Skip to content

Conversation

@taeold
Copy link
Contributor

@taeold taeold commented Oct 16, 2025

Key changes:

  • Added --format flag to functions:secrets:set command
  • Auto-detect JSON format from .json file extensions
  • Added format field to SecretParam interface for deploy-time handling
  • Use visible input() prompt for JSON secrets vs password() for regular secrets
  • Validate JSON format before storing in Secret Manager
  • Improved error messages with actionable commands for developers
  • Added non-interactive mode check with helpful error for missing secrets

Example usage:
$ firebase functions:secrets:set STRIPE_CONFIG --format=json --data-file config.json
$ cat config.json | firebase functions:secrets:set STRIPE_CONFIG --format=json

@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello @taeold, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the secret management capabilities for Firebase Functions by introducing robust support for JSON-formatted secrets. It streamlines the process of setting and validating complex secret values, improves the interactive and non-interactive user experience with clearer prompts and error messages, and ensures data integrity by validating JSON inputs before storage. These changes make it easier for developers to manage structured configuration data as secrets.

Highlights

  • JSON Secret Support: Introduced the ability to set secrets in JSON format, either explicitly via a new --format=json flag or implicitly by detecting .json file extensions when using --data-file.
  • Improved User Experience: Enhanced the interactive prompt for setting secrets, using a visible input() for JSON values and password() for regular strings. Also, improved error messages now provide actionable commands for developers, especially when dealing with invalid JSON or missing secrets in non-interactive mode.
  • Validation and Type Safety: Added client-side validation to ensure that values provided for JSON secrets are indeed valid JSON before being stored in Secret Manager. The SecretParam interface was updated to include a format field for better type handling during deployment.
  • Non-Interactive Mode Handling: Implemented a check for missing secrets in non-interactive mode, which now throws a FirebaseError with clear instructions and example commands to set the required secrets.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds support for JSON-formatted secrets in Firebase Functions, including a new --format flag for the functions:secrets:set command, auto-detection of JSON from file extensions, and appropriate handling during deployment. The changes are well-implemented, with improved error messages and prompts for a better developer experience. My feedback includes a critical fix for interactive JSON secret input to ensure it's visible, and a few minor suggestions to improve the clarity of error messages.

Key changes:
- Added --format flag to functions:secrets:set command
- Auto-detect JSON format from .json file extensions
- Added format field to SecretParam interface for deploy-time handling
- Use visible input() prompt for JSON secrets vs password() for regular secrets
- Validate JSON format before storing in Secret Manager
- Improved error messages with actionable commands for developers
- Added non-interactive mode check with helpful error for missing secrets

Example usage:
  firebase functions:secrets:set STRIPE_CONFIG --format=json --data-file config.json
  cat config.json | firebase functions:secrets:set STRIPE_CONFIG --format=json
@taeold taeold force-pushed the json-secrets-support branch from 8dc5984 to b6cb593 Compare October 16, 2025 21:58
- Include parse error message in JSON validation errors for better debugging
- Remove redundant --format=json flag from error suggestions (auto-detected from .json extension)
- Use consistent <file.json> placeholder instead of config.json in examples
- Implement custom secret reading logic to handle file/stdin/interactive input
- Keep all interactive secrets hidden using password() for security (including JSON)
- Include parse error message in JSON validation errors for better debugging
- Remove redundant --format=json flag from error suggestions (auto-detected from .json extension)
- Use consistent <file.json> placeholder instead of config.json in examples
- Keep all interactive secrets hidden using password() for security (including JSON)
@taeold
Copy link
Contributor Author

taeold commented Oct 16, 2025

/gemini review

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces valuable support for JSON-formatted secrets in Firebase Functions, including auto-detection from file extensions and improved error messaging. The implementation is well-structured. My feedback focuses on a couple of areas to enhance usability and maintainability: using a visible prompt for entering JSON secrets interactively and refactoring duplicated code for JSON validation.

Move validateJsonSecret to src/functions/secrets.ts to adhere to DRY principle and improve maintainability. This avoids duplicating the same validation logic and error messages across multiple files.
@taeold taeold requested a review from jhuleatt October 16, 2025 23:10
@taeold taeold enabled auto-merge (squash) October 17, 2025 00:49
@taeold taeold merged commit 795975c into master Oct 17, 2025
48 checks passed
@taeold taeold deleted the json-secrets-support branch October 17, 2025 01:00
@github-project-automation github-project-automation bot moved this from Approved [PR] to Done in [Cloud] Extensions + Functions Oct 17, 2025
TorbenWetter added a commit to TorbenWetter/firebase-tools that referenced this pull request Oct 23, 2025
…anager

PR firebase#9335 added a check that fails deployments in non-interactive mode
when secrets are required. However, it didn't verify whether those
secrets already exist in Secret Manager, causing deployments to fail
even when all secrets were properly configured.

This change queries Secret Manager before throwing the error to check
if each required secret exists. Only truly missing secrets will cause
the deployment to fail.

Fixes firebase#9368
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants