Add firebase deploy --only run for remote Cloud Build source deploys

src/checkValidTargetFilters.ts

@@ -32,6 +32,7 @@ const FILTERABLE_TARGETS = new Set([
   "dataconnect",
   "apphosting",
   "ailogic",
+  "run",
 ]);
 
 /**

src/commands/deploy.ts

@@ -23,7 +23,7 @@
 }
 
 function getDeployHelp(): string {
   const boldFn = (str: string) => clc.bold(str);
 
   let targetHelp = "Deploy targets include:\n\n";
   for (const [targetName, target] of Object.entries(TARGETS)) {
@@ -88,6 +88,9 @@
     if (options.filteredTargets.includes("ailogic")) {
       experiments.assertEnabled("ailogic", "deploy AI Logic resources");
     }
+    if (options.filteredTargets.includes("run")) {
+      experiments.assertEnabled("directcloudrun", "deploy Cloud Run services");
+    }
     const permissions = options.filteredTargets.reduce((perms: string[], target: string) => {
       return perms.concat(TARGET_PERMISSIONS[target as (typeof VALID_DEPLOY_TARGETS)[number]]);
     }, []);
@@ -95,7 +98,7 @@
   })
   .before((options: Options) => {
     if (options.filteredTargets.includes("functions")) {
       return checkServiceAccountIam(options.project!);
     }
   })
   .before(async (options: Options) => {
@@ -131,10 +134,10 @@
       }
       logBullet("No Hosting site detected.");
       const siteId = await pickHostingSiteName("", options);
       await createSite(options.project!, siteId);
     }
   })
   .before(checkValidTargetFilters)
   .action((options) => {
     return deploy(options.filteredTargets, options);
   });

src/deploy/index.ts

@@ -20,6 +20,8 @@
 import * as AppHostingTarget from "./apphosting";
 import * as AuthTarget from "./auth";
 import * as AiLogicTarget from "./ailogic";
+import * as RunTarget from "./run";
+import { RUN_PERMISSIONS } from "./run/prereqs";
 import { prepareFrameworks } from "../frameworks";
 import { Context as HostingContext } from "./hosting/context";
 import { addPinnedFunctionsToOnlyString, hasPinnedFunctions } from "./hosting/prepare";
@@ -44,6 +46,7 @@
   "apphosting",
   "auth",
   "ailogic",
+  "run",
 ] as const;
 
 export const TARGET_PERMISSIONS: Record<(typeof VALID_DEPLOY_TARGETS)[number], string[]> = {
@@ -105,6 +108,7 @@
     // ensureAILogicApiEnabled reads API enablement state via Service Usage.
     "serviceusage.services.get",
   ],
+  run: RUN_PERMISSIONS,
 };
 
 export const TARGETS = {
@@ -119,13 +123,14 @@
   apphosting: AppHostingTarget,
   auth: AuthTarget,
   ailogic: AiLogicTarget,
+  run: RunTarget,
 };
 
 export type DeployOptions = Options & { dryRun?: boolean };
 
 type Chain = ((context: any, options: any, payload: any) => Promise<unknown>)[];
 
 const chain = async function (fns: Chain, context: any, options: any, payload: any): Promise<void> {
   for (const latest of fns) {
     await latest(context, options, payload);
   }

src/deploy/run/args.ts

@@ -0,0 +1,22 @@
+import { RunSingle } from "../../firebaseConfig";
+import * as runv2 from "../../gcp/runv2";
+
+/** A service being deployed. prepare fills in the first fields, and deploy sets `deployed`. */
+export interface ServiceDeploy {
+  config: RunSingle;
+  /** The service as it is in Cloud Run before this deploy, or undefined if it doesn't exist yet. */
+  existing?: runv2.Service;
+  baseImage?: string;
+  /** The service after the rollout. */
+  deployed?: runv2.Service;
+}
+
+export interface Payload {
+  run?: { services: ServiceDeploy[] };
+}
+
+export interface Context {
+  projectId: string;
+  /** Overrides the service's base image. null clears it; undefined keeps the current one. */
+  baseImage?: string | null;
+}

