CI CD and Deployment

CI/CD and Deployment

Three GitHub Actions workflows automate builds and deploys.

build-apk.yml — build & publish the APK

• Trigger: push a v* tag, or manual dispatch.
• Does: JDK 17 → restore the permanent release keystore from secrets (RELEASE_KEYSTORE_BASE64 / RELEASE_KEYSTORE_PASSWORD) → ./gradlew assembleRelease → create a GitHub Release with app-release.apk.
• If the keystore secrets are absent it falls back to a throwaway debug keystore (that APK won't install over releases).
• See Releases and Signing.

deploy-hosting.yml — deploy the web console

• Trigger: push to main touching public/**, firebase.json, .firebaserc, or the workflow.
• Does: deploys Firebase Hosting (site coremdm) using the FIREBASE_SERVICE_ACCOUNT secret. Live at coremdm.web.app.

deploy-firestore.yml — deploy the security rules

• Trigger: push to main touching firestore.rules or the workflow.
• Does: firebase deploy --only firestore:rules using the same FIREBASE_SERVICE_ACCOUNT secret.
• Caveat: deploying rules needs the service account to have the Firebase Rules Admin role (roles/firebaserules.admin) in Google Cloud IAM — the Hosting role alone isn't enough. Until that's granted the deploy step is continue-on-error (it won't fail the run) and prints guidance; publish rules manually in the Firebase console in the meantime.

Required repo secrets

Secret	Used by	What it is
RELEASE_KEYSTORE_BASE64	build-apk	base64 of the release .p12 keystore
RELEASE_KEYSTORE_PASSWORD	build-apk	the keystore password
FIREBASE_SERVICE_ACCOUNT	deploy-hosting, deploy-firestore	a Firebase Admin SDK service-account JSON

Set these under repo Settings → Secrets and variables → Actions.

One-time IAM grant (to enable auto rules deploy)

In Google Cloud Console → IAM & Admin → IAM for project techeaz-core-mdm, give the service account (ends in @techeaz-core-mdm.iam.gserviceaccount.com, usually firebase-adminsdk-…) the Firebase Rules Admin role. After that, deploy-firestore.yml will succeed on its own.

Manual deploys (fallback)

firebase login
firebase deploy --only hosting:coremdm
firebase deploy --only firestore:rules

Or publish rules in the console: Firestore Database → Rules → paste → Publish.

The installer site

The device-provisioning front end lives in a separate project served at coremdm.pages.dev/install (it was removed from this repo's public/install). It isn't part of these workflows.