Monitoring Nevercode Mobile CI/CD with Vigilmon: Build Heartbeats, App Store Status & Pipeline Alerts

Nevercode (now part of Codemagic's ecosystem) is a cloud-based CI/CD platform specialized for mobile app development — iOS, Android, React Native, Flutter, and Xamarin. Mobile CI pipelines have uniquely long build times and complex provisioning requirements: code signing certificates expire, provisioning profiles need renewal, and builds can silently queue when capacity limits are hit. Vigilmon adds the external observability layer your mobile CI stack needs: build completion heartbeats, API availability checks, post-deployment pings, and deadline-aware certificate expiry alerts.

What You'll Build

• A build completion heartbeat for end-to-end mobile build verification
• A webhook-triggered heartbeat from successful Nevercode builds
• An API availability check for the Nevercode platform
• A post-deployment heartbeat for app store submissions
• SSL certificate expiry alerts for any associated services
• An HTTP check for your app's production API (as a companion monitor)

Prerequisites

• A Nevercode (or Codemagic) account with active mobile workflows
• At least one iOS or Android pipeline configured
• Access to Nevercode's webhook settings for your workflow
• A free account at vigilmon.online

Step 1: Build Completion Heartbeat via Webhook

Nevercode supports outgoing webhooks that fire after each build completes. Configure a webhook to send a heartbeat to Vigilmon on successful builds — this gives you immediate notification if your mobile CI pipeline stops working:

1. In Vigilmon, Add Monitor → Heartbeat.
2. Expected interval: Match your build trigger frequency (e.g., 120 minutes for builds triggered by every main branch push).
3. Grace period: 60 minutes (mobile builds take longer than typical web CI).
4. Label: Nevercode Build Completion
5. Copy the heartbeat URL from Vigilmon.

In Nevercode:

1. Open your App → Workflow settings.
2. Navigate to Post-build → Webhooks.
3. Add a webhook with the Vigilmon heartbeat URL.
4. Set Trigger condition: Build status is Successful.
5. Save.

Now every successful build on your configured branch sends a POST to Vigilmon's heartbeat endpoint. If a build starts failing, provisioning profiles expire, or the build queue backs up beyond the grace period, Vigilmon alerts you.

Step 2: Post-Build Script Heartbeat

For more control over when the heartbeat fires (e.g., only after signing and upload complete), add a build script step at the end of your Nevercode workflow:

For iOS workflows — add to your build script:

#!/bin/bash
# Run at the end of your Nevercode build script, after archive and export

# Only ping if the build artifact exists (IPA was created)
if [ -f "$NEVERCODE_BUILD_DIR/*.ipa" ]; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-BUILD-HEARTBEAT-ID
fi

For Android workflows — add to your Gradle post-build:

#!/bin/bash
# Run after assembleRelease completes

if [ -f "app/build/outputs/apk/release/app-release.apk" ] || \
   [ -f "app/build/outputs/bundle/release/app-release.aab" ]; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-BUILD-HEARTBEAT-ID
fi

For Flutter workflows:

#!/bin/bash
# Run after flutter build appbundle completes

BUILD_STATUS=$?
if [ $BUILD_STATUS -eq 0 ]; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-BUILD-HEARTBEAT-ID
fi

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Expected interval: Match your build frequency.
3. Grace period: 60 minutes.
4. Label: Nevercode Signed Build Output

This heartbeat confirms not just that the build ran, but that the signing step and artifact generation completed successfully — the steps most likely to silently fail due to expired certificates or provisioning profile issues.

Step 3: Nevercode API Availability Check

Nevercode/Codemagic exposes a REST API for triggering builds, checking build status, and managing applications. Validate API availability with a periodic token-authenticated check:

#!/bin/bash
# /etc/cron.d/nevercode-api-check — runs every 10 minutes

STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "x-auth-token: YOUR_API_TOKEN" \
  "https://api.codemagic.io/apps")

if [ "$STATUS" = "200" ]; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-API-HEARTBEAT-ID
fi

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Expected interval: 10 minutes.
3. Grace period: 30 minutes.
4. Label: Nevercode API Availability

API token expiration is a common silent failure mode for mobile CI platforms — webhook triggers and automated build scheduling stop working while the UI still shows historical builds normally.

