What changed.

Highlights

• Expand the CLI from 75 to 189 executable command paths across 45 top-level groups.

• Add explicit production submission planning, draft assembly, guarded final submission, manual release, and selected phased-release operations.

• Add selected IAP commerce, pricing, availability, offer-code, promotional-image, and promoted-purchase workflows.

• Expand TestFlight metadata, group/build distribution, recruitment inspection, and notifications.

• Add in-app events, product-page experiments, review responses, webhooks, content rights, custom EULA, accessibility declarations, and tag visibility.

• Extend asset workflows with previews, review attachments, screenshot ordering, processing verification, and safer upload recovery.

• Harden state intent validation, ownership and pagination checks, dependent changes, checkpoint identity, pricing preservation, and preflight observations.

• Refresh the pinned App Store Connect API reference to 4.5 and expand documentation navigation to 21 pages, including seven new workflow guides and a capabilities reference.

• Update the Go build toolchain to 1.26.6 to address four reachable standard-library vulnerability findings.

• Refresh eight Go module dependencies; migrate lint and CodeQL actions to Node 24 while retaining full SHA pins, and pin security scanner versions.

Upgrade notes

• Apply checkpoints now use schema version 3; upload checkpoints use schema version 2. Older incompatible checkpoints are rejected. Inspect live state and a fresh plan before restarting interrupted work rather than blindly resuming.
• Validation now rejects unsupported, ambiguous, or mismatched intent that could previously produce incomplete plans or unsafe writes.
• Existing command paths remain available. Production submission and manual release require their separate explicit commands; state apply does not perform either action.

Support boundaries

• New write workflows have local fixture coverage; controlled live qualification has not been completed for the expansion. IAP-version submission attachment and phased-release transitions still require controlled live qualification.
• App availability remains partial. Subscription authoring, Game Center authoring, application binary build/sign/upload, privacy nutrition labels, and resolution-center correspondence are outside the selected authoring workflows.
• Preflight retains 15 rules and does not guarantee Apple review approval.

See the workflow capabilities and submission guide.

Verification

• macOS and Linux race suites, vet, lint, generated-doc parity, dependency review, CodeQL, vulnerability scanning, and gosec passed.
• Offline integration-tagged tests and module verification passed locally; no controlled live Apple writes were run.
• Release workflow produced four platform archives, SBOMs, checksums, and Sigstore bundles. Downloaded archive/SBOM checksums matched, and the macOS ARM64 binary passed version and command-help smoke checks.

Changelog

• c5d7382444b9205a05331cba4e2a03940149ee97: Add three preflight rules mined from the rejection corpus (@ul0gic)
• 55a8a8e5c4ab88a320032d49a2b6b58b587d62e5: Fix pricing get availability fetch rejected by Apple's include cap (@ul0gic)
• ef2d60725b34181bccdbbde2837b673fad3ecae9: Make unknown subcommands fail instead of exiting 0 (@ul0gic)
• 364b4c9c42364a8f6dddccd421eac1e094018b48: Populate review submission item references via include (@ul0gic)
• 8323850b41ab720f4b38bc88ebbf89918588f703: Report true price counts instead of the 50-row sideload sample (@ul0gic)
• 8867baf86d0cbbc8e0fa0ee90e40f6a313d32685: Share the review-detail attributes type from the asc package (@ul0gic)

First public release.

Flightline turns App Store Connect into a structured, declarative surface — fetch live state, edit YAML, lint, plan, apply — so submissions stop being a clerical landmine. All three layers ship complete and verified against live ASC:

• L1, API CLI: the full authoring and observation surface. 35+ subcommands, every one with --output table|json.
• L2, state as code: flightline fetch, plan, and apply against a single state.yaml describing the whole release. Writes diff first and patch only the delta.
• L3, preflight: 11 rules covering the common rejection causes, run offline with lint or live against ASC with preflight, before anything is submitted.

Install:

go install github.com/ul0gic/flightline@latest

Requires Go 1.26+. Docs at flightline.dev/docs.

Versioning policy (pre-1.0): breaking changes to flags, JSON output, or exit codes can happen between minor versions, are always flagged in a ### Breaking section of the release notes, and never happen in patches. 1.0 locks the contract.

Found a bug? Open an issue.

All three layers are complete and working against live App Store Connect.

• L1, API CLI: the full authoring and observation surface. 35+ subcommands, every one with --output table|json.
• L2, state as code: flightline fetch, plan, and apply against a single state.yaml describing the whole release. Writes diff first and patch only the delta.
• L3, preflight: 11 rules covering the common rejection causes, run offline with lint or live against ASC with preflight, before anything is submitted.

Also in this build:

• Tri-state exit codes on lint and preflight: 0 clean, 1 errors, 2 warnings only, so CI chooses its own strictness.
• --version reports version, commit, and build date.
• Release pipeline hardened and ready: GoReleaser cross-platform builds, signed artifacts, SBOM.

Install with go install github.com/ul0gic/flightline@latest.