Deployment of functions using a secret fails with 10.6.0

[gpfister]

[REQUIRED] Environment info

firebase-tools: 10.6.0

Platform: Ubuntu (Bitbucket pipeline)

[REQUIRED] Test case

Deploy a Cloud Function which requires a secret.

[REQUIRED] Steps to reproduce

Here's an example of functions:

export const onContactMessageCreated = functions
  .region('europe-west1')
  .runWith({ secrets: ['MYSECRET'] })
  .firestore.document('/contactMessages/{contactMessageId}')
  .onCreate(handleContactMessageCreation);

Then deploy it:

firebase deploy

[REQUIRED] Expected behavior

Successful deployment

[REQUIRED] Actual behavior

The deployment fails with an unknown error. Here are the debug log (firebase-debug-log):

[debug] [2022-04-06T16:10:30.866Z] Pruning secrets to find unused secret versions...
[debug] [2022-04-06T16:10:30.866Z] >>> [apiv2][query] GET https://secretmanager.googleapis.com/v1/projects/oskey-dev/secrets filter=labels.firebase-managed%3Dtrue
[debug] [2022-04-06T16:10:30.921Z] <<< [apiv2][status] GET https://secretmanager.googleapis.com/v1/projects/oskey-dev/secrets 200
[debug] [2022-04-06T16:10:30.921Z] <<< [apiv2][body] GET https://secretmanager.googleapis.com/v1/projects/oskey-dev/secrets {}
[debug] [2022-04-06T16:10:30.922Z] TypeError: res.body.secrets is not iterable
    at listSecrets (/opt/atlassian/pipelines/agent/build/node_modules/firebase-tools/lib/gcp/secretManager.js:36:34)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async Object.pruneSecrets (/opt/atlassian/pipelines/agent/build/node_modules/firebase-tools/lib/functions/secrets.js:103:25)
    at async Object.pruneAndDestroySecrets (/opt/atlassian/pipelines/agent/build/node_modules/firebase-tools/lib/functions/secrets.js:142:27)
    at async release (/opt/atlassian/pipelines/agent/build/node_modules/firebase-tools/lib/deploy/functions/release/index.js:70:34)
[error] 
[error] Error: An unexpected error has occurred.

It is working with firebase-tools@10.5.0, so I would assume this is a regression from a change released with 10.6.0 (#4130). The function was already deployed once, the secret hasn't changed and is still there.

[inlined]

Thanks for linking this to the likely culprit. We will fix this in our next release, which should come out early next week. As a workaround you can just add a random secret to your project.

[gpfister]

I'm not sure the workaround suggested works, there's already a secret in my project. Actually, deploying objects that don't require a secret works fine on 10.6.0.

Also I don't quite see the point of cleaning up secret automatically (personnaly I would rather keep this as a side cloud admin activity).

[inlined]

This issue should be fixed. If the secret is created with gcloud or the Cloud Console then Firebase should not clean up versions for you. We check for the firebase-managed label.

[nmhernandez10]

This issue should not have been closed. This error still happens using firebase-tools 10.6.0 or above. We have to use firebase-tools 10.5.0 in order to deploy functions with secrets correctly.

[NicWickman]

This release (and later) broke my deployments.

firebase deploy --only hosting works for me fine on 10.6.0 in a project with no cloud functions at all, both from github CI workflows and locally.

Starting at this release, the deployment fails with

$ firebase deploy --only hosting

=== Deploying to '<project>'...

i  deploying hosting

Error: Failed to list functions for <project>

[colerogers]

@nmhernandez10 Apologies, we should have pushed a fix in the latest release 10.9.2.

I'm going to mark this issue closed.

@NicWickman that does not look related to secrets, please open a new issue with steps to reproduce. Thanks