[setting/#3] init-cicd #4
Conversation
WalkthroughThis change adds Firebase integration (Google Services plugin, BOM, Analytics), introduces Fastlane with lanes for test/beta/deploy/distribute, and configures a GitHub Actions CI/CD pipeline that builds/tests and conditionally distributes via Firebase App Distribution. It also adds a Gemfile, updates .gitignore, and removes various IDE/local environment files. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub
participant GA as GitHub Actions
participant Gradle as Gradle Build
participant Test as Unit Tests
participant Ruby as Ruby/Bundler
participant Fastlane as Fastlane
participant Firebase as Firebase App Dist.
Dev->>GH: Push/PR to main or develop
GH->>GA: Trigger workflow (build-and-test)
GA->>Gradle: ./gradlew assembleDebug
Gradle-->>GA: APK/outputs
GA->>Test: ./gradlew test
Test-->>GA: Test reports (artifact upload)
alt push on main/develop and build success
GH->>GA: Trigger distribute job
GA->>Ruby: Setup Ruby 3.1 + bundle install
GA->>GA: Decode FIREBASE_SECRET -> firebase-service-account.json
GA->>Fastlane: bundle exec fastlane android distribute
Fastlane->>Gradle: clean assembleRelease
Gradle-->>Fastlane: release APK/AAB
Fastlane->>Firebase: Upload build + notes + testers
Firebase-->>Fastlane: Distribution result
end
sequenceDiagram
autonumber
actor Dev as Developer
participant FL as Fastlane
participant Gradle as Gradle
participant Crash as Crashlytics
participant Play as Google Play
participant FAD as Firebase App Dist.
rect rgba(200,255,200,0.2)
note right of FL: Lanes overview (Android)
Dev->>FL: fastlane android test
FL->>Gradle: gradle(task: "test")
end
rect rgba(200,200,255,0.2)
Dev->>FL: fastlane android beta
FL->>Gradle: clean assembleRelease
Gradle-->>FL: Release build
FL->>Crash: upload_crashlytics_symbols / triggers
end
rect rgba(255,240,200,0.2)
Dev->>FL: fastlane android deploy
FL->>Gradle: clean assembleRelease
Gradle-->>FL: Release build
FL->>Play: supply/upload to Play Console
end
rect rgba(255,220,220,0.2)
Dev->>FL: fastlane android distribute
FL->>Gradle: clean assembleRelease
Gradle-->>FL: APK/AAB
FL->>FAD: firebase_app_distribution (app_id, testers, notes)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Nitpick comments (7)
Gemfile (1)
1-6: LGTM with a minor suggestion.The Gemfile structure is correct. Consider pinning the Fastlane version for reproducible builds (e.g.,
gem "fastlane", "~> 2.0"), though this is optional for development.fastlane/Fastfile (3)
46-46: Consider making tester list configurable.The tester email is hardcoded. For better maintainability, consider using an environment variable or a configuration file that can be updated without modifying the Fastfile.
Example approach:
- testers: "[email protected]", + testers: ENV["FIREBASE_TESTERS"] || "[email protected]",Then set
FIREBASE_TESTERSin your workflow as a secret or configuration variable.
24-31: Unused lane references unconfigured Crashlytics.The
betalane callscrashlyticsbut Crashlytics is not configured in this PR. If this lane is not currently used, consider removing it or adding a TODO comment indicating future plans.
33-37: Unused lane references unconfigured Play Store.The
deploylane callsupload_to_play_storebut Google Play Store configuration is not present in this PR. If this lane is not currently used, consider removing it or adding a TODO comment indicating future plans..github/workflows/distribute.yml (3)
15-15: Update GitHub Actions to v4.The
actions/checkout@v3action is outdated and may not run on the latest GitHub-hosted runners.Apply this diff:
- uses: actions/checkout@v3 + uses: actions/checkout@v4Based on static analysis hints.
24-24: Update GitHub Actions to v4.The
actions/setup-java@v3action is outdated and may not run on the latest GitHub-hosted runners.Apply this diff:
- uses: actions/setup-java@v3 + uses: actions/setup-java@v4Based on static analysis hints.
