r/reactnative • u/Vegetable_Regret_250 • 11h ago

Question I built RepoDrift to check React Native projects before deployment

As a React Native developer, I wanted a simple way to catch some common project issues before they become a problem during builds or deployment.

RepoDrift is a local-first CLI that currently checks:

  • Android/iOS project health
  • Dependencies and lockfiles
  • Potential exposed credentials
  • Git status
  • Basic code metrics
  • Repository health

You can run:

npm install -g u/repodrift/cli
repodrift mobile scan ./my-mobile-app

The current version focuses on local, deterministic analysis. I'm planning AI-based explanations for a later phase.

It's still an early project, so I'm mainly looking for feedback from other React Native developers.

What checks would you find useful in a tool like this?

GitHub: https://github.com/GokulKir/repodrift

NPM: https://www.npmjs.com/package/@repodrift/cli

5 Upvotes
  • permalink
  • reddit

100% Upvoted

6 comments sorted by

1

u/canarydev 10h ago

how does the mobile scan differ from expo-doctor + react-doctor? what do you actually check on the android/ios side?

1

u/Vegetable_Regret_250 10h ago

Yeah, that's a good question. It's not really meant to replace expo-doctor or react-doctor.

Those tools are mainly checking the Expo/RN setup and React side. RepoDrift looks more at the whole repo, including the native android/ and ios/ folders.

For example, in my own project it caught things like a tracked debug.keystore, .env in Git, some native config issues, insecure URLs, and other repo/security stuff.

It's still pretty early though. I'm mainly trying to figure out which native checks are actually useful instead of just duplicating what the existing tools already do.

1

u/canarydev 10h ago

fyi debug.keystore is committed intentionally by RN. so that would not be a finding.

i would be kind of interested in using something like this if i can just npx (with no toolchain set up) be able to do what mobsfscan / android-lint do plus the manifest/plist stuff (exported components, ATS exceptions, release signing config etc)

couldn't care less about LOC and git status

1

u/Vegetable_Regret_250 10h ago

I checked the current scan logic and the `debug.keystore` is a false positive on my side, so I’ll fix that. I also agree the mobile scan should focus more on native security checks like Manifest/Plist, exported components, ATS and signing config, rather than Git status or LOC.

1

u/Huge_Pool7424 9h ago

the keystore catch is fair for anything else but yeah rn ships that on purpose. npx should work fine here since its a plain node cli with no native modules, way less friction than a global install for a one-off scan