Deploying adev preview to Firebase workflow (angular/angular)
The Deploying adev preview to Firebase workflow from angular/angular, explained and optimized by Latchkey.
C
CI health: C - fair
The optimized version below adds caching, job timeouts.
What it does
This is the Deploying adev preview to Firebase workflow from the angular/angular repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
workflow (.yml)
# This workflow runs whenever the ADEV build workflow has completed. Deployment happens
# as part of a dedicated second workflow to avoid security issues where the building would
# otherwise occur in an authorized context where secrets could be leaked.
#
# More details can be found here:
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
name: Deploying adev preview to Firebase
on:
workflow_run:
workflows: ['Build adev for preview deployment']
types: [completed]
permissions:
# Needed in order to be able to comment on the pull request.
pull-requests: write
# Needed in order to checkout the repository
contents: read
# Needed in order to retrieve the artifacts from the previous job
actions: read
env:
PREVIEW_PROJECT: ng-dev-previews
PREVIEW_SITE: ng-dev-previews-fw
jobs:
deploy:
runs-on: ubuntu-latest
if: ${{ github.event.workflow_run.conclusion == 'success' }}
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
token: '${{secrets.GITHUB_TOKEN}}'
persist-credentials: false
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version-file: '.nvmrc'
package-manager-cache: false
- name: Configure Firebase deploy target
working-directory: ./
run: |
# We can use `npx` as the Firebase deploy actions uses it too.
# Use stable version release
npx -y firebase-tools@15.15.0 target:clear --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs
npx -y firebase-tools@15.15.0 target:apply --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs ${{env.PREVIEW_SITE}}
- uses: angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase@442c2fcbf06a321b5196b4c5fc70e78a49242958
with:
github-token: '${{secrets.GITHUB_TOKEN}}'
workflow-artifact-name: 'adev-preview'
firebase-config-dir: './adev'
firebase-public-dir: './adev/build/browser'
firebase-project-id: '${{env.PREVIEW_PROJECT}}'
firebase-service-key: '${{secrets.FIREBASE_PREVIEW_SERVICE_TOKEN}}'
The same workflow, on Latchkey
Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.
# This workflow runs whenever the ADEV build workflow has completed. Deployment happens# as part of a dedicated second workflow to avoid security issues where the building would# otherwise occur in an authorized context where secrets could be leaked.## More details can be found here:# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/. name: Deploying adev preview to Firebase on: workflow_run: workflows: ['Build adev for preview deployment'] types: [completed] permissions: # Needed in order to be able to comment on the pull request. pull-requests: write # Needed in order to checkout the repository contents: read # Needed in order to retrieve the artifacts from the previous job actions: read env: PREVIEW_PROJECT: ng-dev-previews PREVIEW_SITE: ng-dev-previews-fw jobs: deploy: timeout-minutes: 30 runs-on: latchkey-small if: ${{ github.event.workflow_run.conclusion == 'success' }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: '${{secrets.GITHUB_TOKEN}}' persist-credentials: false - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: cache: 'npm' node-version-file: '.nvmrc' package-manager-cache: false - name: Configure Firebase deploy target working-directory: ./ run: | # We can use `npx` as the Firebase deploy actions uses it too. # Use stable version release npx -y firebase-tools@15.15.0 target:clear --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs npx -y firebase-tools@15.15.0 target:apply --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs ${{env.PREVIEW_SITE}} - uses: angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase@442c2fcbf06a321b5196b4c5fc70e78a49242958 with: github-token: '${{secrets.GITHUB_TOKEN}}' workflow-artifact-name: 'adev-preview' firebase-config-dir: './adev' firebase-public-dir: './adev/build/browser' firebase-project-id: '${{env.PREVIEW_PROJECT}}' firebase-service-key: '${{secrets.FIREBASE_PREVIEW_SERVICE_TOKEN}}'
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Cache dependency installs on the setup step so they are served from cache.
- Add a job timeout so a hung step cannot burn hours of runner time.
This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.
Actions used in this workflow
actions/checkout
actions/setup-node
angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase
Frequently asked questions
What does the Deploying adev preview to Firebase workflow (angular/angular) workflow do?
This is the Deploying adev preview to Firebase workflow from the angular/angular repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.
What CI health grade does this workflow get?
This Node.js workflow grades C. Paste your own workflow into the Latchkey grader to see its grade and the exact fixes.
How can I improve this Node.js workflow?
Apply caching, job timeouts. Latchkey applies these automatically on managed runners when you point runs-on at Latchkey.