feat: split across different cloudbuilds

Author: cabljac

integration_test/README.md

@@ -247,6 +247,8 @@ Functions and test data are automatically cleaned up:
 ## Commands
 
 ### Running Tests
+
+#### Local Testing
 ```bash
 # Run all tests sequentially
 npm run test:all:sequential
@@ -266,6 +268,20 @@ npm run run-tests -- --sequential v1_firestore v1_database
 npm run run-tests -- --filter=v2 --exclude=auth
 ```
 
+#### Cloud Build Testing
+```bash
+# Run V1 tests in Cloud Build
+npm run cloudbuild:v1
+
+# Run V2 tests in Cloud Build
+npm run cloudbuild:v2
+
+# Run both V1 and V2 tests in parallel
+npm run cloudbuild:both
+# or
+npm run cloudbuild:all
+```
+
 ### Generate Functions Only
 ```bash
 npm run generate <suite-name>
@@ -335,32 +351,84 @@ Cloud Build uses Application Default Credentials (ADC) automatically. However, t
 - `roles/cloudtestservice.testAdmin` - For Firebase Test Lab integration tests
 - `roles/firebase.admin` - For Firebase services (already included)
 - `roles/pubsub.publisher` - For Pub/Sub integration tests (already included)
+- `roles/iam.serviceAccountUser` - For Firebase Functions deployment (Service Account User)
 
 **Multi-Project Setup:**
-Tests deploy to multiple projects (typically one for V1 tests and one for V2 tests). The Cloud Build service account needs the above permissions on **all target projects**:
+Tests deploy to multiple projects (V1 tests to `functions-integration-tests`, V2 tests to `functions-integration-tests-v2`). Each Cloud Build runs on its own project, so **no cross-project permissions are needed**.
 
+**V1 Project Setup:**
 ```bash
-# Grant permissions to each target project
-gcloud projects add-iam-policy-binding TARGET_PROJECT_ID \
+# Grant permissions to V1 project (functions-integration-tests)
+gcloud projects add-iam-policy-binding functions-integration-tests \
   --member="serviceAccount:[email protected]" \
   --role="roles/cloudtasks.admin"
 
-gcloud projects add-iam-policy-binding TARGET_PROJECT_ID \
+gcloud projects add-iam-policy-binding functions-integration-tests \
   --member="serviceAccount:[email protected]" \
   --role="roles/cloudscheduler.admin"
 
-gcloud projects add-iam-policy-binding TARGET_PROJECT_ID \
+gcloud projects add-iam-policy-binding functions-integration-tests \
   --member="serviceAccount:[email protected]" \
   --role="roles/cloudtestservice.testAdmin"
 
