Skip to content

Commit fd654cc

Browse files
staceybeardstaceybeard
authored
ci: add workflow to deploy Firebase rules (#419)
Wrote a workflow to deploy Firebase rules via GitHub Actions. This is done automatically for dev, and can be run manually in any other available environment. Also consolidated our Firebase rules files to only have one file for all environments.
1 parent 387d71d commit fd654cc

27 files changed

+160
-760
lines changed

‎.github/workflows/firebase-rules.yml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# SPDX-FileCopyrightText: Copyright 2025 Opal Health Informatics Group at the Research Institute of the McGill University Health Centre <[email protected]>
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-or-later
4+
5+
# This workflow is explained in `docs/source/ci-cd-workflows.md`; please keep that documentation file up to date when making changes here.
6+
7+
name: Firebase Rules
8+
# Default to dev when running automatically (see also "env" below)
9+
run-name: Deploying Firebase rules for ${{ inputs.ENVIRONMENT || 'dev' }} 🚀
10+
on:
11+
# When the database rules are changed, automatically deploy to dev
12+
push:
13+
branches:
14+
- main
15+
paths:
16+
- 'firebase/database.rules.json'
17+
18+
# Offer a manual interface to deploy to all other environments as needed
19+
workflow_dispatch:
20+
inputs:
21+
ENVIRONMENT:
22+
description: 'Environment in which to deploy rules'
23+
type: choice
24+
required: true
25+
default: 'dev'
26+
options:
27+
- dev
28+
- prod
29+
30+
permissions:
31+
contents: read
32+
33+
# Read the target environment from workflow_dispatch inputs, or default to dev
34+
env:
35+
ENVIRONMENT: ${{ inputs.ENVIRONMENT || 'dev' }}
36+
37+
jobs:
38+
deploy:
39+
runs-on: ubuntu-latest
40+
steps:
41+
# Setup
42+
- name: Convert environment to all caps
43+
run: echo "ENVIRONMENT_CAPS=${ENVIRONMENT^^}" >> "$GITHUB_ENV"
44+
- name: Print environment
45+
run: |
46+
echo "Environment: $ENVIRONMENT ($ENVIRONMENT_CAPS)"
47+
- uses: actions/[email protected]
48+
with:
49+
persist-credentials: false
50+
- name: Use Node.js
51+
uses: actions/[email protected]
52+
with:
53+
# renovate: datasource=node-version dependency=node
54+
node-version: '22.14.0'
55+
- name: Check npm installation
56+
run: npm -v
57+
- name: Install firebase-tools
58+
run: |
59+
npm install -g firebase-tools
60+
firebase --version
61+
62+
# Deploy Firebase rules
63+
# Deployment via 'firebase deploy' implicitly uses a service account assigned to $GOOGLE_APPLICATION_CREDENTIALS below (from values defined in the GitHub project settings)
64+
# This service account provides permissions for editing Firebase rules
65+
# See: https://firebase.google.com/docs/admin/setup#initialize_the_sdk_in_non-google_environments
66+
- name: Read the service account needed to deploy to Firebase
67+
# See: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#setting-an-environment-variable
68+
run: |
69+
echo "${SECRET_GOOGLE_APPLICATION_CREDENTIALS}" > google-application-credentials.json
70+
echo "GOOGLE_APPLICATION_CREDENTIALS=$(readlink -f google-application-credentials.json)" >> "$GITHUB_ENV"
71+
env:
72+
# See: https://stackoverflow.com/questions/61255989/dynamically-retrieve-github-actions-secret
73+
SECRET_GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets[format('{0}_GOOGLE_APPLICATION_CREDENTIALS', env.ENVIRONMENT_CAPS)] }} # zizmor: ignore[overprovisioned-secrets]
74+
- name: Specify which Firebase project to use
75+
working-directory: ./firebase
76+
# Replace the <PROJECT-ID> placeholder with the project ID from repository variables
77+
run: sed -i "s/<PROJECT-ID>/${VAR_PROJECT_ID}/" .firebaserc
78+
env:
79+
VAR_PROJECT_ID: ${{ vars[format('{0}_FIREBASE_PROJECT_ID', env.ENVIRONMENT_CAPS)] }}
80+
- name: Deploy rules to Firebase
81+
working-directory: ./firebase
82+
run: firebase deploy --only database

