flow-envision

Envision <> Flow web application. Two pages live in this repo:

• public/index.html — Flow-Envision Development Workflow (org chart + workflow viewer). This is the canonical entry point served by Firebase Hosting (firebase.json rewrites all paths to /index.html).
• index.html (root) — Cash-flow forecasting page (Firestore-backed, writes to a Google Apps Script endpoint). Currently NOT routed in production; kept as the source-of-truth until/unless it is moved into public/.

Stack

• Static HTML + Tailwind via CDN (cdn.tailwindcss.com).
• Firebase JS SDK 9.22.0 (CDN ESM imports) — Firestore for the cash-flow page.
• Google Apps Script as a thin write-backend for the cash-flow page.
• Hosting: Firebase Hosting (public/ is the publish root).

Deploy

Pushes to main trigger .github/workflows/firebase-deploy.yml, which:

1. Generates config.js from GitHub repo secrets (see below).
2. Installs firebase-tools.
3. Runs firebase deploy --only hosting.

There is no Express server, no Railway, no build step.

Required GitHub repo secrets

Set under Settings → Secrets and variables → Actions:

Secret	Purpose
FIREBASE_TOKEN	Auth token for firebase deploy (CI).
FIREBASE_PROJECT_ID	Firebase project to deploy to.
GOOGLE_SCRIPT_URL	Apps Script /exec URL for the cash-flow write endpoint.
FIREBASE_API_KEY	Firebase Web API key (used by browser SDK).
FIREBASE_AUTH_DOMAIN	e.g. your-project.firebaseapp.com.
FIREBASE_STORAGE_BUCKET	e.g. your-project.appspot.com.
FIREBASE_MESSAGING_SENDER_ID	Firebase sender id.
FIREBASE_APP_ID	Firebase web app id.

The CI step writes these into a generated config.js (gitignored) that the cash-flow index.html reads via window.APP_CONFIG.

Local development

cp config.example.js config.js          # then fill in real values
npx serve .                             # or any static server

config.js is gitignored — never commit real values.

Security notes

• config.js MUST stay gitignored.
• The Firebase web API key is technically not secret, but the project should be locked down via Firebase Console security rules + App Check.
• The GOOGLE_SCRIPT_URL IS secret-equivalent (the deployment ID is the auth); rotate it whenever it appears in git history or in a leak.