-gcloud projects add-iam-policy-binding TARGET_PROJECT_ID \
+gcloud projects add-iam-policy-binding functions-integration-tests \
   --member="serviceAccount:[email protected]" \
   --role="roles/firebase.admin"
+
+gcloud projects add-iam-policy-binding functions-integration-tests \
+  --member="serviceAccount:[email protected]" \
+  --role="roles/iam.serviceAccountUser"
 ```
 
-Replace:
-- `TARGET_PROJECT_ID` with each project where tests will be deployed
-- `CLOUD_BUILD_PROJECT_NUMBER` with the project number where Cloud Build runs
+**V2 Project Setup:**
+```bash
+# Grant permissions to V2 project (functions-integration-tests-v2)
+gcloud projects add-iam-policy-binding functions-integration-tests-v2 \
+  --member="serviceAccount:[email protected]" \
+  --role="roles/cloudtasks.admin"
+
+gcloud projects add-iam-policy-binding functions-integration-tests-v2 \
+  --member="serviceAccount:[email protected]" \
+  --role="roles/cloudscheduler.admin"
+
+gcloud projects add-iam-policy-binding functions-integration-tests-v2 \
+  --member="serviceAccount:[email protected]" \
+  --role="roles/cloudtestservice.testAdmin"
+
+gcloud projects add-iam-policy-binding functions-integration-tests-v2 \
+  --member="serviceAccount:[email protected]" \
+  --role="roles/firebase.admin"
+
+gcloud projects add-iam-policy-binding functions-integration-tests-v2 \
+  --member="serviceAccount:[email protected]" \
+  --role="roles/iam.serviceAccountUser"
+```
+
+Replace `CLOUD_BUILD_PROJECT_NUMBER` with the project number where Cloud Build runs.
+
+#### Running Cloud Build
+
+The integration tests use **separate Cloud Build configurations** for V1 and V2 tests to avoid cross-project permission complexity:
+
+**V1 Tests:**
+```bash
+# Run V1 tests on functions-integration-tests project
+gcloud builds submit --config=integration_test/cloudbuild-v1.yaml
+```
+
+**V2 Tests:**
+```bash
+# Run V2 tests on functions-integration-tests-v2 project
+gcloud builds submit --config=integration_test/cloudbuild-v2.yaml
+```
+
+**Both Tests (Parallel):**
+```bash
+# Run both V1 and V2 tests simultaneously
+gcloud builds submit --config=integration_test/cloudbuild-v1.yaml &
+gcloud builds submit --config=integration_test/cloudbuild-v2.yaml &
+wait
+```
 
 #### Running Cloud Build with Custom Projects
 
@@ -378,9 +446,13 @@ To use your own projects, edit the YAML configuration files:
      projectId: your-v2-project-id
    ```
 
-3. **Run Cloud Build**:
+3. **Run Cloud Build** (use the appropriate config for your target project):
    ```bash
-   gcloud builds submit --config=integration_test/cloudbuild.yaml
+   # For V1 tests
+   gcloud builds submit --config=integration_test/cloudbuild-v1.yaml
+   
+   # For V2 tests  
+   gcloud builds submit --config=integration_test/cloudbuild-v2.yaml
    ```
 
 **Default behavior (Firebase team):**
@@ -447,6 +519,11 @@ If you see authentication errors like "Could not refresh access token" or "Permi
   gcloud projects add-iam-policy-binding TARGET_PROJECT_ID \
     --member="serviceAccount:[email protected]" \
     --role="roles/firebase.admin"
+  
+  # For Service Account User (required for Functions deployment)
+  gcloud projects add-iam-policy-binding TARGET_PROJECT_ID \
+    --member="serviceAccount:[email protected]" \
+    --role="roles/iam.serviceAccountUser"
   ```
 
 ### Cleanup Issues

integration_test/cloudbuild-v1.yaml

@@ -0,0 +1,50 @@
+# Cloud Build configuration for Firebase Functions V1 Integration Tests
+# Runs all V1 test suites sequentially to avoid rate limits
+
+options:
+  machineType: 'E2_HIGHCPU_8'
+  logging: CLOUD_LOGGING_ONLY
+
+timeout: '3600s'
+
+steps:
+  # Build SDK and run all V1 test suites sequentially
+  - name: 'node:20'
+    id: 'build-sdk-and-test-v1'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |
+        # Step 1: Build and pack the firebase-functions SDK from source
+        echo "Building firebase-functions SDK from source..."
+        npm ci
+        npm run build
+        npm pack
+        # Move the tarball to where integration tests expect it
+        mv firebase-functions-*.tgz integration_test/firebase-functions-local.tgz
+        echo "SDK built and packed successfully"
+
+        # Step 2: Run V1 integration tests with the local SDK
+        cd integration_test
+        echo "Installing test dependencies..."
+        npm ci
+        # Install firebase-tools globally
+        npm install -g firebase-tools
+        # Install gcloud CLI for Cloud Tasks cleanup
+        curl https://sdk.cloud.google.com | bash
+        export PATH="$PATH:/root/google-cloud-sdk/bin"
+        # Verify tools are installed
+        firebase --version
+        gcloud --version
+        # V1 tests use functions-integration-tests project
+        echo "Running V1 tests on project: functions-integration-tests"
+        # Use Application Default Credentials (Cloud Build service account)
+        # Run all V1 test suites sequentially
+        node scripts/run-tests.js --sequential --filter=v1 --use-published-sdk=file:firebase-functions-local.tgz
+
+# Artifacts to store
+artifacts:
+  objects:
+    location: 'gs://${PROJECT_ID}-test-results/${BUILD_ID}'
+    paths:
+      - 'logs/**/*.log'

