Skip to content

docs: setup firebase hosting con github actions#3

Merged
esam-dev merged 1 commit intodevelopfrom
feat/github-workflow-firebase
Mar 10, 2026
Merged

docs: setup firebase hosting con github actions#3
esam-dev merged 1 commit intodevelopfrom
feat/github-workflow-firebase

Conversation

@esam-dev
Copy link
Owner

Cambios realizados:

  • Se configuró GitHub Actions para despliegue automático.
  • Se agregaron los flujos firebase-hosting-merge.yml y firebase-hosting-pull-request.yml.
  • Vinculación exitosa con el proyecto finanz-services de Firebase.

Validación:

  • El flujo de trabajo debe dispararse automáticamente al hacer merge en la rama de producción.

@qodo-code-review
Copy link

Review Summary by Qodo

Configure GitHub Actions for Firebase Hosting deployment

✨ Enhancement 📝 Documentation

Grey Divider

Walkthroughs

Description
• Configure GitHub Actions workflows for Firebase Hosting deployment
• Add automatic deployment on merge to main branch
• Add preview deployment on pull requests
• Update Firebase project ID to finanz-services
Diagram
flowchart LR
  A["GitHub Push to main"] -- "triggers" --> B["firebase-hosting-merge.yml"]
  B -- "builds & deploys" --> C["Firebase Hosting Live"]
  D["GitHub Pull Request"] -- "triggers" --> E["firebase-hosting-pull-request.yml"]
  E -- "builds & previews" --> F["Firebase Hosting Preview"]
  G[".firebaserc"] -- "updated project ID" --> H["finanz-services"]
Loading

Grey Divider

File Changes

1. .firebaserc ⚙️ Configuration changes +1/-1

Update Firebase project configuration

• Updated default Firebase project ID from expense-tracker-eee50 to finanz-services

.firebaserc


2. .github/workflows/firebase-hosting-merge.yml ✨ Enhancement +20/-0

Add Firebase deployment workflow for merge

• Created new workflow for automatic deployment on merge to main branch
• Runs npm ci and npm run build before deployment
• Uses FirebaseExtended/action-hosting-deploy action
• Deploys to live channel with finanz-services project ID

.github/workflows/firebase-hosting-merge.yml


3. .github/workflows/firebase-hosting-pull-request.yml ✨ Enhancement +21/-0

Add Firebase preview deployment workflow for PRs

• Created new workflow for preview deployment on pull requests
• Includes security check to only run on internal PRs
• Sets appropriate permissions for checks, contents, and pull-requests
• Builds and deploys preview to Firebase Hosting

.github/workflows/firebase-hosting-pull-request.yml


Grey Divider

Qodo Logo

@qodo-code-review
Copy link

qodo-code-review bot commented Mar 10, 2026

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider


Action required

1. Deploys placeholder site 🐞 Bug ✓ Correctness
Description
The new workflows run npm run build but Firebase Hosting is configured to serve the checked-in
public/ directory, so the deployment can publish the default Firebase placeholder page instead of
the app. This will make production deploys incorrect even though CI reports a successful
build/deploy.
Code

.github/workflows/firebase-hosting-merge.yml[R14-20]

+      - run: npm ci && npm run build
+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: ${{ secrets.GITHUB_TOKEN }}
+          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_FINANZ_SERVICES }}
+          channelId: live
+          projectId: finanz-services
Evidence
The workflow builds the app but does not place build output into the directory Firebase Hosting
serves. firebase.json serves public/ and rewrites all routes to /index.html, and
public/index.html is the default Firebase Hosting welcome page; the build script is only `vite
build and there is no Vite config redirecting build output to public/`. Therefore the deployment
can ship the placeholder page.

firebase.json[1-16]
public/index.html[1-7]
package.json[6-16]
vite.config.ts[1-30]
.github/workflows/firebase-hosting-merge.yml[13-20]
.github/workflows/firebase-hosting-pull-request.yml[15-21]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
GitHub Actions runs `npm run build`, but Firebase Hosting is configured to serve `public/`, which currently contains the default Firebase Hosting placeholder page. This means deployments can publish the placeholder instead of the built app.

