[shojiiii]

Description

Related to #11330.

This draft explores an opt-in way to configure runtime security updates for
existing 2nd gen functions through Firebase deployments. For example, setting
functions.runtimeUpdatePolicy to automatic would switch a function currently
using on-deploy to automatic updates on the next deployment.

I opened the issue to clarify the intended ownership of this setting. This is an
initial implementation proposal to make that discussion more concrete; the option
name, its placement in firebase.json, and the behavior when omitted are open to
feedback. Would managing this through Firebase CLI fit the intended configuration
model, or would it be better exposed through the Functions SDK?

The implementation accepts automatic and on-deploy per functions
configuration and applies the setting only to 2nd gen functions. It maps the
selected value to the corresponding Cloud Functions v2 build configuration field
and update mask. Policy changes trigger an update even when the source and
environment hashes match. When omitted, no policy field or policy update mask is
sent, preserving existing update behavior and API defaults for new functions.

API reference:
https://cloud.google.com/functions/docs/reference/rest/v2/projects.locations.functions#BuildConfig

Scenarios Tested

• 262 related unit tests passed across configuration validation, deployment
  preparation, Cloud Functions v2 conversion and requests, and deployment planning.
• Both policy values, omission, invalid configuration, mixed Gen 1 / Gen 2
  codebases, and policy-only changes with matching source hashes are covered.
• Create and update request tests check that exactly the selected policy is sent;
  update tests also check the mask. Output-only runtimeVersion is not sent back.
• TypeScript compilation and lint checks passed.
• Full unit suite: TZ=UTC npm run mocha -- --forbid-only --reporter dot
  passed (5,912 passing, 11 pending). UTC avoids an existing datetimeString
  test failure under Asia/Tokyo.
• Live Cloud Functions deployment has not been tested.

Sample Commands

With the following firebase.json configuration:

{
  "functions": {
    "source": "functions",
    "runtimeUpdatePolicy": "automatic"
  }
}

firebase deploy --only functions:hello

Use on-deploy to apply runtime security patches only on deployment. Omitting
the option leaves the policy unmanaged by Firebase CLI.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request introduces the functions.runtimeUpdatePolicy configuration setting for 2nd generation Cloud Functions, allowing users to choose between automatic and on-deploy runtime security updates. The changes include updates to the configuration schema, validation logic, deployment planner, and the Cloud Functions v2 API integration, along with corresponding unit tests. The review feedback recommends extracting the inlined policy strings in the validation function into a top-level constant to comply with the repository's style guide against magic values.

[gemini-code-assist]

To adhere to the repository style guide (Rule 34: Extract magic numbers and static constants), we should avoid inlining the repeated magic strings "automatic" and "on-deploy". We can extract them into a local allowedPolicies constant array, which also simplifies the validation logic and makes it more maintainable.

Suggested change

	if (
	config.runtimeUpdatePolicy !== undefined &&
	config.runtimeUpdatePolicy !== "automatic" &&
	config.runtimeUpdatePolicy !== "on-deploy"
	) {
	throw new FirebaseError(
	'functions.runtimeUpdatePolicy must be either "automatic" or "on-deploy".',
	);
	}
	const allowedPolicies: readonly string[] = ["automatic", "on-deploy"];
	if (
	config.runtimeUpdatePolicy !== undefined &&
	!allowedPolicies.includes(config.runtimeUpdatePolicy)
	) {
	throw new FirebaseError(
	'functions.runtimeUpdatePolicy must be either "automatic" or "on-deploy".',
	);
	}

References

1. Extract magic numbers and static constants: Define static IDs, default timeouts, millisecond offsets, and repeated strings as top-level constants (UPPER_SNAKE_CASE) instead of inlining magic values inside functions. Mark static configuration arrays and lookup tables as readonly or as const. ^(link)