Cloud Billing API check when deploying Functions with Google Workload Identity

[bkendall]

[REQUIRED] Environment info

firebase-tools: v13.15.4

Platform: macOS

[REQUIRED] Test case

I'm fairly certain this will work with any function deployed with a workload identity. For example, I have a GH action with the following block (for authentication):

      - id: auth
        name: Authenticate to GCP
        uses: google-github-actions/auth@v2
        with:
          create_credentials_file: true
          workload_identity_provider: projects/xxxx/locations/global/workloadIdentityPools/github-action-pool/providers/github-action-provider
          service_account: github-action@yyyy.iam.gserviceaccount.com

[REQUIRED] Steps to reproduce

Deploy using the workload identity provider as above - probably easiest to do in GH actions once you have it set up. Instructions are in the action from Google

[REQUIRED] Expected behavior

Successful deploy.

[REQUIRED] Actual behavior

The CLI is giving me an error that the Cloud Billing API isn't enabled:

Error: HTTP Error: 403, Cloud Billing API has not been used in project 194637951628 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudbilling.googleapis.com/overview?project=194637951628 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

I assume, btw, that this API is enabled in the CLI's 'producer project', which is why this check succeeds when I run a deploy locally. I'm not sure what's causing this billing check, but it would be nice to either (1) skip it or (2) enable it, if it really needs to be enabled.

cc: @ifielker and @taeold who dealt with a similar problem recently :)

[steveoh]

This is also affecting me and my projects in github actions ubuntu runner.

[bkendall]

I'm not sure why, but this check is no longer being made - maybe it was a change in firebase-functions? This might be able to be closed now.

[manicmaniac]

I came across this issue just after upgrading firebase-tools to 13.19.0, while 13.18.0 has no problem.

[steveoh]

I came across this issue just after upgrading firebase-tools to 13.19.0, while 13.18.0 has no problem.

Wait? Is that a good thing or a bad thing?

[JR-RomanZaiats]

Have same issue with firebase-tools 13.5.4 and firebase-functions 5.1.1

[aalej]

Hey folks, re-opening this issue so that we can investigate. @JR-RomanZaiats, could you try updating to firebase-tools v13.16.0 or v13.18.0 to see if this would work around the issue?

[joehan]

As an alternative workaround, you can also enable the Cloud Billing API on the project listed in the error message.

[manicmaniac]

To add more information to #7584 (comment),

In my environment, the directory structure is like the following.

• my-project/
  • .github/
    • workflows/
      • deploy.yaml
  • package.json
  • package-lock.json
  • functions/
    • package.json
    • package-lock.json
    • index.js

./my-project/package.json declares only firebase-tools as dependency.
./my-project/functions/package.json declares some dependencies including firebase-functions. Its version is pinned to 6.0.1.

If I make ./my-project/package.json use firebase-tools@v13.18.0, the deploy workflow works well.
However once I make ./my-project/package.json use firebase-tools@v13.19.0 the workflow fails with the same error as this issue.

./.github/workflows/deploy.yaml is like the following.

name: Deploy
on: workflow_dispatch
jobs:
  deploy:
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          access_token_scopes: |
            email
            openid
            https://www.googleapis.com/auth/cloud-platform
            https://www.googleapis.com/auth/firebase
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          create_credentials_file: true
          export_environment_variables: true
      - run: npm ci
      - run: npx firebase deploy --only functions --force --project=my-project