---
title: "Cutting Mobile Build Times by Up to 79% for a Southeast Asian Bank"
description: "We introduced native build reuse and signed delivery for compatible micro-frontends in a Southeast Asian bank’s React Native app with 15M+ registered users, preserving security checks. Full-cache-hit tests cut Android build time by 79% and the measured iOS flow by 58.3%. In an illustrative model of 40,000 annual cache-hit builds split evenly across Android and iOS, the avoided runtime is valued at around US$30,000 using public CI rates."
url: https://www.callstack.com/case-studies/cutting-mobile-build-times-by-up-to-79-for-a-southeast-asian-bank
updated: 2026-10-30T18:13:57.928Z
---

# Cutting Mobile Build Times by Up to 79% for a Southeast Asian Bank

We introduced native build reuse and signed delivery for compatible micro-frontends in a Southeast Asian bank’s React Native app with 15M+ registered users, preserving security checks. Full-cache-hit tests cut Android build time by 79% and the measured iOS flow by 58.3%. In an illustrative model of 40,000 annual cache-hit builds split evenly across Android and iOS, the avoided runtime is valued at around US$30,000 using public CI rates.

**Speeding Up Android and iOS Builds Without Compromising Banking Security**

_Client: Southeast Asian Bank · Industry: Finance · Date: 2026 · Size: Enterprise_

Services: [Enterprise Infrastructure](https://www.callstack.com/capabilities/self-hosted-ci-cd-infrastructure)

## Company: Banking for people and businesses

One of Southeast Asia's largest commercial banks. It serves individuals and businesses through retail, SME, corporate, and international banking services, delivered across physical and digital channels.

## Challenge: When every app change had to follow the full banking release path

More than 15 million people relied on the bank's mobile app. At that scale, every production release had to protect a critical customer channel and meet the security requirements of a regulated financial product.

The bank had built Arxan/EnsureIT hardening, signing, SSL pinning, jailbreak detection, screen-capture protection, and verification into its release process. The pipeline treated every change as if it affected the native application. Even a one-line JavaScript update triggered a full native build and went through the entire security path.

Android CI runs usually took close to an hour. On iOS, builds with Arxan/EnsureIT security hardening, referred to as “shielded” builds, took about 27 minutes; builds without that hardening step took about 13 to 14 minutes. These waits slowed feedback in both CI and local development. The bank needed a faster path from code to validation while keeping every security check intact.

The pipeline also handled JavaScript updates, micro-frontend changes, and native dependency changes in the same way. Every batch agent installed all 22 features, leaving about 14 GB to process. Repeated cleanup and repository setup added more waiting.

[Re.Pack](https://re-pack.dev/) 5 already gave the app a micro-frontend foundation, but compatible feature updates still depended on a native app release. The team also lacked a controlled way to roll back a remote bundle or load a reliable fallback when the network was unavailable.

## Numbers: Measured results

- **2.4×** faster iOS cache-hit builds on average
- **2×** faster Android builds with partial reuse
- **82%** smaller CI installation footprint

## Our work: Reusing work while preserving release controls

We began by measuring Android and iOS from the same baseline. That gave the client and our team one set of numbers for every decision, as an optimization only counted when it shortened a real pipeline path and preserved the required security checks.

### Reusing native builds with Rock

A React Native app build has two parts: the native app, compiled with Xcode or Gradle, and the JavaScript bundle. Most changes touch only JavaScript, yet the bank's pipeline rebuilt both every time. Rock computes a fingerprint of everything that affects the native build: native code, native dependencies and build settings. When the fingerprint matches an earlier build, Rock downloads that native app from the cache in seconds instead of compiling it again. The pipeline then builds only the JavaScript bundle, typically 5-12 minutes for an app this size, before hardening, signing and verification run as usual.

We used [Rock](https://www.rockjs.dev/), Callstack's modular toolkit for React Native teams, to identify which native build work could be safely reused. When the relevant inputs matched, the pipeline could pull a compatible app artifact and refresh the JavaScript payload, version, and signature.

The integration covered four CI flows: shielded and non-shielded builds for Android and iOS. It also worked for local development. We connected Rock to the bank's existing JFrog Artifactory through a custom remote-cache provider, keeping artifacts inside its current supply chain.

Rock computes a fingerprint from the native inputs before it decides whether to reuse an artifact. Environment-neutral artifacts, version restamping, and a two-layer Android cache widened the range of builds that could share earlier work. The same fingerprint-based reuse principle can also shorten native build times in Expo testing and QA workflows.

The fallback stayed simple. A missing certificate chain, failed fingerprint, bad download, or unsigned artifact sent the pipeline back to a normal native build. Hardening, signing, and verification still ran as required, so the bank kept the controls already built into its release process.

### Creating a controlled path for feature updates

Build caching shortened native compilation, but even compatible changes to the app’s micro-frontends (MFEs), separately bundled feature modules, still depended on the app-store cycle. We built an app-level MFE Source Resolver on top of Re.Pack’s ScriptManager to control where each module loads from. It lets the app choose between a promoted remote bundle, the last known good cached version, and a fallback packaged with the app.

