|
| 1 | +# Getting the CI deploy values |
| 2 | + |
| 3 | +The deploy workflow (`.github/workflows/deploy-web.yml`) needs three values: |
| 4 | + |
| 5 | +| GitHub setting | Name | What it is | |
| 6 | +|---|---|---| |
| 7 | +| Variable | `GOOGLE_CLIENT_ID` | Public OAuth Web Client ID (sign-in) | |
| 8 | +| Variable | `FIREBASE_PROJECT_ID` | Your Firebase/GCP project id | |
| 9 | +| Secret | `FIREBASE_SERVICE_ACCOUNT` | Service-account JSON that lets CI deploy Hosting | |
| 10 | + |
| 11 | +Do them in this order — step 2 (Firebase project) gives you the hosting URL you need to finish step 1, and step 3 reuses the same project. |
| 12 | + |
| 13 | +--- |
| 14 | + |
| 15 | +## 1. `GOOGLE_CLIENT_ID` — OAuth Web Client ID |
| 16 | + |
| 17 | +1. Go to **https://console.cloud.google.com** and create a project (top bar → project dropdown → New project), e.g. `promptvault`. Select it. |
| 18 | +2. **Enable the Drive API:** left menu → **APIs & Services → Library** → search **"Google Drive API"** → **Enable**. |
| 19 | +3. **OAuth consent screen:** APIs & Services → **OAuth consent screen**: |
| 20 | + - User type: **External** → Create. |
| 21 | + - App name: `PromptVault`; user support email: your email; developer contact: your email → Save and continue. |
| 22 | + - Scopes: you can skip adding scopes here (the app requests `drive.file` + `userinfo.email` at runtime). Both are **non-sensitive**, so no Google verification is required. |
| 23 | + - Test users: add your own Google account if you leave the app in "Testing". (Or click **Publish app** later — fine for these scopes.) |
| 24 | +4. **Create the client id:** APIs & Services → **Credentials** → **Create credentials → OAuth client ID**: |
| 25 | + - Application type: **Web application**. |
| 26 | + - Name: `PromptVault Web`. |
| 27 | + - **Authorized JavaScript origins** → Add URI, add each of these (you'll know the first two after step 2 — they use your project id): |
| 28 | + - `https://<PROJECT_ID>.web.app` |
| 29 | + - `https://<PROJECT_ID>.firebaseapp.com` |
| 30 | + - `http://localhost:5173` (local dev) |
| 31 | + - your custom domain too, if you set one up later |
| 32 | + - (Authorized redirect URIs are **not** needed — Google Identity Services uses the JS origins.) |
| 33 | + - **Create** → a dialog shows your **Client ID** like `1234567890-abc123.apps.googleusercontent.com`. Copy it. **That is `GOOGLE_CLIENT_ID`.** (It's public, not a secret.) |
| 34 | + |
| 35 | +> If sign-in later fails with `redirect_uri_mismatch` / `origin not allowed`, the page's origin isn't in the Authorized JavaScript origins list — add it and wait a minute. |
| 36 | +
|
| 37 | +--- |
| 38 | + |
| 39 | +## 2. `FIREBASE_PROJECT_ID` + create the Hosting site |
| 40 | + |
| 41 | +1. Go to **https://console.firebase.google.com** → **Add project** → choose **"Add Firebase to an existing Google Cloud project"** and pick the project from step 1 (this keeps OAuth + Hosting in one project). Accept the defaults. |
| 42 | +2. **Enable Hosting:** left menu → **Build → Hosting → Get started**. You can click through the wizard's steps (you don't need to run the local commands it shows — CI handles deploys). This provisions your site at `https://<PROJECT_ID>.web.app`. |