‎REUSE.toml

+3-21
Original file line numberDiff line numberDiff line change
@@ -7,27 +7,9 @@ path = [
77
".vscode/extensions.json",
88
"docs/jsdoc.config.json",
99
"docs/source/config.json",
10-
"firebase/demo/.firebaserc",
11-
"firebase/demo/database.rules.json",
12-
"firebase/demo/firebase.json",
13-
"firebase/dev/.firebaserc",
14-
"firebase/dev/database.rules.json",
15-
"firebase/dev/firebase.json",
16-
"firebase/devops/.firebaserc",
17-
"firebase/devops/database.rules.json",
18-
"firebase/devops/firebase.json",
19-
"firebase/preprod/.firebaserc",
20-
"firebase/preprod/database.rules.json",
21-
"firebase/preprod/firebase.json",
22-
"firebase/prod/.firebaserc",
23-
"firebase/prod/database.rules.json",
24-
"firebase/prod/firebase.json",
25-
"firebase/qa/.firebaserc",
26-
"firebase/qa/database.rules.json",
27-
"firebase/qa/firebase.json",
28-
"firebase/staging/.firebaserc",
29-
"firebase/staging/database.rules.json",
30-
"firebase/staging/firebase.json",
10+
"firebase/.firebaserc",
11+
"firebase/database.rules.json",
12+
"firebase/firebase.json",
3113
"listener/educational-material/eduMaterialConfig.json",
3214
"listener/studies/studiesConfig.json",
3315
"package.json",

‎docs/source/ci-cd-workflows.md

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!--
2+
SPDX-FileCopyrightText: Copyright 2025 Opal Health Informatics Group at the Research Institute of the McGill University Health Centre <[email protected]>
3+
4+
SPDX-License-Identifier: AGPL-3.0-or-later
5+
-->
6+
7+
This project uses GitHub Actions to manage various CI/CD tasks.
8+
9+
### Deploy Firebase Rules
10+
11+
Deployment of [Firebase Realtime Database security rules](https://firebase.google.com/docs/database/security)
12+
has been configured in `.github/workflows/firebase-rules.yml` in this repository.
13+
For more information on our use of Firebase rules, see {@tutorial firebase-rules}.
14+
15+
There are two ways to deploy the Firebase rules:
16+
17+
#### 1. Automatically (Dev)
18+
19+
Any commit on the main branch that modifies the Firebase rules file will automatically trigger a deployment in the dev environment.
20+
Since other Opal components are also automatically deployed to Dev,
21+
this allows changes to the Firebase rules to be immediately available in that environment.
22+
23+
#### 2. Manually (any environment)
24+
25+
Rules can be deployed manually using the GitHub Actions interface.
26+
In environments other than Dev, this facilitates timing the deployment of new rules concurrently with the deployment of the app or listener.
27+
28+
To deploy rules manually, go to the [GitHub Actions Tab](https://github.com/opalmedapps/opal-listener/actions),
29+
select `Firebase Rules` in the left sidebar, and next to `This workflow has a workflow_dispatch event trigger`,
30+
select `Run workflow`.
31+
This will open a panel in which to provide inputs, such as which environment to use.
32+
33+
#### Configuration: Service Accounts
34+
35+
Service accounts were created to give the workflow the required permissions to publish Firebase rules.
36+
37+
To create a new service account, follow these steps:
38+
39+
1. Navigate to https://console.cloud.google.com/iam-admin/serviceaccounts
40+
and select the Firebase project for which you'd like to create a service account.
41+
2. Select `Create service account`.
42+
3. Suggested inputs:
43+
- Service account name: GitHub CI/CD - opal-listener
44+
- Service account ID: `<automatically generated>`
45+
- Service account description: Manually created service account that allows automatic deployment of Realtime Database rules to Firebase.
46+
4. Grant the account the following permissions:
47+
- Firebase Realtime Database Admin
48+
- Firebase Rules Admin
49+
50+
If you'd like to view or edit permissions for a service account after it's been created,
51+
you can do so at https://console.cloud.google.com/iam-admin/iam (make sure to select the right project).
52+
53+
Once created, service accounts can be made accessible to the workflow by adding them as
54+
[Repository Secrets for GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository),
55+
and naming them in the format expected by the workflow, for example `DEV_GOOGLE_APPLICATION_CREDENTIALS`.
56+
57+
#### Configuration: Project IDs
58+
59+
To deploy rules to a given Firebase project, its `projectID` must be saved as a
60+
[Repository Variable for GitHub Actions](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#creating-configuration-variables-for-a-repository),
61+
for example `DEV_FIREBASE_PROJECT_ID`.