src/deploy/run/deploy.spec.ts

@@ -0,0 +1,171 @@
+import { expect } from "chai";
+import * as fs from "fs";
+import * as sinon from "sinon";
+import * as artifactregistry from "../../gcp/artifactregistry";
+import * as runv2 from "../../gcp/runv2";
+import * as gcs from "../../gcp/storage";
+import * as getProjectNumber from "../../getProjectNumber";
+import { Options } from "../../options";
+import * as apphostingUtil from "../apphosting/util";
+import { ServiceDeploy } from "./args";
+import { deploy, revisionTemplate } from "./deploy";
+
+const NODEJS22 = "us-central1-docker.pkg.dev/serverless-runtimes/google-22/runtimes/nodejs22";
+const DEPLOY_MESSAGE = "firebase.google.com/deploy-message";
+
+describe("run deploy", () => {
+  const options = { config: { projectDir: "/project" } } as unknown as Options;
+  const web = { serviceId: "web", region: "us-central1", rootDir: "apps/web" };
+  // Date.now() is stubbed to return 42, which tags the image.
+  const image = "us-central1-docker.pkg.dev/my-project/cloud-run-source-deploy/web:42";
+  let createArchiveStub: sinon.SinonStub;
+  let submitBuildStub: sinon.SinonStub;
+  let createServiceStub: sinon.SinonStub;
+  let updateServiceStub: sinon.SinonStub;
+
+  beforeEach(() => {
+    sinon.stub(getProjectNumber, "getProjectNumber").resolves("123");
+    sinon.stub(gcs, "upsertBucket").resolves("source-bucket");
+    createArchiveStub = sinon
+      .stub(apphostingUtil, "createSourceDeployArchive")
+      .resolves("/tmp/web.zip");
+    sinon.stub(fs, "createReadStream").returns("stream" as unknown as fs.ReadStream);
+    sinon
+      .stub(gcs, "uploadObject")
+      .resolves({ bucket: "source-bucket", object: "web.zip", generation: "1" });
+    sinon.stub(artifactregistry, "ensureDockerRepository").resolves();
+    submitBuildStub = sinon.stub(runv2, "submitBuild").resolves();
+    const deployed = { uri: "https://web.run.app" } as runv2.Service;
+    createServiceStub = sinon.stub(runv2, "createService").resolves(deployed);
+    updateServiceStub = sinon.stub(runv2, "updateService").resolves(deployed);
+    sinon.stub(Date, "now").returns(42);
+  });
+
+  afterEach(() => sinon.restore());
+
+  async function deployOne(svc: ServiceDeploy): Promise<ServiceDeploy> {
+    await deploy({ projectId: "my-project" }, options, { run: { services: [svc] } });
+    return svc;
+  }
+
+  it("uploads the source, builds it, and creates a public service", async () => {
+    const svc = await deployOne({ config: web, baseImage: NODEJS22 });
+
+    expect(createArchiveStub).to.have.been.calledWithMatch(
+      { backendId: "web" },
+      "/project/apps/web",
+    );
+    expect(submitBuildStub).to.have.been.calledWithMatch("my-project", "us-central1", {
+      storageSource: { bucket: "source-bucket", object: "web.zip" },
+      imageUri: image,
+      buildpackBuild: { baseImage: NODEJS22, enableAutomaticUpdates: true },
+    });
+    expect(createServiceStub).to.have.been.calledWithMatch("my-project", "us-central1", "web", {
+      template: { containers: [{ name: "web", image, baseImageUri: NODEJS22 }] },
+      invokerIamDisabled: true,
+      ingress: "INGRESS_TRAFFIC_ALL",
+    });
+    expect(svc.deployed).to.deep.equal({ uri: "https://web.run.app" });
+  });
+
+  it("builds without a base image if the service doesn't have one", async () => {
+    await deployOne({ config: web });
+
+    // Without a base image, Cloud Build can't turn on automatic base image updates.
+    const { buildpackBuild } = submitBuildStub.firstCall.args[2];
+    expect(buildpackBuild).not.to.have.property("baseImage");
