fix: deploy via FIREBASE_TOKEN; revert WIF (firebase-tools#3926) - #44
Merged
Conversation
Reverts the WIF dual-path (#43): firebase-tools 15.22.2 rejects WIF external_account credentials (firebase-tools#3926), so it could never work. Root cause of the deploy flake (2026-06-25): `firebase apphosting:rollouts:create` intermittently fails "Failed to authenticate" on hosted runners with SA-key ADC, across all projects (tmi AND atlas), while the SAME key authenticates fine locally and `apphosting:backends:list` works. The SA-key path signs a JWT (iat/exp), so it's clock-skew sensitive on the runner fleet; refresh-token (FIREBASE_TOKEN) auth is not JWT-signed and sidesteps it. Adds optional job-level FIREBASE_TOKEN env to deploy-firebase.yml. Empty (secret unset) => CLI ignores it and uses the SA key as before, so repos opt in per-repo by setting the FIREBASE_TOKEN secret (from `firebase login:ci`). Refs shared-workflows#42 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause (2026-06-25 incident)
firebase apphosting:rollouts:createintermittently failsFailed to authenticateon GitHub hosted runners using SA-key ADC — across all projects (tmi AND atlas), while the same key authenticates fine locally andapphosting:backends:listworks. SA-key auth signs a JWT (iat/exp) → clock-skew-sensitive on the runner fleet. Refresh-token (FIREBASE_TOKEN) auth isn't JWT-signed, so it sidesteps the failure (verified: direct rollout with a user token succeeds).Changes
external_accountcreds (firebase-tools#3926) — it could never work. Removes thewif_provider/deploy_service_accountinputs, dual auth steps, andid-tokenperms.FIREBASE_TOKEN: optional secret + job-level env ondeploy-firebase.yml. When set, the CLI uses it; when empty, falls back to the SA key unchanged → safe per-repo opt-in.Rollout
Set the
FIREBASE_TOKENsecret (fromfirebase login:ci) on a repo to switch it; leave unset to keep SA-key behavior. Canary = tmi.Refs #42