Merge branch 'master' into hsinpei/database-chunk-4

Author: tohhsinpei

CHANGELOG.md

@@ -1,7 +1,2 @@
-- Releases Firestore Emulator 1.17.1
-  - Propagates page token from ListDocumentsResponse to GetOrListDocumentsResponse in Firestore emulator.
-- Fixes an issue where Secret Manager secrets were tagged incorrectly (#5704).
-- Fix bug where Custom Event channels weren't automatically crated on function deploys (#5700)
-- Lift GCF 2nd gen naming restrictions (#5690)
-- Fixes a bug where `ext:install` and `ext:configure` would error on extensions with no params.
-- Fixed an issue with Vite and Angular integrations using a obsolete NPM command (#5710)
+- Added more helpful error messages for the Firebase Hosting GitHub Action (#5749)
+- Upgrade Firestore emulator to 1.17.4

npm-shrinkwrap.json

@@ -1,6 +1,6 @@
 {
   "name": "firebase-tools",
-  "version": "11.28.0",
+  "version": "11.29.1",
   "description": "Command-Line Interface for Firebase",
   "main": "./lib/index.js",
   "bin": {

package.json

@@ -86,6 +86,12 @@ export const command = new Command("hosting:channel:deploy [channelId]")
           .split(",")
           .map((o: string) => `hosting:${o}`)
           .join(",");
+      } else {
+        // N.B. The hosting deploy code uses the only string to add all (and only)
+        // functions that are pinned to the only string. If we didn't set the
+        // only string here and only used the hosting deploy targets, we'd only
+        // be able to deploy *all* functions.
+        options.only = "hosting";
       }
 
       const sites: ChannelInfo[] = hostingConfig(options).map((config) => {

src/commands/hosting-channel-deploy.ts

@@ -55,8 +55,8 @@ const secretsInSpec = (spec: ExtensionSpec): Param[] => {
 };
 
 async function handleSecretsCreateInstance(i: DeploymentInstanceSpec, nonInteractive: boolean) {
-  const extensionVersion = await getExtensionVersion(i);
-  const secretParams = secretsInSpec(extensionVersion.spec);
+  const spec = await getExtensionSpec(i);
+  const secretParams = secretsInSpec(spec);
   for (const s of secretParams) {
     await handleSecretParamForCreate(s, i, nonInteractive);
   }

src/deploy/extensions/secrets.ts

@@ -36,6 +36,9 @@ import { generateServiceIdentity } from "../../gcp/serviceusage";
 import { applyBackendHashToBackends } from "./cache/applyHash";
 import { allEndpoints, Backend } from "./backend";
 import { assertExhaustive } from "../../functional";
+import { isRunningInGithubAction } from "../../init/features/hosting/github";
+import { firebaseRoles } from "../../gcp/resourceManager";
+import { requirePermissions } from "../../requirePermissions";
 
 export const EVENTARC_SOURCE_ENV = "EVENTARC_CLOUD_EVENT_SOURCE";
 function hasUserConfig(config: Record<string, unknown>): boolean {
@@ -55,6 +58,15 @@ export async function prepare(
   const projectId = needProjectId(options);
   const projectNumber = await needProjectNumber(options);
 
+  // Fail early if we're running in our Github Action and don't have permission
+  if (isRunningInGithubAction()) {
+    await requirePermissions(options, [firebaseRoles.functionsDeveloper]).catch(() => {
+      throw new FirebaseError(
+        "Please reinstall the Github Action with `firebase init hosting:github` to grant this project the required permissions to deploy Cloud Functions."
+      );
+    });
+  }
+
   context.config = normalizeAndValidate(options.config.src.functions);
   context.filters = getEndpointFilters(options); // Parse --only filters for functions.
 

