# Copyright 2026 Google LLC
# SPDX-License-Identifier: Apache-2.0
#
# Deploy via Firebase Hosting + Cloud Run proxy.
#
# STATUS: DISABLED (manual trigger only).
#
# This workflow:
# 1. Deploys the ASGI app to Cloud Run.
# 2. Configures Firebase Hosting to proxy all traffic to Cloud Run.
#
# The result is a Firebase URL (https://PROJECT.web.app) that proxies
# to the Cloud Run service. This is the recommended pattern for Python
# Genkit apps since firebase-functions-python does not yet support
# onCallGenkit.
#
# Prerequisites:
# 1. Create a Firebase project linked to a GCP project.
# 2. Configure Workload Identity Federation for GitHub Actions.
# 3. Set these repository secrets:
# - GCP_PROJECT_ID — Your Firebase/GCP project ID
# - GCP_REGION — e.g. us-central1
# - GCP_SERVICE_ACCOUNT — SA email with roles/run.admin + roles/firebasehosting.admin
# - GCP_WORKLOAD_IDENTITY — Workload Identity Provider resource name
# - GEMINI_API_KEY — Gemini API key for the deployed service
name: Deploy to Firebase Hosting + Cloud Run
on:
workflow_dispatch:
inputs:
service_name:
description: 'Cloud Run service name'
required: true
default: 'genkit-endpoints'
region:
description: 'Cloud Run region'
required: true
default: 'us-central1'
defaults:
run:
working-directory: py/samples/web-endpoints-hello
permissions:
contents: read
id-token: write
jobs:
deploy:
name: Build & Deploy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@v2
with:
project_id: ${{ secrets.GCP_PROJECT_ID }}
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY }}
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
- name: Set up Cloud SDK
uses: google-github-actions/setup-gcloud@v2
- name: Deploy to Cloud Run
uses: google-github-actions/deploy-cloudrun@v2
with:
service: ${{ inputs.service_name }}
region: ${{ inputs.region }}
source: py/samples/web-endpoints-hello
env_vars: |
GEMINI_API_KEY=${{ secrets.GEMINI_API_KEY }}
flags: >-
--port=8080
--memory=512Mi
--cpu=1
--min-instances=0
--max-instances=10
--allow-unauthenticated
- name: Install Firebase CLI
run: npm install -g firebase-tools
- name: Create Firebase Hosting config
env:
SERVICE_NAME: ${{ inputs.service_name }}
REGION: ${{ inputs.region }}
run: |
mkdir -p /tmp/firebase-hosting/public
echo '<!DOCTYPE html><html><body>Redirecting...</body></html>' \
> /tmp/firebase-hosting/public/index.html
cat > /tmp/firebase-hosting/firebase.json << EOF
{
"hosting": {
"public": "public",
"rewrites": [
{
"source": "**",
"run": {
"serviceId": "${SERVICE_NAME}",
"region": "${REGION}"
}
}
]
}
}
EOF
- name: Deploy Firebase Hosting
run: |
firebase deploy \
--only hosting \
--project ${{ secrets.GCP_PROJECT_ID }} \
--config /tmp/firebase-hosting/firebase.json \
--public /tmp/firebase-hosting/public
- name: Show service URLs
run: |
echo "Firebase Hosting: https://${{ secrets.GCP_PROJECT_ID }}.web.app"
echo "Cloud Run: $(gcloud run services describe ${{ inputs.service_name }} \
--region=${{ inputs.region }} --format='value(status.url)' 2>/dev/null || echo 'check console')"
echo "Test: curl https://${{ secrets.GCP_PROJECT_ID }}.web.app/health"