integration_test/cloudbuild-v2.yaml

@@ -0,0 +1,50 @@
+# Cloud Build configuration for Firebase Functions V2 Integration Tests
+# Runs all V2 test suites sequentially to avoid rate limits
+
+options:
+  machineType: 'E2_HIGHCPU_8'
+  logging: CLOUD_LOGGING_ONLY
+
+timeout: '3600s'
+
+steps:
+  # Build SDK and run all V2 test suites sequentially
+  - name: 'node:20'
+    id: 'build-sdk-and-test-v2'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |
+        # Step 1: Build and pack the firebase-functions SDK from source
+        echo "Building firebase-functions SDK from source..."
+        npm ci
+        npm run build
+        npm pack
+        # Move the tarball to where integration tests expect it
+        mv firebase-functions-*.tgz integration_test/firebase-functions-local.tgz
+        echo "SDK built and packed successfully"
+
+        # Step 2: Run V2 integration tests with the local SDK
+        cd integration_test
+        echo "Installing test dependencies..."
+        npm ci
+        # Install firebase-tools globally
+        npm install -g firebase-tools
+        # Install gcloud CLI for Cloud Tasks cleanup
+        curl https://sdk.cloud.google.com | bash
+        export PATH="$PATH:/root/google-cloud-sdk/bin"
+        # Verify tools are installed
+        firebase --version
+        gcloud --version
+        # V2 tests use functions-integration-tests-v2 project
+        echo "Running V2 tests on project: functions-integration-tests-v2"
+        # Use Application Default Credentials (Cloud Build service account)
+        # Run all V2 test suites sequentially
+        node scripts/run-tests.js --sequential --filter=v2 --use-published-sdk=file:firebase-functions-local.tgz
+
+# Artifacts to store
+artifacts:
+  objects:
+    location: 'gs://${PROJECT_ID}-test-results/${BUILD_ID}'
+    paths:
+      - 'logs/**/*.log'

integration_test/cloudbuild.yaml

@@ -107,35 +107,35 @@ suites:
         trigger: onDelete
 
   # Auth beforeCreate blocking function (must run separately)
-  - name: v1_auth_before_create
-    description: "V1 Auth beforeCreate blocking trigger test"
-    version: v1
-    service: auth
-    functions:
-      - name: authUserBeforeCreateTests
-        trigger: beforeCreate
-        collection: authBeforeCreateTests
-        blocking: true
+  # - name: v1_auth_before_create
+  #   description: "V1 Auth beforeCreate blocking trigger test"
+  #   version: v1
+  #   service: auth
+  #   functions:
+  #     - name: authUserBeforeCreateTests
+  #       trigger: beforeCreate
+  #       collection: authBeforeCreateTests
+  #       blocking: true
 
   # Auth beforeSignIn blocking function (must run separately)
-  - name: v1_auth_before_signin
-    description: "V1 Auth beforeSignIn blocking trigger test"
-    version: v1
-    service: auth
-    functions:
-      - name: authUserBeforeSignInTests
-        trigger: beforeSignIn
-        collection: authBeforeSignInTests
-        blocking: true
+  # - name: v1_auth_before_signin
+  #   description: "V1 Auth beforeSignIn blocking trigger test"
+  #   version: v1
+  #   service: auth
+  #   functions:
+  #     - name: authUserBeforeSignInTests
+  #       trigger: beforeSignIn
+  #       collection: authBeforeSignInTests
+  #       blocking: true
 
   # Cloud Tasks triggers
-  - name: v1_tasks
-    description: "V1 Cloud Tasks trigger tests"
-    version: v1
-    service: tasks
-    functions:
-      - name: tasksOnDispatchTests
-        trigger: onDispatch
+  # - name: v1_tasks
+  #   description: "V1 Cloud Tasks trigger tests"
+  #   version: v1
+  #   service: tasks
+  #   functions:
+  #     - name: tasksOnDispatchTests
+  #       trigger: onDispatch
 
   # Remote Config triggers
   - name: v1_remoteconfig

integration_test/config/v1/suites.yaml

@@ -17,6 +17,10 @@
     "test:all:sequential": "node scripts/run-tests.js --sequential",
     "test:v1:auth-before-create": "node scripts/run-tests.js v1_auth_before_create",
     "test:v1:auth-before-signin": "node scripts/run-tests.js v1_auth_before_signin",
+    "cloudbuild:v1": "gcloud builds submit --config=cloudbuild-v1.yaml",
+    "cloudbuild:v2": "gcloud builds submit --config=cloudbuild-v2.yaml",
+    "cloudbuild:both": "gcloud builds submit --config=cloudbuild-v1.yaml & gcloud builds submit --config=cloudbuild-v2.yaml & wait",
+    "cloudbuild:all": "npm run cloudbuild:both",
     "cleanup": "./scripts/cleanup-suite.sh",
     "cleanup:list": "./scripts/cleanup-suite.sh --list-artifacts",
     "clean": "rm -rf generated/*",