30-30: Update GitHub Actions to v4.The
actions/cache@v3action is outdated and may not run on the latest GitHub-hosted runners.Apply this diff:
- uses: actions/cache@v3 + uses: actions/cache@v4Based on static analysis hints.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (10)
.gradle/8.13/checksums/checksums.lockis excluded by!**/*.lock.gradle/8.13/executionHistory/executionHistory.binis excluded by!**/*.bin.gradle/8.13/executionHistory/executionHistory.lockis excluded by!**/*.lock.gradle/8.13/fileChanges/last-build.binis excluded by!**/*.bin.gradle/8.13/fileHashes/fileHashes.binis excluded by!**/*.bin.gradle/8.13/fileHashes/fileHashes.lockis excluded by!**/*.lock.gradle/8.13/fileHashes/resourceHashesCache.binis excluded by!**/*.bin.gradle/buildOutputCleanup/buildOutputCleanup.lockis excluded by!**/*.lock.gradle/buildOutputCleanup/outputFiles.binis excluded by!**/*.binGemfile.lockis excluded by!**/*.lock
📒 Files selected for processing (18)
.github/workflows/ci.yml(1 hunks).github/workflows/distribute.yml(1 hunks).gitignore(1 hunks).gradle/buildOutputCleanup/cache.properties(0 hunks).gradle/config.properties(0 hunks).idea/gradle.xml(0 hunks).idea/workspace.xml(0 hunks)Gemfile(1 hunks)app/build.gradle.kts(2 hunks)app/google-services.json(1 hunks)build.gradle.kts(1 hunks)fastlane/Appfile(1 hunks)fastlane/Fastfile(1 hunks)fastlane/Pluginfile(1 hunks)fastlane/README.md(1 hunks)fastlane/report.xml(1 hunks)gradle/libs.versions.toml(4 hunks)local.properties(0 hunks)
💤 Files with no reviewable changes (5)
- .idea/gradle.xml
- .gradle/buildOutputCleanup/cache.properties
- .gradle/config.properties
- local.properties
- .idea/workspace.xml
🧰 Additional context used
🪛 actionlint (1.7.8)
.github/workflows/distribute.yml
15-15: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
30-30: the runner of "actions/cache@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
.github/workflows/ci.yml
15-15: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
18-18: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/cache@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
44-44: the runner of "actions/upload-artifact@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 Gitleaks (8.28.0)
app/google-services.json
[high] 18-18: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.
(gcp-api-key)
🪛 markdownlint-cli2 (0.18.1)
fastlane/README.md
4-4: Heading style
Expected: setext; Actual: atx
(MD003, heading-style)
14-14: Heading style
Expected: setext; Actual: atx
(MD003, heading-style)
16-16: Heading style
Expected: setext; Actual: atx
(MD003, heading-style)
18-18: Heading style
Expected: setext; Actual: atx
(MD003, heading-style)
26-26: Heading style
Expected: setext; Actual: atx
(MD003, heading-style)
34-34: Heading style
Expected: setext; Actual: atx
(MD003, heading-style)
42-42: Heading style
Expected: setext; Actual: atx
(MD003, heading-style)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: distribute
🔇 Additional comments (13)
app/google-services.json (1)
1-29: LGTM! Static analysis false positive.The
google-services.jsonfile is correctly structured for Firebase integration. The API key flagged by Gitleaks is a Firebase client configuration key (not a secret) that is meant to be included in the app. Firebase restricts its usage through console settings (package name restrictions, SHA fingerprint verification, etc.).fastlane/README.md (1)
1-56: LGTM! Auto-generated documentation.The README is auto-generated by Fastlane and provides helpful documentation for the available lanes. The markdown style hints from static analysis can be safely ignored since this file is regenerated automatically.
Note: The Xcode installation instructions (lines 6-10) are part of Fastlane's default template and are harmless for an Android-only project.
build.gradle.kts (1)
11-11: LGTM!The Google Services plugin is correctly added using the version catalog alias and
apply falseat the root level, following Gradle best practices. It will be applied in the app module where needed.app/build.gradle.kts (2)
10-10: LGTM!The Google Services plugin is correctly applied in the app module, enabling Firebase services integration.
82-83: LGTM!Firebase dependencies are correctly configured using the BOM (Bill of Materials) platform dependency, which ensures version consistency across all Firebase libraries. The Analytics library is properly imported through the BOM.
fastlane/Appfile (1)
2-2: LGTM!The package name correctly matches the configuration in
google-services.json.fastlane/Pluginfile (1)
1-5: LGTM!The Pluginfile correctly declares the Firebase App Distribution plugin dependency.
fastlane/Fastfile (1)
39-50: LGTM on the distribute lane logic!The distribute lane correctly builds a release APK and distributes it via Firebase App Distribution. The configuration parameters (app ID, release notes, artifact type) are appropriate.
.github/workflows/distribute.yml (2)
39-43: LGTM on Firebase credentials handling!The workflow correctly decodes the base64-encoded Firebase service account secret and writes it to a file that matches the Fastfile reference (assuming the Fastfile is updated per earlier comment).
17-21: Good job on the workflow structure!The workflow properly sets up the required environment (Ruby, JDK, Gradle caching) and executes Fastlane distribution. The use of bundler-cache and Gradle caching will improve build performance.
Also applies to: 23-28, 29-37, 45-49
gradle/libs.versions.toml (3)
52-54: LGTM on version declarations!The Google Services plugin version and Firebase BOM version are properly declared.
107-109: LGTM on Firebase library declarations!The Firebase BOM and Analytics library are correctly declared. Using the BOM pattern ensures consistent Firebase library versions across the project.
121-121: LGTM on plugin declaration!The Google Services plugin is properly declared and references the correct version.
| @@ -0,0 +1,2 @@ | |||
| json_key_file("") # Path to the json secret file - Follow https://docs.fastlane.tools/actions/supply/#setup to get one | |||
There was a problem hiding this comment.
Empty json_key_file path will cause Fastlane failures.
The json_key_file is set to an empty string, which will cause Firebase App Distribution to fail. Based on the distribute.yml workflow (which decodes FIREBASE_SECRET to firebase-service-account.json), this should point to that file.
