Repository navigation
fix: EB Firebase 인증 파일 자동 생성 - #63
Conversation
📝 WalkthroughWalkthroughThe PR adds an Elastic Beanstalk predeploy hook. The hook retrieves Firebase credentials from AWS Secrets Manager, validates them, installs them atomically, applies restricted ownership and permissions, and removes temporary files on exit. ChangesFirebase credential deployment
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.platform/hooks/predeploy/10-firebase-credentials.sh:
- Around line 14-19: Update the predeploy credential setup before the aws
secretsmanager call to check FIREBASE_ENABLED, and skip the entire Firebase
credential retrieval when Firebase is disabled. Preserve the existing secret
retrieval behavior when Firebase is enabled, including the current secret_id,
aws_region, and temporary_path handling.
- Line 21: Replace the non-empty check in the Firebase credential installation
flow with validation that parses the service-account JSON and verifies all
required fields before chown and mv. Ensure the validator is available on the
Elastic Beanstalk image by provisioning jq through .ebextensions-dev or using
another guaranteed validator, while preserving failure handling for invalid
credentials.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 488b2bf6-0bc5-4d97-907b-ded2aa71352a
📒 Files selected for processing (1)
.platform/hooks/predeploy/10-firebase-credentials.sh
| aws secretsmanager get-secret-value \ | ||
| --secret-id "${secret_id}" \ | ||
| --region "${aws_region}" \ | ||
| --query SecretString \ | ||
| --output text \ | ||
| --no-cli-pager > "${temporary_path}" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- hook ---'
cat -n .platform/hooks/predeploy/10-firebase-credentials.sh
printf '%s\n' '--- Firebase configuration references ---'
rg -n -C 3 'FIREBASE_ENABLED|FirebaseConfig|getApplicationDefault|credential_dir|temporary_path|secret_id|aws_region' \
.platform . 2>/dev/null | head -n 300
printf '%s\n' '--- related platform files ---'
git ls-files '.platform/*' '*application*.yml' '*FirebaseConfig*' '*firebase*' | head -n 200Repository: DayTodo/DayTodo_BE
Length of output: 5790
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- deployment configuration and documentation ---'
git ls-files | rg '(^|/)(\.ebextensions|\.platform|Dockerfile|docker-compose|.*ya?ml|.*properties|README)' | head -n 300
rg -n -C 4 'FIREBASE_ENABLED|GOOGLE_APPLICATION_CREDENTIALS|firebase-service-account|secretsmanager|get-secret-value|AWS_REGION|environment|env' \
.github .ebextensions .platform README.md src 2>/dev/null | head -n 400
printf '%s\n' '--- Firebase configuration and application resources ---'
cat -n src/main/java/com/daytodo/global/config/FirebaseConfig.java
sed -n '60,82p' src/main/resources/application.yml
sed -n '14,28p' README.mdRepository: DayTodo/DayTodo_BE
Length of output: 9313
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
hook = Path(".platform/hooks/predeploy/10-firebase-credentials.sh").read_text()
config = Path("src/main/resources/application.yml").read_text()
firebase = Path("src/main/java/com/daytodo/global/config/FirebaseConfig.java").read_text()
aws_call = re.search(r'(?m)^\s*aws\s+secretsmanager\s+get-secret-value\s+\\', hook)
guard = re.search(r'(?ms)if\s+\[\[.*?FIREBASE_ENABLED.*?\]\];\s*then.*?exit\s+0', hook)
default_disabled = re.search(r'(?m)^\s*enabled:\s*\$\{FIREBASE_ENABLED:false\}', config)
conditional = re.search(
r'`@ConditionalOnProperty`\(prefix\s*=\s*"firebase",\s*name\s*=\s*"enabled",\s*havingValue\s*=\s*"true"\)',
firebase,
)
print({
"unconditional_secrets_manager_call_present": bool(aws_call),
"firebase_disabled_guard_present_before_call": bool(guard and guard.start() < aws_call.start()) if aws_call else False,
"application_default_is_false": bool(default_disabled),
"firebase_config_requires_enabled_true": bool(conditional),
})
assert aws_call
assert not (guard and guard.start() < aws_call.start())
assert default_disabled
assert conditional
PYRepository: DayTodo/DayTodo_BE
Length of output: 348
Skip credential retrieval when Firebase is disabled.
The predeploy hook always calls Secrets Manager. FIREBASE_ENABLED defaults to false, and FirebaseConfig loads only when firebase.enabled=true. Add a guard before credential setup so disabled environments do not require the secret or IAM permission.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.platform/hooks/predeploy/10-firebase-credentials.sh around lines 14 - 19,
Update the predeploy credential setup before the aws secretsmanager call to
check FIREBASE_ENABLED, and skip the entire Firebase credential retrieval when
Firebase is disabled. Preserve the existing secret retrieval behavior when
Firebase is enabled, including the current secret_id, aws_region, and
temporary_path handling.