| 43 | +3. **Find the project id:** Firebase console → ⚙ **Project settings → General** → **Project ID**. **That is `FIREBASE_PROJECT_ID`** (e.g. `promptvault-1a2b3`). |
| 44 | +4. Put it in `apps/web/.firebaserc` (replace `REPLACE_WITH_FIREBASE_PROJECT_ID`) so local `firebase deploy` works too: |
| 45 | + ```json |
| 46 | + { "projects": { "default": "<PROJECT_ID>" } } |
| 47 | + ``` |
| 48 | +5. Go back and make sure `https://<PROJECT_ID>.web.app` and `.firebaseapp.com` are in the OAuth client's Authorized JavaScript origins (step 1.4). |
| 49 | + |
| 50 | +--- |
| 51 | + |
| 52 | +## 3. `FIREBASE_SERVICE_ACCOUNT` — deploy credentials (secret) |
| 53 | + |
| 54 | +This is a JSON key for a service account allowed to deploy Hosting. |
| 55 | + |
| 56 | +**Recommended (least privilege) — GCP console:** |
| 57 | +1. **https://console.cloud.google.com** → **IAM & Admin → Service Accounts** (same project) → **Create service account**. |
| 58 | +2. Name: `github-hosting-deployer` → Create and continue. |
| 59 | +3. Grant role: **Firebase Hosting Admin** (`roles/firebasehosting.admin`) → Continue → Done. |
| 60 | +4. Open the new service account → **Keys** tab → **Add key → Create new key → JSON** → a `.json` file downloads. |
| 61 | +5. Open that file; you'll paste its **entire contents** into the GitHub secret in step 4. |
| 62 | + |
| 63 | +> Simpler alternative: Firebase console → Project settings → **Service accounts** → **Generate new private key**. This works but the key has broader admin rights than Hosting needs. |
| 64 | +
|
| 65 | +--- |
| 66 | + |
| 67 | +## 4. Put the values into GitHub |
| 68 | + |
| 69 | +### Option A — GitHub web UI |
| 70 | +Repo → **Settings → Secrets and variables → Actions**: |
| 71 | +- **Variables** tab → **New repository variable**: |
| 72 | + - `GOOGLE_CLIENT_ID` = your client id from step 1 |
| 73 | + - `FIREBASE_PROJECT_ID` = your project id from step 2 |
| 74 | +- **Secrets** tab → **New repository secret**: |
| 75 | + - `FIREBASE_SERVICE_ACCOUNT` = paste the **whole** JSON from step 3 |
| 76 | + |
| 77 | +### Option B — `gh` CLI (run from the repo directory) |
| 78 | +```bash |
| 79 | +gh variable set GOOGLE_CLIENT_ID --body "1234567890-abc123.apps.googleusercontent.com" |
| 80 | +gh variable set FIREBASE_PROJECT_ID --body "promptvault-1a2b3" |
| 81 | +gh secret set FIREBASE_SERVICE_ACCOUNT < /path/to/service-account.json |
| 82 | +``` |
| 83 | + |
| 84 | +--- |
| 85 | + |
| 86 | +## 5. Trigger a deploy |
| 87 | + |
| 88 | +Either push any change under `apps/web/**` to `main`, or run it manually: |
| 89 | +```bash |
| 90 | +gh workflow run "Deploy web to Firebase Hosting" |
| 91 | +gh run watch # follow it |
| 92 | +``` |
| 93 | +On success your site is live at `https://<PROJECT_ID>.web.app` (landing) and `/app` (portal). |
| 94 | + |
| 95 | +### If the deploy step fails |
| 96 | +- **`HTTP 403` / permission denied** → the service account is missing **Firebase Hosting Admin**; add the role (step 3.3) and regenerate/re-paste the key. |
| 97 | +- **`Invalid project id`** → `FIREBASE_PROJECT_ID` variable doesn't match an existing Firebase project, or Hosting was never enabled (step 2.2). |
| 98 | +- **Sign-in popup blocked / `origin not allowed`** → add the exact deployed origin to the OAuth client's Authorized JavaScript origins (step 1.4). |
0 commit comments