Use Google Cloud Build to deploy Firebase without Firebase CI token - firebase

Question

In my package.json I have this line:
{
"deploy:ci": firebase deploy --force --only functions --token \"$SECRET\"
}
And my cloudbuild.yaml:
steps:
- name: "gcr.io/cloud-builders/docker"
args: ["build", "--tag", "gcr.io/$PROJECT_ID/functions", "."]
- name: "gcr.io/$PROJECT_ID/functions"
args: ["yarn", "deploy:ci"]
secretEnv: ["FIREBASE_TOKEN"]
secrets:
- kmsKeyName: projects/myproject/locations/global/keyRings/enviroment/cryptoKeys/firebase
secretEnv:
FIREBASE_TOKEN: VERY_LONG_UNGLY_AND_BORING_BASE64_STRING
I want to know if it is possible to add some "special" permissions to the cloudbuild in order to allow the deployment without this FIREBASE_TOKEN.
(all files are in the same project)

Answer 1

yes, it is possible. But there are couple of stuff you need to do
assuming your cloud build looks like this
steps:
- name: "gcr.io/cloud-builders/npm"
args: ["install"]
- name: "gcr.io/cloud-builders/npm"
args: ["run", "build]
- name: "gcr.io/cloud-builders/firebase"
args: ["deploy"]
You need to upload your own firebase image from here, I assume you are already familiar with this, otherwise, I wrote basically a similar post about how to do this part here anyway...
After that, the IAM you are asking for is Firebase Admin, you need to assign this to your ...#cloudbuild.gserviceaccount.com account.
Voila! you can test it like (using the sdk)
gcloud builds submit --config cloudbuild.yaml .
Of course point to your file location.
Opinionated comment: I'm not a big fan of this approach, I tried a few times and there were always some issues with it, but well, that's why we called it opinionated comment :)
Good luck.