Deploying adev preview to Firebase workflow (angular/angular)

The Deploying adev preview to Firebase workflow from angular/angular, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get caching, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: angular/angular.github/workflows/adev-preview-deploy.ymlLicense MITView source

What it does

This is the Deploying adev preview to Firebase workflow from the angular/angular repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

# This workflow runs whenever the ADEV build workflow has completed. Deployment happens
# as part of a dedicated second workflow to avoid security issues where the building would
# otherwise occur in an authorized context where secrets could be leaked.
#
# More details can be found here:
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.

name: Deploying adev preview to Firebase

on:
  workflow_run:
    workflows: ['Build adev for preview deployment']
    types: [completed]

permissions:
  # Needed in order to be able to comment on the pull request.
  pull-requests: write
  # Needed in order to checkout the repository
  contents: read
  # Needed in order to retrieve the artifacts from the previous job
  actions: read

env:
  PREVIEW_PROJECT: ng-dev-previews
  PREVIEW_SITE: ng-dev-previews-fw

jobs:
  deploy:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          token: '${{secrets.GITHUB_TOKEN}}'
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: '.nvmrc'
          package-manager-cache: false
      - name: Configure Firebase deploy target
        working-directory: ./
        run: |
          # We can use `npx` as the Firebase deploy actions uses it too.
          # Use stable version release
          npx -y firebase-tools@15.15.0 target:clear --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs
          npx -y firebase-tools@15.15.0 target:apply --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs ${{env.PREVIEW_SITE}}

      - uses: angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase@442c2fcbf06a321b5196b4c5fc70e78a49242958
        with:
          github-token: '${{secrets.GITHUB_TOKEN}}'
          workflow-artifact-name: 'adev-preview'
          firebase-config-dir: './adev'
          firebase-public-dir: './adev/build/browser'
          firebase-project-id: '${{env.PREVIEW_PROJECT}}'
          firebase-service-key: '${{secrets.FIREBASE_PREVIEW_SERVICE_TOKEN}}'

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

# This workflow runs whenever the ADEV build workflow has completed. Deployment happens
# as part of a dedicated second workflow to avoid security issues where the building would
# otherwise occur in an authorized context where secrets could be leaked.
#
# More details can be found here:
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
 
name: Deploying adev preview to Firebase
 
on:
  workflow_run:
    workflows: ['Build adev for preview deployment']
    types: [completed]
 
permissions:
  # Needed in order to be able to comment on the pull request.
  pull-requests: write
  # Needed in order to checkout the repository
  contents: read
  # Needed in order to retrieve the artifacts from the previous job
  actions: read
 
env:
  PREVIEW_PROJECT: ng-dev-previews
  PREVIEW_SITE: ng-dev-previews-fw
 
jobs:
  deploy:
    timeout-minutes: 30
    runs-on: latchkey-small
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          token: '${{secrets.GITHUB_TOKEN}}'
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'
          package-manager-cache: false
      - name: Configure Firebase deploy target
        working-directory: ./
        run: |
          # We can use `npx` as the Firebase deploy actions uses it too.
          # Use stable version release
          npx -y firebase-tools@15.15.0 target:clear --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs
          npx -y firebase-tools@15.15.0 target:apply --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs ${{env.PREVIEW_SITE}}
 
      - uses: angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase@442c2fcbf06a321b5196b4c5fc70e78a49242958
        with:
          github-token: '${{secrets.GITHUB_TOKEN}}'
          workflow-artifact-name: 'adev-preview'
          firebase-config-dir: './adev'
          firebase-public-dir: './adev/build/browser'
          firebase-project-id: '${{env.PREVIEW_PROJECT}}'
          firebase-service-key: '${{secrets.FIREBASE_PREVIEW_SERVICE_TOKEN}}'

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cache dependency installs on the setup step so they are served from cache.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/setup-node