| --output text \ | ||
| --no-cli-pager > "${temporary_path}" | ||
|
|
||
| test -s "${temporary_path}" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".platform/hooks/predeploy/10-firebase-credentials.sh"
printf '%s\n' "--- hook ---"
cat -n "$file"
printf '%s\n' "--- related references ---"
rg -n --hidden -S \
'temporary_path|FIREBASE|GoogleCredentials|getApplicationDefault|firebase|jq|webapp' \
-g '!node_modules' -g '!dist' -g '!build' . | head -300
printf '%s\n' "--- jq availability ---"
if command -v jq >/dev/null 2>&1; then
jq --version
else
echo "jq: unavailable"
fiRepository: DayTodo/DayTodo_BE
Length of output: 5369
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' "--- deployment configuration ---"
git ls-files | rg '(^|/)(Dockerfile|docker-compose|.*ebextensions.*|.*platform.*|.*workflow.*|.*ya?ml$|.*json$)' | head -300
printf '%s\n' "--- validator and platform references ---"
rg -n --hidden -S \
'jq|yum|dnf|apt|amazon linux|platform|Elastic Beanstalk|aws-elasticbeanstalk|predeploy|SecretString' \
.platform .ebextensions-dev .github README.md build.gradle 2>/dev/null || true
printf '%s\n' "--- proposed jq predicate behavior ---"
python3 - <<'PY'
import json
from pathlib import Path
fixtures = {
"valid service account": {
"type": "service_account",
"project_id": "p",
"client_email": "x@example.com",
"private_key": "-----BEGIN PRIVATE KEY-----\\nkey\\n-----END PRIVATE KEY-----\\n",
},
"malformed JSON": '{"type":"service_account"',
"unrelated object": {"kind": "config", "value": "not credentials"},
"nonempty scalar": "secret",
"missing private_key": {
"type": "service_account",
"project_id": "p",
"client_email": "x@example.com",
},
}
for name, value in fixtures.items():
path = Path("/tmp") / ("firebase-" + name.replace(" ", "-") + ".json")
if isinstance(value, str) and value.startswith("{"):
path.write_text(value)
else:
path.write_text(json.dumps(value))
print(f"{name}: {path}")
PY
predicate='
type == "object" and
.type == "service_account" and
(.project_id | type == "string") and
(.client_email | type == "string") and
(.private_key | type == "string")
'
for file in /tmp/firebase-*.json; do
if jq -e "$predicate" "$file" >/dev/null 2>&1; then
printf 'accepted: %s\n' "$file"
else
printf 'rejected: %s\n' "$file"
fi
doneRepository: DayTodo/DayTodo_BE
Length of output: 1565
🌐 Web query:
AWS Elastic Beanstalk Amazon Linux 2 platform jq preinstalled package
💡 Result:
The jq command-line JSON processor is not preinstalled on AWS Elastic Beanstalk platforms running Amazon Linux 2 [1][2][3]. Because jq is frequently required to parse configuration data or environment variables on these platforms [4][1][5][3], users must explicitly include it in their environment configuration. To install jq on an Elastic Beanstalk environment using Amazon Linux 2, you can add it to your.ebextensions configuration file using the packages key [2][3][6]: packages: yum: jq: [] While Elastic Beanstalk documentation now recommends using Buildfile, Procfile, and platform hooks for configuration on Amazon Linux 2 environments [7], adding jq via.ebextensions remains a standard and widely used approach for ensuring the tool is available on the instance [1][3][6].
Citations:
- 1: https://repost.aws/questions/QU4Dpikh78ThGEDCHGF4RKOA/unable-to-update-environment-properties-in-aml-2-rails
- 2: https://stackoverflow.com/questions/59094752/reference-environment-properties-in-ebextension-script
- 3: https://blog.richardchou.dev/upgrading-elastic-beanstalk-from-amazon-linux-1-to-amazon-linux-2-1c2e0344c326
- 4: https://nick.pearson.dev/posts/ebenv
- 5: /opt/elasticbeanstalk/bin/get-config doesn't exist for Amazon Linux 2 Platforms awsdocs/elastic-beanstalk-samples#111
- 6: https://stackoverflow.com/questions/69713927/upgrading-elastic-beanstalk-environment-from-aws-linux-1-to-aws-linux-2
- 7: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers-ec2.html
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' "--- deployment workflow ---"
cat -n .github/workflows/dev-deploy.yml
printf '%s\n' "--- Elastic Beanstalk configuration ---"
for file in .ebextensions-dev/00-makefiles.config .ebextensions-dev/01-set-timezone.config; do
printf '%s\n' "--- $file ---"
cat -n "$file"
done
printf '%s\n' "--- credential path consumers and environment wiring ---"
rg -n --hidden -S \
'GOOGLE_APPLICATION_CREDENTIALS|firebase-service-account|credential_path|/opt/daytodo|FIREBASE_ENABLED|GoogleCredentials' \
. \
-g '!node_modules' -g '!dist' -g '!build'Repository: DayTodo/DayTodo_BE
Length of output: 4412
Validate the Firebase service-account JSON before installation.
test -s accepts malformed JSON and unrelated non-empty values. Validate the JSON and required service-account fields before chown and mv. jq is not installed by default on Elastic Beanstalk, so provision it in .ebextensions-dev or use a validator guaranteed on the target image.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.platform/hooks/predeploy/10-firebase-credentials.sh at line 21, Replace the
non-empty check in the Firebase credential installation flow with validation
that parses the service-account JSON and verifies all required fields before
chown and mv. Ensure the validator is available on the Elastic Beanstalk image
by provisioning jq through .ebextensions-dev or using another guaranteed
validator, while preserving failure handling for invalid credentials.
2 participants
📌 관련 이슈
🔎 What is this PR?
✨ Changes
EB가 배포 시 새 EC2 인스턴스를 생성하는 상황이라, 기존 인스턴스에 수동으로 저장한 Firebase service account JSON이 새 인스턴스에는 존재하지 않아 배포가 실패했습니다.
새 인스턴스에서도 자동으로 인증 파일이 생성되도록, 배포 전 Secrets Manager의
daytodo/firebase-service-account값을 가져와/opt/daytodo/firebase-service-account.json으로 저장하는 EB predeploy hook을 추가했습니다.📷 Result
💬 To. Reviewer
✅ 체크 리스트
Summary by CodeRabbit