Answer: Environmental Variables.
Specifically, using a machine with a browser and firebase tools installed, run firebase login:ci --no-localhost and paste the resulting key from the firebase CLI tool into an Environmental Variable and name it FIREBASE_TOKEN (not $FIREBASE_TOKEN).
In your deployment, say
npm install -g firebase-tools
firebase deploy
Done. If you care about Why? Read on.
The firebase/firebase-tools repo README indicates the following regarding Usage with CI Systems.
The Firebase CLI requires a browser to complete authentication, but is
fully compatible with CI and other headless environments.
On a machine with a browser, install the Firebase CLI. Run firebase
login:ci to log in and print out a new access token (the current CLI
session will not be affected).
NOTE: You actually want to type firebase login:ci --no-localhost
Store the output token in a secure but accessible way in your CI
system. There are two ways to use this token when running Firebase
commands:
Store the token as the environment variable FIREBASE_TOKEN and it will
automatically be utilized. Run all commands with the --token <token>
flag in your CI system.
- NOTE: You MUST put your token in quotes IIF using the --token flag
BIGGER NOTE Do NOT prefix your environment variable with $ or you will get a nonsensical error message below!!!
Your CLI authentication needs to be updated to take advantage of new features.
Please run firebase login --reauth
Error: Command requires authentication, please run firebase login
The order of precedence for token loading is flag, environment
variable, active project.
Recommendation is to use Environmental Variable so the secret token is not stored/visible in the logs.