我有一个云构建触发器，试图将我的应用程序推送到firebase托管。为此，我有一个加密的.env.enc文件，其中包含部署所需的firebase令牌。在我的构建期间，我解密了这个文件并尝试部署但遇到了未经授权的消息。
我尝试在部署脚本中对令牌进行硬编码，而不是使用环境变量，并且部署得很好。
这是我的cloudbuild.yaml
steps:
- name: gcr.io/cloud-builders/gcloud
args:
- kms
- decrypt
- --ciphertext-file=.env.enc
- --plaintext-file=.env
- --location=global
- --keyring=ssr-vue-docker-app
- --key=cloudbuild-env
# Install
- name: 'gcr.io/cloud-builders/npm'
args: ['install']
# Test
- name: 'gcr.io/cloud-builders/npm'
args: ['run', 'test']
# Build
- name: 'gcr.io/cloud-builders/npm'
args: ['run', 'build']
# Deploy
- name: 'gcr.io/cloud-builders/npm'
args: ['run', 'deploy']
最后的部署步骤使用解密的.env文件中使用的环境变量调用package.json中的npm脚本。
"deploy": "firebase deploy --debug --token \"$FIREBASE_TOKEN\"
我得到的初始输出表明该令牌未被使用，但也可以从最终日志中进行编辑。
Step #4: [2019-04-17T21:14:48.087Z] Command: /usr/local/bin/node /workspace/node_modules/.bin/firebase deploy --debug --token= --only=hosting
这是我尝试部署时收到的错误。
Step #4: Error: HTTP Error: 403, The caller does not have permission
Step #4:
Step #4: [2019-04-17T21:14:48.531Z] <<< HTTP RESPONSE BODY code=403, message=The caller does not have permission, status=PERMISSION_DENIED
Step #4: [2019-04-17T21:14:48.530Z] <<< HTTP RESPONSE 403 vary=X-Origin, Referer, Origin,Accept-Encoding, content-type=application/json; charset=UTF-8, date=Wed, 17 Apr 2019 21:14:48 GMT, server=ESF, cache-control=private, x-xss-protection=1; mode=block, x-frame-options=SAMEORIGIN, x-content-type-options=nosniff, accept-ranges=none, transfer-encoding=chunked
Step #4: rewrites=[glob=**, region=us-central1, serviceId=nuxt-server], deployment-tool=cli-firebase
Step #4: [2019-04-17T21:14:48.337Z] >>> HTTP REQUEST POST https://firebasehosting.googleapis.com/v1beta1/sites/ssr-vue-docker-app/versions
Step #4: i deploying hosting
Step #4:
Step #4: === Deploying to 'ssr-vue-docker-app'...
如果正在使用环境变量，我可能会调试的任何建议？或者我的构建步骤中是否缺少某些东西，允许我使用.env文件中的环境变量？
我试图遵循这个指南：https://fireship.io/lessons/ci-cd-with-google-cloud-build/。我似乎无法看到我在这里缺少什么，所以任何帮助都表示赞赏。
看到：
$ git clone https://github.com/GoogleCloudPlatform/cloud-builders-community
$ cd firebase
$ gcloud builds submit --config cloudbuild.yaml .
$ firebase login:ci
$ gcloud kms keyrings create cloudbuilder --location global
$ gcloud kms keys create firebase-token --location global --keyring cloudbuilder --purpose encryption
$ echo -n <ciToken> | gcloud kms encrypt \
--plaintext-file=- \
--ciphertext-file=- \
--location=global \
--keyring=cloudbuilder \
--key=firebase-token | base64
看到：
secrets:
- kmsKeyName: projects/<projectName>/locations/global/keyRings/cloudbuilder/cryptoKeys/firebase-token
secretEnv:
FIREBASE_TOKEN: <EncryptedCiToken>
steps:
- id: 'npm install'
name: 'gcr.io/cloud-builders/npm'
args: ['install']
- id: 'functions npm install'
name: 'gcr.io/cloud-builders/npm'
args: ['install']
dir: 'functions'
- id: "deploy firebase"
name: 'gcr.io/$PROJECT_ID/firebase'
args: ['deploy', '--project=<projectName>']
# Deploy specific Firebase services
# (If you only want to deploy specific Firebase services or features)
#
# - id: "deploy firebase"
# name: 'gcr.io/$PROJECT_ID/firebase'
# args: ['deploy', '--only', 'functions', '--project=<projectName>']
#
# - id: "deploy firebase storage"
# name: 'gcr.io/$PROJECT_ID/firebase'
# args: ['deploy', '--only', 'storage', '--project=<projectName>']
# secretEnv: ['FIREBASE_TOKEN']
#
# - id: "deploy firebase firestore"
# name: 'gcr.io/$PROJECT_ID/firebase'
# args: ['deploy', '--only', 'firestore', '--project=<projectName>']
# secretEnv: ['FIREBASE_TOKEN']
#
# - id: "deploy firebase hosting"
# name: 'gcr.io/$PROJECT_ID/firebase'
# args: ['deploy', '--only', 'hosting', '--project=<projectName>']