+    expect(buildpackBuild).not.to.have.property("enableAutomaticUpdates");
+  });
+
+  it("rolls out a new revision of an existing service with all traffic, keeping its tags", async () => {
+    const existing = {
+      name: "projects/my-project/locations/us-central1/services/web",
+      template: { revision: "web-001", containers: [{ name: "web", image: "old-image" }] },
+      traffic: [
+        { type: "TRAFFIC_TARGET_ALLOCATION_TYPE_REVISION", revision: "web-001", percent: 90 },
+        {
+          type: "TRAFFIC_TARGET_ALLOCATION_TYPE_REVISION",
+          revision: "web-000",
+          tag: "preview",
+          percent: 10,
+        },
+      ],
+    } as unknown as runv2.Service;
+
+    await deployOne({ config: web, existing });
+
+    expect(createServiceStub).not.to.have.been.called;
+    expect(updateServiceStub).to.have.been.calledOnceWithExactly(
+      {
+        name: "projects/my-project/locations/us-central1/services/web",
+        template: { containers: [{ name: "web", image }] },
+        traffic: [
+          { type: "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST", percent: 100 },
+          { type: "TRAFFIC_TARGET_ALLOCATION_TYPE_REVISION", revision: "web-000", tag: "preview" },
+        ],
+      },
+      { updateMask: ["template", "traffic"], pollTimeoutMs: 10 * 60 * 1000 },
+    );
+  });
+
+  describe("revisionTemplate", () => {
+    const existing = {
+      name: "projects/my-project/locations/us-central1/services/web",
+      template: {
+        revision: "web-001",
+        serviceAccount: "web@my-project.iam.gserviceaccount.com",
+        annotations: { team: "frontend", [DEPLOY_MESSAGE]: "Last deploy" },
+        containers: [
+          {
+            name: "web",
+            image: "old-image",
+            baseImageUri: NODEJS22,
+            env: [{ name: "MODE", value: "prod" }],
+          },
+        ],
+      },
+    } as unknown as runv2.Service;
+
+    it("starts a new service with just the image", () => {
+      expect(revisionTemplate({ config: web }, image)).to.deep.equal({
+        containers: [{ name: "web", image }],
+      });
+    });
+
+    it("keeps the live revision's settings, but not its name", () => {
+      const template = revisionTemplate({ config: web, existing, baseImage: NODEJS22 }, image);
+
+      expect(template).to.deep.equal({
+        serviceAccount: "web@my-project.iam.gserviceaccount.com",
+        annotations: { team: "frontend" },
+        containers: [
+          { name: "web", image, baseImageUri: NODEJS22, env: [{ name: "MODE", value: "prod" }] },
+        ],
+      });
+      // The live service itself isn't changed.
+      expect(existing.template.revision).to.equal("web-001");
+    });
+
+    it("sets the base image, or clears it", () => {
+      const withBaseImage = revisionTemplate(
+        { config: web, existing, baseImage: "nodejs24" },
+        image,
+      );
+      expect(withBaseImage.containers?.[0].baseImageUri).to.equal("nodejs24");
+
+      const withoutBaseImage = revisionTemplate({ config: web, existing }, image);
+      expect(withoutBaseImage.containers?.[0]).not.to.have.property("baseImageUri");
+    });
+
+    it("sets the deploy message, or clears the last one", () => {
+      const withMessage = revisionTemplate({ config: web, existing }, image, "Fix the login page");
+      expect(withMessage.annotations).to.deep.equal({
+        team: "frontend",
+        [DEPLOY_MESSAGE]: "Fix the login page",
+      });
+
+      const withoutMessage = revisionTemplate({ config: web, existing }, image);
+      expect(withoutMessage.annotations).to.deep.equal({ team: "frontend" });
+    });
+  });
+});