Home

安全發布（Web + Firebase Hosting） / Secure Release (Web + Firebase Hosting)

重點原則 / Security Principles

• 不要把任何 API 金鑰、Token、Service Account JSON 放進 GitHub。
  Never commit API keys, tokens, or service account JSON files to GitHub.
• Flutter Web 前端可被反編譯，--dart-define=OPENAI_API_KEY=... 會外洩。
  Flutter Web is client-side; API keys passed via --dart-define are exposed.
• 本流程預設「不在前端注入機密」。
  This flow intentionally does not inject secrets into frontend.

---

一鍵發布指令（安全優先） / One-Command Secure Release

set -euo pipefail

cd /Users/Leo/Documents/sharpface

echo "== 0) Precheck =="
flutter --version
firebase --version

echo "== 1) Ensure secret files are ignored by Git =="
grep -q '^\.env$' .gitignore || echo '.env' >> .gitignore
grep -q '^\.env\..*$' .gitignore || echo '.env.*' >> .gitignore
grep -q '^firebase-adminsdk.*\.json$' .gitignore || echo 'firebase-adminsdk*.json' >> .gitignore
grep -q '^*serviceAccount*.json$' .gitignore || echo '*serviceAccount*.json' >> .gitignore

echo "== 2) Secret scan before release =="
if rg -n --hidden -S "(OPENAI_API_KEY|sk-[A-Za-z0-9]{20,}|BEGIN PRIVATE KEY|PRIVATE KEY|firebase-adminsdk)" \
  -g '!build/**' -g '!.dart_tool/**' -g '!coverage/**' -g '!.git/**' . ; then
  echo "❌ Potential secret detected. Remove it before release."
  exit 1
fi

echo "== 3) Quality gates =="
flutter pub get
flutter analyze
flutter test --coverage

echo "== 4) Build web (NO secret injection) =="
flutter build web --release --dart-define=OPENAI_API_KEY=

echo "== 5) Select Firebase project =="
firebase use <YOUR_FIREBASE_PROJECT_ID>

echo "== 6) Deploy hosting + firestore rules/indexes =="
firebase deploy --only hosting,firestore:rules,firestore:indexes

echo "✅ Secure release completed"

---

發布前檢查清單 / Pre-Release Checklist

• Git history 與目前檔案中無 API key / private key
• .gitignore 已包含 .env* 與 service account JSON 規則
• flutter analyze 通過
• flutter test --coverage 通過
• 使用正式 Firebase 專案 ID 部署
• Firestore Rules/Indexes 已同步部署