White-label App Firebase App distribution

[keskin]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

Android (Kotlin)

Steps to reproduce

I am trying to build an automation system for my white-label app. I am using Codemagic's build API. This is my request:

{
    "appId": "6426aa151d93429c41a4a53a",
    "workflowId": "custom-app-firebase-test",
    "branch": "dev",
    "environment": {
        "variables": {
            "APP_PACKAGE_NAME": "com.myapp",
            "APP_NAME": "My App",
            "GCLOUD_SERVICE_ACCOUNT_CREDENTIALS" : ***,
            "FIREBASE_APP_ID": ***
...
}

In my codemagic.yml I have two workflows. One is for publishing to Google Play, other one is for publishing to Firebase.

workflows:
  custom-app-firebase-test:
    name: Firebase APK Test
    ....
    publishing:
      firebase:
        firebase_service_account: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        android:
          app_id: $FIREBASE_APP_ID
          groups:
            - android-testers

  custom-app-google-play:
    name: Google Play App Bundle Release
    ....
    publishing:
      google_play:
        credentials: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        track: internal
        in_app_update_priority: 0
        changes_not_sent_for_review: false

I have created a service account on google cloud with Firebase App Distribution Admin, and Service Account User permissions.

As you can see in the API request I have GCLOUD_SERVICE_ACCOUNT_CREDENTIALS environment variable. I set the service account JSON file encoded with base64 to this variable.
In my codemagic file, I use this environment variable for firebase_service_account and google play credentials.

With these settings, I can publish to Google Play. But for Firebase I have this error message:
Error: Failed to authenticate, have you run Firebase login?

I also tried to decode the variable with the following, but no success
firebase_service_account: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS | base64 --decode
firebase_service_account: echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS | base64 --decode

How do I proceed? I am sure I am missing something. Any help?

Expected results

successful build

Actual results

Error: Failed to authenticate, have you run Firebase login?

Build id (optional)

64b6a02f7c9e0bc3b1db1488

[kulakarla]

Hello @keskin

Well, the error itself is self-explanatory, most of the times there are just issues with the JSON key. A new generated key always helps.

I'm really surprised you have your Google Play Workflow working with that setup, since when I pass base64 encoded GCLOUD Service Credentials, Google Play fails too, as it should. This is surprising and I do not know exactly why your Google Play is working.

However, I reproduced it more or less, and got both of the workflows working. I use the same service account for Google Play and Firebase.
Here is my setup with explanations:

My API request. I did not include package names, application id-s while testing, since it should not matter. I just hard-coded them into YAML for publishing testing purposes. Request contains the service account JSON key encoded in base64.

{
  "appId": "64afac999821c93eb6677b3c",
  "workflowId": "firebase-publish-only",
  "branch": "main",
  "environment": {
      "variables": {
          "GCLOUD_SERVICE_ACCOUNT_CREDENTIALS": "ewogICJ0eXBlI.......
      }
  }
}

Now, to the workflows. When you pass a base64 value, you obviously need to decode it for usage. So I wrote a simple script that decodes the variable. Add this to your scripts before building the app, especially if you are using automatic build versioning.

- name: GCLOUD Key
  script: |
     echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
     echo 'GCLOUD_SERVICE_ACCOUNT_CREDENTIALS<<DELIMITER' >> $CM_ENV
     echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS | base64 --decode >> $CM_ENV
     echo 'DELIMITER' >> $CM_ENV

And everything else should remain the same. My workflow's look like this:

workflows:
  google-play-workflow:
    name: Google Play Publish Workflow
    environment:
      flutter: stable
      android_signing:
        - mainTestKeyRef
      vars:
        PACKAGE_NAME: "io.codemagic.overall_testapp"
    scripts:
     ........
      - name: GCLOUD Key
        script: |
          echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
          echo 'GCLOUD_SERVICE_ACCOUNT_CREDENTIALS<<DELIMITER' >> $CM_ENV
          echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS | base64 --decode >> $CM_ENV
          echo 'DELIMITER' >> $CM_ENV
     ........
    publishing:
      google_play:
        credentials: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        track: internal
        submit_as_draft: true


  firebase-publish-only:
    name: Firebase API Publish test
    environment:
      flutter: stable
      android_signing:
        - mainTestKeyRef
      vars:
        PACKAGE_NAME: "io.codemagic.overall_testapp"
    scripts:
     ........
      - name: GCLOUD Key
        script: |
          echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
          echo 'GCLOUD_SERVICE_ACCOUNT_CREDENTIALS<<DELIMITER' >> $CM_ENV
          echo $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS | base64 --decode >> $CM_ENV
          echo 'DELIMITER' >> $CM_ENV
    ........
    publishing:
      firebase:
        firebase_service_account: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        android:
          app_id: 123casdc123c: ....
          groups:
            - androidTesters
          artifact_type: 'apk'

This should answer your question. If you still get any errors, let us know. However, if you can publish to Google Play with this, and Firebase still gives you the "Error: Failed to authenticate, have you run Firebase login?", then you have to check your FIrebase & Google Play and make sure everything is correctly set up with the Service Account integration. Also, try generating a new JSON key for the account.

[keskin]

@kulakarla Thank you for the answer. I was trying a similar script without considering DELIMETER. With DELIMITER it is working on both Firebase and Google Play.
Thank you