src/deploy/functions/prepare.ts

@@ -5,8 +5,11 @@ import * as deploymentTool from "../../deploymentTool";
 import { Context } from "./context";
 import { Options } from "../../options";
 import { HostingOptions } from "../../hosting/options";
-import { zipIn } from "../../functional";
+import { assertExhaustive, zipIn } from "../../functional";
 import { track } from "../../track";
+import * as utils from "../../utils";
+import { HostingSource } from "../../firebaseConfig";
+import * as backend from "../functions/backend";
 
 /**
  *  Prepare creates versions for each Hosting site to be deployed.
@@ -34,6 +37,12 @@ export async function prepare(context: Context, options: HostingOptions & Option
       if (config.webFramework) {
         labels["firebase-web-framework"] = config.webFramework;
       }
+      const unsafe = await unsafePins(context, config);
+      if (unsafe.length) {
+        const msg = `Cannot deploy site ${config.site} to channel ${context.hostingChannel} because it would modify one or more rewrites in "live" that are not pinned, breaking production. Please pin "live" before pinning other channels.`;
+        utils.logLabeledError("Hosting", msg);
+        throw new Error(msg);
+      }
       const version: Omit<api.Version, api.VERSION_OUTPUT_FIELDS> = {
         status: "CREATED",
         labels,
@@ -52,3 +61,73 @@ export async function prepare(context: Context, options: HostingOptions & Option
     context.hosting.deploys.push({ config, version });
   }
 }
+
+function rewriteTarget(source: HostingSource): string {
+  if ("glob" in source) {
+    return source.glob;
+  } else if ("source" in source) {
+    return source.source;
+  } else if ("regex" in source) {
+    return source.regex;
+  } else {
+    assertExhaustive(source);
+  }
+}
+
+/**
+ * Returns a list of rewrite targets that would break in prod if deployed.
+ * People use tag pinning so that they can deploy to preview channels without
+ * modifying production. This assumption is violated if the live channel isn't
+ * actually pinned. This method returns "unsafe" pins, where we're deploying to
+ * a non-live channel with a rewrite that is pinned but haven't yet pinned live.
+ */
+export async function unsafePins(
+  context: Context,
+  config: config.HostingResolved
+): Promise<string[]> {
+  // Overwriting prod won't break prod
+  if ((context.hostingChannel || "live") === "live") {
+    return [];
+  }
+
+  const targetTaggedRewrites: Record<string, string> = {};
+  for (const rewrite of config.rewrites || []) {
+    const target = rewriteTarget(rewrite);
+    if ("run" in rewrite && rewrite.run.pinTag) {
+      targetTaggedRewrites[target] = `${rewrite.run.region || "us-central1"}/${
+        rewrite.run.serviceId
+      }`;
+    }
+    if ("function" in rewrite && typeof rewrite.function === "object" && rewrite.function.pinTag) {
+      const region = rewrite.function.region || "us-central1";
+      const endpoint = (await backend.existingBackend(context)).endpoints[region]?.[
+        rewrite.function.functionId
+      ];
+      // This function is new. It can't be pinned elsewhere
+      if (!endpoint) {
+        continue;
+      }
+      targetTaggedRewrites[target] = `${region}/${endpoint.runServiceId || endpoint.id}`;
+    }
+  }
+
+  if (!Object.keys(targetTaggedRewrites).length) {
+    return [];
+  }
+
+  const channelConfig = await api.getChannel(context.projectId, config.site, "live");
+  const existingUntaggedRewrites: Record<string, string> = {};
+  for (const rewrite of channelConfig?.release?.version?.config?.rewrites || []) {
+    if ("run" in rewrite && !rewrite.run.tag) {
+      existingUntaggedRewrites[
+        rewriteTarget(rewrite)
+      ] = `${rewrite.run.region}/${rewrite.run.serviceId}`;
+    }
+  }
+
+  // There is only a problem if we're targeting the same exact run service but
+  // live isn't tagged.
+  return Object.keys(targetTaggedRewrites).filter(
+    (target) => targetTaggedRewrites[target] === existingUntaggedRewrites[target]
+  );
+}

