CI/CD¶
Last reviewed: April 2, 2026
BeFam uses a protected promotion model:
stagingfor integrationmainfor production releases
Workflow Summary¶
branch-ci.yml (CI - Branch Quality Gates)¶
Runs on: - pushes to every branch
Checks: - docs build and rules-doc validation - Functions install/build/test - Flutter analyze/test - Android release build verification - dependency review + Trivy + gitleaks + image vulnerability scanning
mobile-e2e.yml + mobile-e2e-ios.yml¶
Run Android/iOS smoke E2E on pushes to every branch, plus manual dispatch. The jobs self-skip when the push does not touch mobile or E2E-related files.
mobile-e2e-deep.yml (CI - Mobile E2E Deep)¶
Runs the full deep mobile regression suite on pushes to staging and main, plus manual dispatch.
deploy-docs.yml (CD - Deploy Docs (GitHub Pages))¶
Builds and publishes MkDocs to GitHub Pages.
deploy-staging.yml (CD - Deploy Staging)¶
Deploys Firebase resources and web hosting to the staging environment. Branch guard: staging only.
release-staging.yml (CD - Release Staging (Manual))¶
Manual workflow_dispatch to build signed staging mobile artifacts for store testing:
- Android AAB
- iOS IPA
This workflow does not create a release tag and does not publish a GitHub Release.
release-main.yml (CD - Release Main)¶
Builds release-ready artifacts, signs mobile binaries, publishes immutable release assets, checksums, and the release manifest. Branch guard: main only.
deploy-firebase.yml (CD - Deploy Firebase (Production))¶
Manual workflow_dispatch that promotes a selected release-main tag to production Firestore rules, indexes, Storage rules, and Functions.
Also writes runtime .env.<projectId> and syncs non-secret runtime overrides.
Input guard: release_tag must point to a GitHub Release produced from main.
deploy-web-hosting.yml (CD - Deploy Web Hosting (Production))¶
Manual workflow_dispatch that promotes the immutable web bundle attached to a selected release-main tag.
Input guard: release_tag must point to a GitHub Release produced from main.
rollback-production.yml (CD - Rollback Production)¶
Restores production Firebase/Hosting to a selected release tag.
promote-staging-to-main.yml (Ops - Promote Staging to Main)¶
Creates or refreshes the staging -> main promotion PR whenever new commits land on staging.
release-issue-closure.yml (Ops - Close Released Issues)¶
Closes linked delivered issues after release PR merge to main.
Production Environment Keys¶
Required vars:
- FIREBASE_PROJECT_ID
- FIREBASE_FUNCTIONS_REGION
- APP_TIMEZONE
- BEFAM_ADMOB_ANDROID_APP_ID
- BEFAM_ADMOB_IOS_APP_ID
- BEFAM_ADMOB_ANDROID_BANNER_UNIT_ID
- BEFAM_ADMOB_ANDROID_INTERSTITIAL_UNIT_ID
- BEFAM_ADMOB_ANDROID_REWARDED_UNIT_ID
- BEFAM_ADMOB_IOS_BANNER_UNIT_ID
- BEFAM_ADMOB_IOS_INTERSTITIAL_UNIT_ID
- BEFAM_ADMOB_IOS_REWARDED_UNIT_ID
Required production secrets:
- GCP_WORKLOAD_IDENTITY_PROVIDER
- GCP_SERVICE_ACCOUNT_EMAIL
- BILLING_WEBHOOK_SECRET
- VNPAY_TMNCODE
- VNPAY_HASH_SECRET
Staging migration fallback (optional, staging only):
- FIREBASE_SERVICE_ACCOUNT
- CARD_WEBHOOK_SECRET