Production bundles are stored in private Azure Blob Storage under immutable, versioned paths. A separate promotion pipeline makes the selected version available to the app and can point it back to an earlier version during rollback.

Each bundle is hashed with SHA-256 and signed with RS256 in CI. Strict signature checks reject missing, unsigned, or incompatible artifacts on Android and iOS; if the network is unavailable, the app loads a cached or packaged copy. We added these rules at the application level while keeping Re.Pack on its upstream version, so the bank had no fork or private patch to maintain.

### Giving the bank time to validate and adopt

The optimized flows sit on dedicated branches and behind feature flags. The bank can move each part into its main pipeline on its own schedule, keep the current process available during rollout, and give engineering, security, and QA teams time to validate every path in their own environments.

Phase one finished ahead of schedule, so we spent the remaining time on more build paths and edge cases: environment-neutral caching, Yarn workspace-focused installs, Android App Bundle output, simulator builds, and shield-neutral Android caching. We also investigated the limits of shield-neutral caching on iOS.

Every week, the client received pull requests, pipeline runs, screen recordings, and updated wiki documentation as part of the handover. Final branches, written instructions, a recommendations report, and workshops gave its engineering teams a clear path to maintain the setup.

## Results: Cutting the wait between code and validation

In the tested flows, the bank could validate compatible changes faster while keeping its hardening, signing, artifact storage, and rollback controls in place.

With a full Android cache hit, the average CI build fell from 52 minutes 18 seconds to 11 minutes 5 seconds, saving 41 minutes 13 seconds per build on average. The optimized flow ran 4.72 times faster while following the same hardening, signing, and verification path.

![Five measured Android CI runs comparing the baseline with a full Rock cache hit](https://www.callstack.com/assets/6ad9dfb9ee322fc5fab08c78_Five-measured-Android-CI-runs-comparing-the-baseline-with-a-full-Rock-cache-hit-2.webp)

_Five measured Android CI runs comparing the baseline with a full Rock cache hit._

The pipeline also had a faster path when the higher-level Android cache missed but the compilation cache hit. Average build time fell from 54 minutes 48 seconds to 27 minutes 12 seconds. That partial reuse cut the wait by 50.4% and saved 27 minutes 36 seconds per build.

![Six measured Android CI runs comparing the baseline with partial reuse of the compilation cache](https://www.callstack.com/assets/6ad9dfeb69df5303d93ffa22_Six-measured-Android-CI-runs-comparing-the-baseline-with-partial-reuse-of-the-compilation-cache-2.webp)

_Six measured Android CI runs comparing the baseline with partial reuse of the compilation cache._

With an iOS cache hit, the average time for the measured flow, covering both shielded and non-shielded builds, fell from 41 minutes 14 seconds to 17 minutes 10 seconds, a 58.3% reduction. Simulator builds followed a separate path, dropping from about 12 minutes to 4 minutes.

![Five measured iOS CI runs and their average, comparing the baseline flow with a full Rock cache hit; each run covers both shielded and non-shielded builds](https://www.callstack.com/assets/6ad9e0148f934651888ba442_Five-measured-iOS-CI-runs-and-their-average-2.webp)

_Five measured iOS CI runs and their average, comparing the baseline flow with a full Rock cache hit; each run covers both shielded and non-shielded builds._

Workspace-focused installs cut the CI installation footprint from about 14 GB to 2.5 GB, an 82% decrease. The caching work covered six build paths across Android and iOS, plus local development. Developers kept using the same Yarn commands.

We tested remote micro-frontend delivery from publication through rollback with one feature. The team published the bundle to Azure Blob Storage, promoted it, loaded it in the app, replaced it, and rolled it back without rebuilding the native application. Promotion or rollback took 1 to 2 minutes on average; some runs finished in about 30 seconds.

The shielded iOS build passed QA checks for screen-capture detection, timeout handling, SSL pinning, reverse-proxy detection, and VPN detection. The development team confirmed that the Android flow worked, and the ongoing maintenance period covers changes needed during wider rollout.

The optimized flows remain on separate branches while the bank prepares to bring them into its main pipeline, so the figures above are technical measurements rather than production business outcomes. Production usage, engineering hours saved, and broader business impact will be assessed after wider adoption.

## Build and scale React Native apps.

For over a decade, enterprise teams have trusted us with React and React Native products. Our senior engineers work with AI agents on new builds, complex migrations, and native engineering. [Contact us](https://www.callstack.com/contact)

### Talk to our team

We’ll connect you with the right expert within 24 hours.

## How we’ve solved similar challenges

- [Building Storybook Connect for JetBrains Twice as Fast With AI](https://www.callstack.com/case-studies/building-storybook-connect-for-jetbrains-in-25-working-days)
- [Teamworks cut mobile change lead time from days to minutes](https://www.callstack.com/case-studies/accelerating-teamworks-mobile-delivery-with-re-pack-and-module-federation)