src/deploy/hosting/prepare.ts

@@ -17,8 +17,6 @@ import * as RemoteConfigTarget from "./remoteconfig";
 import * as ExtensionsTarget from "./extensions";
 import { prepareFrameworks } from "../frameworks";
 import { HostingDeploy } from "./hosting/context";
-import { requirePermissions } from "../requirePermissions";
-import { TARGET_PERMISSIONS } from "../commands/deploy";
 
 const TARGETS = {
   hosting: HostingTarget,
@@ -62,18 +60,8 @@ export const deploy = async function (
   if (targetNames.includes("hosting")) {
     const config = options.config.get("hosting");
     if (Array.isArray(config) ? config.some((it) => it.source) : config.source) {
-      experiments.assertEnabled("webframeworks", "deploy a web framework to hosting");
-      const usedToTargetFunctions = targetNames.includes("functions");
+      experiments.assertEnabled("webframeworks", "deploy a web framework from source");
       await prepareFrameworks(targetNames, context, options);
-      const nowTargetsFunctions = targetNames.includes("functions");
-      if (nowTargetsFunctions && !usedToTargetFunctions) {
-        if (context.hostingChannel && !experiments.isEnabled("pintags")) {
-          throw new FirebaseError(
-            "Web frameworks with dynamic content do not yet support deploying to preview channels"
-          );
-        }
-        await requirePermissions(TARGET_PERMISSIONS["functions"]);
-      }
     }
   }
 

src/deploy/index.ts

@@ -33,9 +33,9 @@ const EMULATOR_UPDATE_DETAILS: { [s in DownloadableEmulators]: EmulatorUpdateDet
     expectedChecksum: "311609538bd65666eb724ef47c2e6466",
   },
   firestore: {
-    version: "1.17.1",
-    expectedSize: 64778399,
-    expectedChecksum: "108789dc93092c45b9e04a074e3238ce",
+    version: "1.17.4",
+    expectedSize: 64969580,
+    expectedChecksum: "9d580b58e55e57b0cdc3ca8888098d43",
   },
   storage: {
     version: "1.1.3",

src/emulator/downloadableEmulators.ts

@@ -1,8 +1,10 @@
-import { bold } from "colorette";
+import { bold, italic } from "colorette";
 import * as leven from "leven";
+import { basename } from "path";
 
 import { configstore } from "./configstore";
 import { FirebaseError } from "./error";
+import { isRunningInGithubAction } from "./init/features/hosting/github";
 
 export interface Experiment {
   shortDescription: string;
@@ -192,11 +194,28 @@ export function enableExperimentsFromCliEnvVariable(): void {
  */
 export function assertEnabled(name: ExperimentName, task: string): void {
   if (!isEnabled(name)) {
-    throw new FirebaseError(
-      `Cannot ${task} because the experiment ${bold(name)} is not enabled. To enable ${bold(
-        name
-      )} run ${bold(`firebase experiments:enable ${name}`)}`
-    );
+    const prefix = `Cannot ${task} because the experiment ${bold(name)} is not enabled.`;
+    if (isRunningInGithubAction()) {
+      const path = process.env.GITHUB_WORKFLOW_REF?.split("@")[0];
+      const filename = path ? `.github/workflows/${basename(path)}` : "your action's yml";
+      const newValue = [process.env.FIREBASE_CLI_EXPERIMENTS, name].filter((it) => !!it).join(",");
+      throw new FirebaseError(
+        `${prefix} To enable add a ${bold(
+          "FIREBASE_CLI_EXPERIMENTS"
+        )} environment variable to ${filename}, like so: ${italic(`
+
+- uses: FirebaseExtended/action-hosting-deploy@v0
+  with:
+    ...
+  env:
+    FIREBASE_CLI_EXPERIMENTS: ${newValue}
+`)}`
+      );
+    } else {
+      throw new FirebaseError(
+        `${prefix} To enable ${bold(name)} run ${bold(`firebase experiments:enable ${name}`)}`
+      );
+    }
   }
 }