## Issue Context
- `firebase.json` serves `public/` and rewrites all routes to `/index.html`.
- `public/index.html` is the Firebase Hosting welcome page.
- Build script is `vite build` and there is no Vite config shown to emit output into `public/`.

## Fix Focus Areas
- firebase.json[1-16]
- package.json[6-16]
- vite.config.ts[1-30]
- .github/workflows/firebase-hosting-merge.yml[13-20]
- .github/workflows/firebase-hosting-pull-request.yml[15-21]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

2. Unpinned deploy action 🐞 Bug ⛨ Security
Description
The workflows use FirebaseExtended/action-hosting-deploy@v0, a floating tag that can change
without review. Because this action receives the Firebase service account secret, a compromised or
unexpected update could affect production deployments.
Code

.github/workflows/firebase-hosting-merge.yml[R15-18]

+      - uses: FirebaseExtended/action-hosting-deploy@v0
+        with:
+          repoToken: ${{ secrets.GITHUB_TOKEN }}
+          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_FINANZ_SERVICES }}
Evidence
Both workflows reference the deploy action via the mutable @v0 tag rather than a commit SHA, so
the executed code can change over time without a code review in this repository.

.github/workflows/firebase-hosting-merge.yml[15-20]
.github/workflows/firebase-hosting-pull-request.yml[17-21]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The deployment workflows reference `FirebaseExtended/action-hosting-deploy@v0`, which is a floating tag. This makes the deployment pipeline vulnerable to upstream changes because the action code can change without being reviewed in this repo.

## Issue Context
This action is part of the production deploy path and receives `FIREBASE_SERVICE_ACCOUNT_FINANZ_SERVICES`.

## Fix Focus Areas
- .github/workflows/firebase-hosting-merge.yml[15-20]
- .github/workflows/firebase-hosting-pull-request.yml[17-21]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

ⓘ The new review experience is currently in Beta. Learn more

Grey Divider

Qodo Logo

@github-actions
Copy link

Visit the preview URL for this PR (updated for commit d905bd4):

https://finanz-services--pr3-feat-github-workflow-3m2lwuak.web.app

(expires Tue, 17 Mar 2026 18:47:58 GMT)

🔥 via Firebase Hosting GitHub Action 🌎

Sign: 4905a912ab243faab8eac1b38a9b8711115b94d9

@esam-dev esam-dev merged commit 55884c6 into develop Mar 10, 2026
2 checks passed
Comment on lines +14 to +20
- run: npm ci && npm run build
- uses: FirebaseExtended/action-hosting-deploy@v0
with:
repoToken: ${{ secrets.GITHUB_TOKEN }}
firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_FINANZ_SERVICES }}
channelId: live
projectId: finanz-services

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Deploys placeholder site 🐞 Bug ✓ Correctness

The new workflows run npm run build but Firebase Hosting is configured to serve the checked-in
public/ directory, so the deployment can publish the default Firebase placeholder page instead of
the app. This will make production deploys incorrect even though CI reports a successful
build/deploy.
Agent Prompt
## Issue description
GitHub Actions runs `npm run build`, but Firebase Hosting is configured to serve `public/`, which currently contains the default Firebase Hosting placeholder page. This means deployments can publish the placeholder instead of the built app.

## Issue Context
- `firebase.json` serves `public/` and rewrites all routes to `/index.html`.
- `public/index.html` is the Firebase Hosting welcome page.
- Build script is `vite build` and there is no Vite config shown to emit output into `public/`.

## Fix Focus Areas
- firebase.json[1-16]
- package.json[6-16]
- vite.config.ts[1-30]
- .github/workflows/firebase-hosting-merge.yml[13-20]
- .github/workflows/firebase-hosting-pull-request.yml[15-21]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant