.env-based secret param binding for Functions by Berlioz · Pull Request #10714 · firebase/firebase-tools

Berlioz · 2026-06-24T23:57:30Z

Pulls secrets from the Functions .env files and propagates them into the Functions Build's SecretEnvVars (and from there, into the resolved Backend, and from there, into the JSON uploaded to Cloud Functions/Cloud Run).

Params support not included in this PR, to reduce the size of the review. This is obviously going to be a terrible user experience before params are supported (hence the experiment flag) but this should be enough to test the actual binding behavior.

Quick guide to file change intent:

environments.ts - Adds an experiment flag which by default prevents any changes from being made to the Build. If the experiment is not enabled, FIREBASE_SECRET_REF_ envs will still be accepted by the parser, but they'll do nothing (and will not appear in process.env)

env.ts - Modifies the key validation logic to allow keys that begin with FIREBASE_SECRET_REF_ even though FIREBASE_ is reserved. Otherwise knows nothing about this feature.

prepare.ts - Partitions the key-value pairs passed from env.ts into the normal entries and the secrets, which have FIREBASE_SECRET_REF_ stripped from the key at this point. If feature flag enabled, calls build.applyEnvSecretOverrides()

build.ts - Implements applyEnvSecretOverrides, which mutates a Build's state to upsert .env-defined secrets into SecretEnvVars before the Build is compiled into a Functions Backend. These secrets contain an allowVersionPinning sentinel value if the version is specified, which will be relevant real soon now.

backend.ts - Adds the allowVersionPinning to a Backend's version of a SecretEnvVar so it can propagate to...

validate.ts - Bypasses the logic that forces secret versions to always resolve to the current latest if allowVersionPinning is set.

…e params right now

wiz-9635d3485b · 2026-06-26T22:18:15Z

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	1
Software Management Findings	-

Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

inlined · 2026-06-30T16:44:30Z

+  "^" +                                      // start of string
+  "csm:\/\/" +                               // scheme csm://
+  "([a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)" +    // secret ID is a GCP resource ID
+  "(?:\/([-a-z0-9]+))?" +                    // capture an optional GCP label for version


It is either a number or "latest"

Discussed over chat: GCP implemented a new feature where users could create arbitrary aliases for specific versions.

inlined · 2026-06-30T16:51:36Z

+      foo: "bar",
+      FIREBASE_SECRET_REF_baz: "quux",
+    } as Record<string, string>;
+    const { userEnvs: userEnvs, secretRefs: secretRefs } = prepare.partitionUserEnvs(input);


FYI: functional.ts already has a partition function. It may be worth just making that support partitioning objects not just arrays.

Actually, I stand corrected; functional.ts already has partitionRecord which seems like it should be used instead of a custom function.

It's almost there but the fact that partitionUserEnvs modifies the keys in the process of partitioning (to strip the special key prefix) makes it kind of annoying to use directly. You'd have to take a second pass with something that basically does a mapObject but mutates keys instead of values. Nothing I tried looked any more readable than just having a custom function, unfortunately.

inlined · 2026-06-30T16:56:36Z

    default: false,
    public: true,
  },
+  secretEnvParams: {


What is the rationale for keeping this experiment guarded? This won't affect any existing behavior because the key was previously disallowed

Uh at first this was written before API review so I had to guard it in case it was merged before formal approval. I actually do like the idea of guarding it until the params implementation is done though, since anyone who tries to use this without param prompting is in for some undefined and unpleasant behavior.

…y for .env secrets

inlined · 2026-07-08T18:55:57Z

+export const SECRET_REF_PREFIX = "FIREBASE_SECRET_REF_";
+// prettier-ignore
+const GCP_RESOURCE_ID_PATTERN = "([a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)"
+export const SECRET_REF_SHORT_RE = new RegExp(


Wow... took me so long to find something canonical but https://docs.cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets/create#query-parameters does say that upper case letters are allowed. Also, there's no mention that it must start with an alpha

Good find. The validation predicator on the internal proto also matches that.

inlined · 2026-07-08T19:01:53Z

 const FUNCTIONS_EMULATOR_DOTENV = ".env.local";

 const RESERVED_PREFIXES = ["X_GOOGLE_", "FIREBASE_", "EXT_"];
+const RESERVED_KEY_PREFIXES = ["FIREBASE_SECRET_REF"];


Nit: isn't a trailing _ part of the prefix too? Also, I wonder if there's a better name for this that makes it clearer.

Honestly, everything I thought of sounded clunky. RESERVED_PREFIX_ALLOWLIST, maybe?

inlined · 2026-07-08T19:35:40Z

      .filter((e) => e.codebase === codebase || e.codebase === undefined);
    await resolveDefaultRegionsForBuild(wantBuild, backend.of(...relevantEndpoints));

+    if (experiments.isEnabled("secretEnvParams")) {


I think I was wrong regarding whether this is good to have as an experiment because it can change existing behavior, but not here. I would assume that the best place to secret-guard is when we prompt for a secret value in resolving the build, but if they already have a codebase that uses secret refs, just move forwards with it. This prevents weird errors where we're collaborating on a codebase and it works on my computer but not yours.

Yeah, I can see that. Didn't consider the collaboration angle.

inlined · 2026-07-09T22:14:09Z

+        );
+      }
+      let notFound = true;
+      endpoint.secretEnvironmentVariables?.forEach((envVar) => {


style guide says to use for ... of last I checked.

inlined · 2026-07-09T22:15:01Z

+ * @return An object populated with project id, secret id, and version, with a field undefined if not provided.
+ */
+export function parseSecretRef(ref: string): ParsedSecretRef {
+  const shortMatch = SECRET_REF_SHORT_RE.exec(ref);


nit: Can JS REs do named captures? Would that be a better simplification here?

I considered it, but the way i have the last capture group for the version jankily split up between multiple lines of the composed regex (so I can deal with the #/@ special cases) would make it kind of awkward to keep consistent here.

inlined · 2026-07-09T22:16:43Z

      .filter((e) => e.codebase === codebase || e.codebase === undefined);
    await resolveDefaultRegionsForBuild(wantBuild, backend.of(...relevantEndpoints));

+    const parsedSecretRefs = Object.fromEntries(


This is already in functional.ts as mapObject

inlined · 2026-07-09T22:17:47Z

+      foo: "bar",
+      FIREBASE_SECRET_REF_baz: "quux",
+    } as Record<string, string>;
+    const { userEnvs: userEnvs, secretRefs: secretRefs } = prepare.partitionUserEnvs(input);


Actually, I stand corrected; functional.ts already has partitionRecord which seems like it should be used instead of a custom function.

inlined · 2026-07-09T22:26:42Z

@@ -10,6 +10,7 @@ import { logBullet, logWarning } from "../utils";
 const FUNCTIONS_EMULATOR_DOTENV = ".env.local";

 const RESERVED_PREFIXES = ["X_GOOGLE_", "FIREBASE_", "EXT_"];


Maybe it would be good to add KIT_ to this now and see if anyone yells before we start depending on it being a reserved prefix.

Oooh, that's a good idea.

.env-based secret param binding. Experimental-flagged, does not handl…

23b799c

…e params right now

This comment was marked as outdated.

Sign in to view

firebase deleted a comment from gemini-code-assist Bot Jun 26, 2026

use standardized uri format

d479b2d

Berlioz force-pushed the vsfan_env_params_use branch from 14c6bec to d479b2d Compare June 26, 2026 22:26

Berlioz requested review from ajperel and inlined June 26, 2026 22:51

inlined approved these changes Jun 30, 2026

View reviewed changes

Berlioz added 11 commits June 30, 2026 17:06

wip: parse new format

7381d56

Merge remote-tracking branch 'origin' into vsfan_env_params_use

6b698a3

new parser, now actually working

d92cf73

lint

44eb07a

style

b4f4fa3

more style

635318e

syntax

db6c1a4

adds a sentinel value that bypasses the version override during deplo…

1c964e4

…y for .env secrets

comment change

fcf5082

Merge remote-tracking branch 'origin' into vsfan_env_params_use

b111522

Merge branch 'main' into vsfan_env_params_use

397744c

inlined requested changes Jul 8, 2026

View reviewed changes

pr review

32ec1ee

Berlioz force-pushed the vsfan_env_params_use branch from e9833dd to 32ec1ee Compare July 8, 2026 22:31

Berlioz assigned inlined and Berlioz Jul 9, 2026

Berlioz requested a review from inlined July 9, 2026 20:58

inlined approved these changes Jul 9, 2026

View reviewed changes

review

2612750

Berlioz added 4 commits July 15, 2026 14:25

Integrate .env secret bindings with param prompting (#10783)

353da19

Merge branch 'main' into vsfan_env_params_use

d945baa

ci fix?

ee7d11d

Merge branch 'main' into vsfan_env_params_use

59b7662

		@@ -10,6 +10,7 @@ import { logBullet, logWarning } from "../utils";
		const FUNCTIONS_EMULATOR_DOTENV = ".env.local";

		const RESERVED_PREFIXES = ["X_GOOGLE_", "FIREBASE_", "EXT_"];

Uh oh!

Conversation

Berlioz commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

wiz-9635d3485b Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Wiz Scan Summary

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Berlioz commented Jun 24, 2026 •

edited

Loading

wiz-9635d3485b Bot commented Jun 26, 2026 •

edited

Loading