Skip to content

fix: support secret environment variables for Cloud Run functions - #10489

Merged
demolaf merged 6 commits into
firebase:mainfrom
invertase:fix/secrets-cloud-run-platform
May 13, 2026
Merged

fix: support secret environment variables for Cloud Run functions#10489
demolaf merged 6 commits into
firebase:mainfrom
invertase:fix/secrets-cloud-run-platform

Conversation

@demolaf

@demolaf demolaf commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Dart functions (and any language deploying as Cloud Run services) use platform=run. The secretsSupportedPlatforms allowlist in validate.ts only included gcfv1 and gcfv2, causing deploys with secrets to fail with:

Tried to set secret environment variables on [platform=run]. Only gcfv1, gcfv2 support secret environments.

Fix

Add "run" to secretsSupportedPlatforms.

Known limitations

Secret rotation (firebase functions:secrets:set) is not yet supported for Cloud Run functions.
The following code in src/functions/secrets.ts still throws for platform=run:
https://github.com/firebase/firebase-tools/blob/main/src/functions/secrets.ts#L382-L385

} else if (endpoint.platform === "run") {
  // This may be tricky because the image has been deleted. How does this work
  // with GCF?
  throw new FirebaseError("Updating Cloud Run functions is not yet implemented.");
}

Related

@demolaf
demolaf marked this pull request as draft May 12, 2026 12:02
gemini-code-assist[bot]
gemini-code-assist Bot reviewed May 12, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds the "run" platform to the list of supported platforms for secrets during deployment validation. Feedback indicates that while this change enables validation, the overall support for secrets on the "run" platform remains incomplete in other parts of the codebase, such as secret updates. Additionally, it is recommended to use a central constant for platform lists to improve maintainability.

Comment thread src/deploy/functions/validate.ts Outdated
@codecov-commenter

codecov-commenter commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@dae4e46). Learn more about missing BASE report.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main   #10489   +/-   ##
=======================================
  Coverage        ?   57.08%           
=======================================
  Files           ?      599           
  Lines           ?    38025           
  Branches        ?     7682           
=======================================
  Hits            ?    21707           
  Misses          ?    14550           
  Partials        ?     1768

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@demolaf
demolaf force-pushed the fix/secrets-cloud-run-platform branch from 513725f to 1e43d0f Compare May 12, 2026 12:13
@demolaf demolaf mentioned this pull request May 12, 2026
Closed
@demolaf
demolaf marked this pull request as ready for review May 12, 2026 12:59
@demolaf
demolaf requested a review from ajperel May 12, 2026 12:59
@cabljac
cabljac self-requested a review May 12, 2026 13:26
@demolaf
demolaf force-pushed the fix/secrets-cloud-run-platform branch from 014f113 to f131e80 Compare May 13, 2026 09:19
ajperel
ajperel approved these changes May 13, 2026
View reviewed changes

@ajperel ajperel left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't hurt to add a test, but I think the code change makes sense. Thanks for the update.

@demolaf

demolaf commented May 13, 2026

Copy link
Copy Markdown
Member Author

Wouldn't hurt to add a test, but I think the code change makes sense. Thanks for the update.

I'll add tests now

@demolaf
demolaf force-pushed the fix/secrets-cloud-run-platform branch from a4f2cb7 to 4becdc6 Compare May 13, 2026 18:12
@demolaf
demolaf enabled auto-merge (squash) May 13, 2026 18:26
@demolaf
demolaf merged commit 70e2771 into firebase:main May 13, 2026
48 checks passed
bkendall pushed a commit that referenced this pull request Jul 9, 2026
@demolaf @bkendall
fix: support secret environment variables for Cloud Run functions (#1…
01d7357 
…0489)

* fix: support secret environment variables for Cloud Run (platform=run) functions

* fix: use backend.AllFunctionsPlatforms

* lint errors

* test: add validation for Cloud Run functions with secret environment variables
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ajperel ajperel ajperel approved these changes
@cabljac cabljac Awaiting requested review from cabljac
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@demolaf @codecov-commenter @ajperel @cabljac