Step 4: App Store Submission Heartbeat

For production apps, the most important signal is whether new builds are reaching the App Store or Google Play. Add a heartbeat that fires after successful submission:

iOS — after Fastlane Deliver completes:

#!/bin/bash
# In your Nevercode post-build script, after fastlane deliver

DELIVER_STATUS=$?
if [ $DELIVER_STATUS -eq 0 ]; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-STORE-HEARTBEAT-ID
fi

Android — after Google Play publishing:

#!/bin/bash
# In your Nevercode post-build script, after fastlane supply

SUPPLY_STATUS=$?
if [ $SUPPLY_STATUS -eq 0 ]; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-STORE-HEARTBEAT-ID
fi

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Expected interval: Match your release cadence (e.g., 7 days for weekly releases).
3. Grace period: 2 days.
4. Label: App Store Submission

A missed heartbeat here means your release pipeline broke — whether due to an expired Apple Distribution certificate, a Google Play API credential issue, or a failed upload — before you've published a new version to your users.

Step 5: Monitor Your App's Production API Endpoint

While not directly a Nevercode check, monitoring your production API alongside your mobile CI pipeline gives you a complete picture: you want to know both that builds are shipping AND that the API the app talks to is healthy:

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://api.yourdomain.com/health (or your production health endpoint).
3. Check interval: 60 seconds.
4. Expected status: 200.
5. Label: Production API Health
6. Click Save.

When you ship a new mobile build and see user complaints, you can immediately check whether the API went down at the same time — separating app-side regressions from backend failures.

Step 6: Code Signing Certificate Expiry Alerts

Apple Distribution certificates and Apple Push Notification certificates expire annually. An expired signing certificate causes every build to fail immediately with a code signing error:

1. If you host your own enterprise distribution server, Add Monitor → SSL Certificate.
2. Domain: distribution.yourdomain.com
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days.
5. Click Save.

For Apple certificates managed through Nevercode/Codemagic's code signing settings, set a calendar reminder 60 days before the certificate expiry date displayed in Nevercode's Code signing panel. Apple certificates cannot be automatically renewed externally — you must renew them in Apple Developer Portal.

For push notification certificates:

1. Add Monitor → SSL Certificate.
2. Domain: Your APNS gateway hostname if using direct APNS connections.
3. Alert when expiry is within: 60 days (APNS certs require more lead time for App Store review cycles).
4. Click Save.

Step 7: Branch Protection — Monitoring Feature Branch Builds

For teams with many feature branches, monitor that feature branch builds are completing on schedule to catch CI regressions early:

#!/bin/bash
# /etc/cron.d/nevercode-branch-check — runs every 30 minutes

# Query the Nevercode/Codemagic API for the last build on your default branch
LAST_BUILD=$(curl -s \
  -H "x-auth-token: YOUR_API_TOKEN" \
  "https://api.codemagic.io/builds?appId=YOUR_APP_ID&branch=main&limit=1" \
  | python3 -c "
import sys, json
data = json.load(sys.stdin)
builds = data.get('builds', [])
if builds:
    print(builds[0].get('status', ''))
")

if [ "$LAST_BUILD" = "finished" ]; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-BRANCH-HEARTBEAT-ID
fi

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Expected interval: 30 minutes.
3. Grace period: 60 minutes.
4. Label: Nevercode Main Branch Build

Common Nevercode Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Build queue backup (capacity limit) | Build completion heartbeat exceeds grace period | | iOS code signing certificate expired | Signed build output heartbeat stops | | Provisioning profile mismatch | Build completion heartbeat stops | | API token expired | API availability heartbeat stops; automated triggers fail | | App Store submission failure | Store submission heartbeat goes silent | | Android keystore issue | Signed build output heartbeat stops | | Flutter dependency resolution failure | Build completion heartbeat stops | | Production API down after release | Production API HTTP monitor fires | | APNS certificate expiring | SSL alert at 60 days | | Webhook delivery failure | Build completion heartbeat stops |

Mobile CI pipelines are high-stakes: a broken iOS or Android build can block a release for days while you chase down certificate issues, signing identity problems, or store submission failures. Vigilmon closes the visibility gap — watching build completion, signing output, API health, and store submissions simultaneously — so you catch mobile CI failures minutes after they happen instead of hours later when users report a stale app.

Start monitoring your mobile CI pipeline in under 5 minutes — register free at vigilmon.online.