setup-firebase-hosting

No direct evidence of sabotage/malware (e.g., reverse shell, hidden backdoor, obfuscated payloads, or exfiltration to non-Google domains) is present in the provided fragment. The code is a legitimate-but-sensitive provisioning/CI bootstrap flow: it creates/rotates GCP service account keys and uploads the key to a GitHub Secret for deployment. The main security concern is the high impact of credential handling; if the script or its inputs are compromised, service account keys could be exposed via the GitHub Secret sink. Overall: likely benign automation with sensitive side effects; further review of the full repository/script (especially helper functions and any earlier/later code not shown) is recommended.