FirebaseAppDistributionAction

struct FirebaseAppDistributionAction

Overview

Runs the upload → poll → release-notes → distribute sequence against the App Distribution v1 API. Works on both iOS and Android; the platform is derived from the Firebase app ID and checked against the artifact’s extension so a mismatched build fails before upload.

Credentials

Two mutually exclusive paths, checked in this order:

1. Workload Identity Federation (keyless) — needs both workload_identity_provider and service_account_email (options or, respectively, the GOOGLE_WORKLOAD_IDENTITY_PROVIDER / GOOGLE_SERVICE_ACCOUNT_EMAIL environment variables). No service-account key ever exists; this is the required path wherever an org enforces iam.disableServiceAccountKeyCreation. See WorkloadIdentityFederationClient for the exchange and the IAM bindings it needs.

2. Service-account JSON key — resolved, in order, from the service_account_path option, the FIREBASE_SERVICE_ACCOUNT_JSON environment variable (raw JSON), or GOOGLE_APPLICATION_CREDENTIALS (a path).

Inline credentials in a Shipfile are never accepted — workload_identity_provider and service_account_email are identifiers, not secrets, so they’re fine directly in a Shipfile.

Usage

# Keyless, via Workload Identity Federation:
- action: firebase-app-distribution
  options:
    app_id: ${FIREBASE_IOS_QA_APP_ID}
    artifact_path: ./build/staging-export/App.ipa
    groups:
      - qa-testers
    release_notes: Staging candidate
    workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/github-actions/providers/github
    service_account_email: firebase-app-distribution-ci@novalingo-staging.iam.gserviceaccount.com