Migrate to Workload Identity Federation (WIF)

[nathenharvey]

• Goal: Eliminate the long-lived SERVICE_ACCOUNT secret from GitHub for maximum security.
• How: Since the third-party action-hosting-deploy action does not support WIF, you can replace it with direct Firebase CLI commands:

  - name: Authenticate to Google Cloud
    uses: google-github-actions/auth@v2
    with:
      workload_identity_provider: 'projects/712907887884/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider'
      service_account: 'ci-service-account@doradotdev.iam.gserviceaccount.com'
  
  - name: Deploy to Firebase
    id: deploy
    run: |
      npx firebase-tools@latest hosting:channel:deploy pr${{ github.event.pull_request.number || 'manual' }}_drafts_off --expires 30d --project doradotdev | tee deploy_output.txt
      PREVIEW_URL=$(grep -oE "https://[a-zA-Z0-9.-]+\.(web\.app|firebaseapp\.com)" deploy_output.txt | head -n 1)
      echo "details_url=$PREVIEW_URL" >> $GITHUB_OUTPUT

• PR Comments: You can write a simple custom step using the pre-installed GitHub CLI (gh pr comment) to post the preview link back to your PRs, as we demonstrated during our WIF trials.