Apply this diff:
-json_key_file("") # Path to the json secret file - Follow https://docs.fastlane.tools/actions/supply/#setup to get one
+json_key_file("firebase-service-account.json") # Path to the json secret file - Follow https://docs.fastlane.tools/actions/supply/#setup to get oneAlternatively, if you want to support both local development and CI, you can use an environment variable:
json_key_file(ENV["FIREBASE_KEY_PATH"] || "firebase-service-account.json")🤖 Prompt for AI Agents
In fastlane/Appfile around line 1, the json_key_file is set to an empty string
which breaks Firebase App Distribution; update this line to point to the decoded
CI secret file (firebase-service-account.json) or use an environment-aware value
so local dev and CI both work — e.g. set the json_key_file to use
ENV["FIREBASE_KEY_PATH"] with a fallback to "firebase-service-account.json".
fastlane/report.xml
Outdated
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <testsuites> | ||
| <testsuite name="fastlane.lanes"> | ||
|
|
||
|
|
||
|
|
||
|
|
||
| <testcase classname="fastlane.lanes" name="0: default_platform" time="0.000216"> | ||
|
|
||
| </testcase> | ||
|
|
||
|
|
||
| <testcase classname="fastlane.lanes" name="1: clean assembleRelease" time="13.863117"> | ||
|
|
||
| </testcase> | ||
|
|
||
|
|
||
| <testcase classname="fastlane.lanes" name="2: firebase_app_distribution" time="17.440506"> | ||
|
|
||
| </testcase> | ||
|
|
||
| </testsuite> | ||
| </testsuites> |
There was a problem hiding this comment.
Remove generated test report from VCS.
The fastlane/report.xml file is a generated artifact from local Fastlane execution and should not be committed to version control. These files are regenerated on each run and will cause unnecessary merge conflicts.
Apply this fix:
- Remove the file from the repository:
git rm fastlane/report.xml- Add the following pattern to your
.gitignore:
+# Fastlane
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots
+fastlane/test_output🤖 Prompt for AI Agents
In fastlane/report.xml around lines 1 to 23, this is a generated Fastlane test
report that should not be committed; remove the file from the repository (git rm
fastlane/report.xml) and update the repository .gitignore to ignore Fastlane
generated reports (add an appropriate pattern such as fastlane/report.xml or
fastlane/*.xml) so the file is not tracked in future commits.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.gitignore (1)
44-45: Remove duplicate Gradle ignore rules.
.gradle/andbuild/are already ignored at Lines 19-20; keeping the duplicates just adds noise. Please drop the redundant entries.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/ci-cd.yml(1 hunks).gitignore(1 hunks).idea/caches/deviceStreaming.xml(1 hunks)app/build.gradle.kts(3 hunks)
✅ Files skipped from review due to trivial changes (1)
- .idea/caches/deviceStreaming.xml
🚧 Files skipped from review as they are similar to previous changes (1)
- app/build.gradle.kts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build-and-test
| - name: Decode Firebase service account | ||
| env: | ||
| FIREBASE_SECRET: ${{ secrets.FIREBASE_SECRET }} | ||
| run: | | ||
| echo $FIREBASE_SECRET | base64 --decode > firebase-service-account.json | ||
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
Quote the secret before decoding.
Use echo "$FIREBASE_SECRET" (or printf '%s' "$FIREBASE_SECRET") to avoid shell word-splitting/globbing corrupting the Base64 payload. Keeps the decoded JSON intact across environments.
- echo $FIREBASE_SECRET | base64 --decode > firebase-service-account.json
+ echo "$FIREBASE_SECRET" | base64 --decode > firebase-service-account.json📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Decode Firebase service account | |
| env: | |
| FIREBASE_SECRET: ${{ secrets.FIREBASE_SECRET }} | |
| run: | | |
| echo $FIREBASE_SECRET | base64 --decode > firebase-service-account.json | |
| - name: Decode Firebase service account | |
| env: | |
| FIREBASE_SECRET: ${{ secrets.FIREBASE_SECRET }} | |
| run: | | |
| echo "$FIREBASE_SECRET" | base64 --decode > firebase-service-account.json |
🤖 Prompt for AI Agents
.github/workflows/ci-cd.yml around lines 80 to 85: the workflow decodes the
FIREBASE_SECRET using echo $FIREBASE_SECRET which allows shell
word-splitting/globbing to corrupt the Base64 payload; change the command to use
a quoted expansion or printf (e.g., use echo "$FIREBASE_SECRET" or printf '%s'
"$FIREBASE_SECRET") before piping to base64 --decode so the secret is preserved
exactly and the decoded JSON remains valid.
|
고생하셨습니다!! |
ISSUE
❗ WORK DESCRIPTION
주요 변경사항:
기술 스택:
📸 SCREENSHOT
CI/CD 파이프라인이므로 스크린샷 대신 워크플로우 구조 설명
📢 TO REVIEWERS
( 받아보고싶으신 분들은 이메일 주시면 좋을것같습니다.)
Summary by CodeRabbit
New Features
Chores
Documentation