refactor: simplify environment variable handling for Firebase deployment #462
Conversation
WalkthroughGitHub Actions の Firebase Functions デプロイワークフローを PR（preview）と push（production）で分岐させ、各パスで使用するシークレットと環境変数、デプロイ手順（checkout, node setup, auth via secret env, npm install, firebase deploy）を分離・明示的に切り替える変更を加えた。加えて functions 配下の .gitignore に Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor 開発者 as Dev
participant GH as GitHub Actions
participant Job as Deploy Job
participant Secrets as GitHub Secrets
participant FB as firebase-tools
Dev->>GH: push / pull_request
GH->>Job: スタート
alt event == pull_request
Note over Job: job = deploy-firebase-functions-dev
Job->>Secrets: read FIREBASE_SA_KEY_FOR_PREVIEW_FUNCTIONS\nFIREBASE_PROJECT_ID_FOR_PREVIEW_FUNCTIONS
Job->>Job: export preview env
Job->>FB: auth using preview SA (env)
Job->>FB: npm install -> firebase deploy --project $FIREBASE_PROJECT_ID_FOR_PREVIEW_FUNCTIONS
else event == push
Note over Job: job = deploy-firebase-functions-production
Job->>Secrets: read FIREBASE_SA_KEY\nFIREBASE_PROJECT
Job->>Job: export production env
Job->>FB: auth using prod SA (env)
Job->>FB: npm install -> firebase deploy --project $FIREBASE_PROJECT
end
FB-->>Job: deployment result
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/github-apps-cd.yml(2 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/github-apps-cd.yml
20-20: got unexpected character '$' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' '
(expression)
21-21: got unexpected character '$' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' '
(expression)
.github/workflows/github-apps-cd.yml
Outdated
| - uses: google-github-actions/auth@v2 | ||
| with: | ||
| credentials_json: ${{ secrets.FIREBASE_SA_KEY }} | ||
| credentials_json: $FIREBASE_SERVICE_ACCOUNT_JSON |
There was a problem hiding this comment.
with の入力に環境変数が展開されません
with ブロック内ではシェル展開が行われないため、$FIREBASE_SERVICE_ACCOUNT_JSON がそのまま文字列として渡され、認証が失敗します。env コンテキストを用いて明示的に式展開してください。
- credentials_json: $FIREBASE_SERVICE_ACCOUNT_JSON
+ credentials_json: ${{ env.FIREBASE_SERVICE_ACCOUNT_JSON }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| credentials_json: $FIREBASE_SERVICE_ACCOUNT_JSON | |
| credentials_json: ${{ env.FIREBASE_SERVICE_ACCOUNT_JSON }} |
🤖 Prompt for AI Agents
.github/workflows/github-apps-cd.yml around line 34: the workflow uses a literal
shell-style variable ($FIREBASE_SERVICE_ACCOUNT_JSON) inside a with block which
is not expanded; change the input to use the GitHub Actions expression that
reads the env context (e.g. replace the literal with the expression that
references env.FIREBASE_SERVICE_ACCOUNT_JSON) and ensure the
FIREBASE_SERVICE_ACCOUNT_JSON value is exported into env earlier in the workflow
or provided as a secret mapped into env.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/github-apps-cd.yml (1)
63-64: プロダクション環境のデプロイ手順名を修正してください。本番ジョブ内のステップ名が「Deploy Functions (dev)」のままなので、運用時に紛らわしくなります。
prodなど適切な表記へ変更することを検討してください。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/github-apps-cd.yml(2 hunks)
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
openci-runner/firebase/functions/.gitignore (1)
11-12: サービスアカウント鍵はワイルドカードで包括的に無視した方が安全です将来のファイル追加に強く、メンテ負担も減ります。
適用例:
-service_account.json -service_account_dev.json +service_account*.json.github/workflows/github-apps-cd.yml (3)
16-40: フォークからの PR でシークレット未提供によりジョブが失敗する懸念フォーク PR では GitHub Secrets が渡されません。プレビュー配備を自リポ内 PR に限定する条件を追加すると安定します。
例:
- if: github.event_name == 'pull_request' + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false組織のコントリビューション方針（fork PR の有無）に合致するか確認してください。
38-40: Firebase CLI のバージョンを固定し、非対話モードを明示最新版追随は破壊的変更の影響を受けやすいです。CI 向けに
--non-interactiveを付与してください。例:
- run: npx firebase-tools deploy --only functions --project ${{ secrets.FIREBASE_PROJECT_ID_FOR_PREVIEW_FUNCTIONS }} + run: npx firebase-tools@13 deploy --only functions --project ${{ secrets.FIREBASE_PROJECT_ID_FOR_PREVIEW_FUNCTIONS }} --non-interactive
63-64: 本番配備でも CLI バージョン固定と非対話化、プロジェクト値の整合確認同様にバージョン固定と非対話化を推奨します。あわせて
FIREBASE_PROJECTが Firebase/GCP の「プロジェクト ID」か「エイリアス」かを統一してください（プレビュー側は*_PROJECT_ID_*）。修正例:
- run: npx firebase-tools deploy --only functions --project ${{ secrets.FIREBASE_PROJECT }} + run: npx firebase-tools@13 deploy --only functions --project ${{ secrets.FIREBASE_PROJECT }} --non-interactive
FIREBASE_PROJECTの値がプロジェクト ID であることを確認し、可能なら命名をFIREBASE_PROJECT_IDに統一してください。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/github-apps-cd.yml(2 hunks)openci-runner/firebase/functions/.gitignore(1 hunks)
🔇 Additional comments (2)
.github/workflows/github-apps-cd.yml (2)
30-33:credentials_jsonのシークレット形式を確認してください
google-github-actions/auth@v2のcredentials_jsonは「生の JSON 文字列」を想定しています。Base64 文字列では認証に失敗します。シークレット
FIREBASE_SA_KEY_FOR_PREVIEW_FUNCTIONSとFIREBASE_SA_KEYが JSON 文字列であることを確認してください（先頭が{で始まる）。
26-29:node-version-file: .nvmrcの指定は正しいため、変更不要です。Likely an incorrect or invalid review comment.
Summary by CodeRabbit