能否在Firebase云函数运行时访问GitHub Secrets？附实现方案

1. 配置GitHub Secrets #

在你的GitHub仓库中，进入「Settings」→「Secrets and variables」→「Actions」，添加以下Secrets：

• FIREBASE_SERVICE_ACCOUNT: Firebase服务账号的JSON内容（用于GitHub Actions获取部署权限）
• ENVIRONMENT: 环境标识（比如local或production）
• VPC_CONNECTOR_PROD: 生产环境的VPC连接器地址
• VPC_EGRESS_PROD: 生产环境的VPC出口设置
• VPC_CONNECTOR_LOCAL: 本地环境的VPC连接器地址
• VPC_EGRESS_LOCAL: 本地环境的VPC出口设置

2. 编写GitHub Actions部署工作流 #

创建.github/workflows/deploy-firebase.yml文件，内容如下：

name: Deploy Firebase Functions

on:
  push:
    branches: [ main ]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          
      - name: Install dependencies
        run: npm install
        
      - name: Deploy to Firebase
        uses: FirebaseExtended/action-hosting-deploy@v0
        with:
          repoToken: '${{ secrets.GITHUB_TOKEN }}'
          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT }}'
          projectId: your-firebase-project-id
        env:
          ENVIRONMENT: '${{ secrets.ENVIRONMENT }}'
          VPC_CONNECTOR_PROD: '${{ secrets.VPC_CONNECTOR_PROD }}'
          VPC_EGRESS_PROD: '${{ secrets.VPC_EGRESS_PROD }}'
          VPC_CONNECTOR_LOCAL: '${{ secrets.VPC_CONNECTOR_LOCAL }}'
          VPC_EGRESS_LOCAL: '${{ secrets.VPC_EGRESS_LOCAL }}'

3. 修改云函数代码（替代functions.config()） #

调整你的GetPolicy函数，直接从环境变量process.env读取配置：

function GetPolicy(timeoutSeconds=60, maxInstances=15){
    const environment = process.env.ENVIRONMENT;
    if (environment === 'local') {
        return {
            timeoutSeconds: 60,
            maxInstances: 2,
            vpcConnector: process.env.VPC_CONNECTOR_LOCAL,
            vpcConnectorEgressSettings: process.env.VPC_EGRESS_LOCAL
        }
    } else {
        return {
            timeoutSeconds: timeoutSeconds ?? 60,
            maxInstances: maxInstances ?? 15,
            vpcConnector: process.env.VPC_CONNECTOR_PROD,
            vpcConnectorEgressSettings: process.env.VPC_EGRESS_PROD
        }
    }
}

补充说明 #

• 部署时GitHub Actions会将Secrets注入为云函数的环境变量，云函数运行时可直接通过process.env访问
• 本地开发时，可创建.env文件添加对应环境变量，配合firebase functions:shell或firebase emulators:start使用（需安装dotenv包并在代码顶部引入require('dotenv').config()）

内容的提问来源于stack exchange，提问作者Rohit