{
  "id": 5855414,
  "title": "A Free, Practical CI/CD Pipeline for Flutter Web on Firebase Hosting",
  "url": "https://urgent.news/2026/09/05/a-free-practical-ci-cd-pipeline-for-flutter-web-on-firebase-hosting",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-05T22:52:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/devshakib/a-free-practical-cicd-pipeline-for-flutter-web-on-firebase-hosting-4k1e"
  },
  "original_language": "en",
  "account": "For approximately a year, the author's deployment process for their portfolio site involved a three-step ritual: running `flutter build web`, hoping for the best, and using `firebase deploy`. This approach often worked, but an incident in Abu Dhabi highlighted its risks. A dropped Wi-Fi connection during a deployment caused a half-deployed site with a blank white screen to go live for four hours before the author could fix it. This experience prompted the author to rethink their deployment strategy.\n\nThe author migrated their deployment pipeline to GitHub Actions, leveraging Firebase Hosting's features to create a practical, free CI/CD solution. The resulting setup includes a single GitHub Actions workflow that builds the Flutter web app, caches dependencies for faster subsequent builds, generates a preview URL for every pull request, and automatically deploys to production upon merge. This solution costs $0/month, as both GitHub Actions and Firebase Hosting's free quotas are ample for this use case.\n\nThe key advantages of this pipeline are threefold. First, automating deployment eliminates the human error that can occur during manual processes, especially when the person deploying is distracted, fatigued, or working under less-than-ideal conditions. Automated deployments run consistently, on clean machines, and refuse deployments that don't meet the required criteria. Second, a preview URL for each pull request allows developers to review changes in a production-identical environment, catching issues that might otherwise go unnoticed. This immediate feedback loop improves code quality and reduces the impact of bugs. Third, continuous deployment reduces the batch size of changes, allowing for more frequent, smaller, and reversible deployments. This approach aligns with DevOps principles, making deployments safer and more manageable, even for small projects like a personal portfolio site.\n\nThe pipeline consists of two main triggers: pull requests and pushes to the main branch. For pull requests, the workflow builds the app and deploys it to a temporary preview channel, then posts the preview URL back into the PR for immediate review. Production remains unaffected until a push to the main branch occurs, at which point the app is built and deployed to the live channel. Firebase Hosting's preview channels provide isolated, full deployments for each pull request without additional infrastructure costs or setup.\n\nFirebase Hosting's preview channels are a particularly valuable feature. They offer a full, isolated deployment accessible via a subdomain like `your-site--pr-42-abc123.web.app`. These channels respect the same configuration as production, including rewrite rules, headers, and clean URLs, ensuring that any configuration issues are caught during the preview phase. This feature is especially useful for testing SPA routing, as it exercises the same rewrite rules that will be in effect for live users.\n\nTo set up this pipeline securely, the author recommends using a service account with scoped permissions instead of baking a long-lived Firebase token into the CI workflow. This service account should be given only the necessary Firebase Hosting Admin role, minimizing the blast radius if the key is ever compromised. The Firebase CLI simplifies this process, allowing the creation of a service account, provisioning it with the minimum required permissions, and storing the JSON key in a GitHub Actions secret. This approach ensures that the deployment identity is as limited as possible, maintaining the principle of least privilege and enhancing overall security.",
  "summary": "For about a year, my \"deploy process\" for my portfolio site was a three-step ritual: flutter build web , cross my fingers, firebase deploy . It mostly worked, which is the dangerous part. Then one evening I shipped a build from a hotel in Abu Dhabi over Wi-Fi that dropped mid-upload, went to dinner, and left a half-deployed, blank-white-screen site live for about four hours. Nobody died. But a…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}