‎docs/source/config.json

+5-2
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,13 @@
77
}
88
}
99
},
10-
"strangler-fig": {
11-
"title": "Strangler Fig"
10+
"ci-cd-workflows": {
11+
"title": "CI/CD Workflows"
1212
},
1313
"firebase-rules": {
1414
"title": "Firebase Rules"
15+
},
16+
"strangler-fig": {
17+
"title": "Strangler Fig"
1518
}
1619
}

‎docs/source/firebase-rules.md

+7-11
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,17 @@ SPDX-License-Identifier: AGPL-3.0-or-later
55
-->
66

77
The Firebase rules for the Realtime Database used by the app and listener are version-controlled in this project.
8-
Rules for each environment can be found in the `firebase` directory.
8+
Rules and configuration files can be found in the `firebase` directory.
99

10-
With the exception of `prod`, rules can be deployed by the CI/CD pipeline whenever a `database.rules.json`
11-
file is modified and the changes are pushed to the default branch.
12-
This deployment is executed automatically for changes to `dev`, and manually for all other environments.
13-
Each deployment job is connected to a [GitLab protected environment](https://docs.gitlab.com/ee/ci/environments/protected_environments.html),
14-
which allows user permissions to be set to control deployment.
10+
For information on the automatic deployment of these rules via GitHub Actions, see {@tutorial ci-cd-workflows}.
1511

16-
To deploy the `prod` rules, or to manually deploy rules for another environment without using the pipeline, the Firebase CLI can be used.
17-
Note that the CLI is installed during `npm install` (see `firebase-tools` in `package.json`). To deploy rules for an
12+
To manually deploy Firebase rules without using the pipeline, the Firebase CLI can be used.
13+
Note that the CLI is installed during `npm install` (see `firebase-tools` in `package.json`). To deploy rules for any
1814
environment, execute the following steps:
1915

20-
1. Run `firebase login` and follow the instructions on the terminal. To publish firebase rules, you must log into
16+
1. Run `firebase login` and follow the instructions on the terminal. To publish Firebase rules, you must log into
2117
an account that has access to the right project.
2218

23-
2. Change directory into the folder of the target environment. For example, `cd firebase/dev`.
19+
2. Change directory into the `firebase` folder.
2420

25-
3. Run `firebase deploy --only database` to deploy the database rules from the directory you're currently in.
21+
3. Run `firebase deploy --only database` to deploy the rules defined in `database.rules.json`.

‎firebase/demo/.firebaserc renamed to ‎firebase/.firebaserc

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"projects": {
3-
"default": "opal-3a1a23"
3+
"default": "<PROJECT-ID>"
44
},
55
"targets": {},
66
"etags": {}

‎firebase/demo/database.rules.json renamed to ‎firebase/database.rules.json

File renamed without changes.

‎firebase/dev/.firebaserc

-7
This file was deleted.

‎firebase/dev/database.rules.json

-88
This file was deleted.

‎firebase/dev/firebase.json

-5
This file was deleted.

‎firebase/devops/.firebaserc

-7
This file was deleted.

0 commit comments

Comments
 (0)