per token, so store the whole contents of .env.hotupdater as the token: every KEY=value line your deploy needs. For Cloudflare, for example:

HOT_UPDATER_CLOUDFLARE_ACCOUNT_ID=…
HOT_UPDATER_CLOUDFLARE_R2_BUCKET_NAME=…
HOT_UPDATER_CLOUDFLARE_R2_ACCESS_KEY_ID=…
HOT_UPDATER_CLOUDFLARE_R2_SECRET_ACCESS_KEY=…
HOT_UPDATER_CLOUDFLARE_D1_DATABASE_ID=…
HOT_UPDATER_CLOUDFLARE_API_TOKEN=…

Add it on Mocco's OTA updates page, on the Your OTA tool tab, with the tool hot-updater, for example as acme-production. Its provider id is ota-hot-updater. The variable names for each provider are in hot-updater's managed provider docs.

Deploy

The released value has several lines, so this fetch step writes it to .env.hotupdater and masks each value, in place of the single OTA_TOKEN line in the pipeline guide:

      - name: Get the storage credentials from Mocco
        run: |
          body=$(jq -nc --arg run "$MOCCO_RUN_ID" --argjson step "$MOCCO_STEP" --arg token "$MOCCO_RUN_TOKEN" \
            '{runId: $run, stepIndex: $step, token: $token}')
          curl -fsS -X POST "${MOCCO_CALLBACK_URL%/callback}/credentials" \
            -H 'content-type: application/json' -d "$body" | jq -r '.credentials.value' > .env.hotupdater
          while IFS='=' read -r _ value; do
            if [ -n "$value" ]; then echo "::add-mask::$value"; fi
          done < .env.hotupdater

      - run: npm ci
      - run: npx hot-updater deploy -p android -c production -m "${{ github.event.client_payload.commitSha }}"

Leaving out -p deploys iOS and then Android. -r 25 rolls out to a share of devices. See deploying.

Roll back

Disable the bundle and devices go back to the previous one:

npx hot-updater bundle disable <bundle id> -y

npx hot-updater bundle list -p android --json lists bundle ids. Run it from your rollback pipeline with the same released credentials. See the console guide.

Rotate

Rotate the keys in your provider, update the lines, choose Rotate on the token's card in Mocco and paste the new contents, then revoke the old keys in the provider.