Deployment fails to find secrets in v14.21.0 in non-interactive mode

[tylerc]

I accidentally closed #9367 and could not reopen it, sorry for the double issue.

[REQUIRED] Environment info

firebase-tools: 14.21.0

Platform: Windows 11 24H2, GitHub Actions ubuntu-latest

[REQUIRED] Test case

firebase deploy --only functions -P project-name --non-interactive

[REQUIRED] Steps to reproduce

• Try to deploy Firebase Functions that use defineSecret() in non-interactive mode (i.e. in GitHub Actions or with the --non-interactive flag.

[REQUIRED] Expected behavior

The deployment should succeed.

[REQUIRED] Actual behavior

The deployment fails with the error Error: In non-interactive mode but have no value for the following secrets: ...

Downgrading to v14.20.0 fixes the issue.

I expect this PR #9335 is to blame: https://github.com/firebase/firebase-tools/pull/9335/files#diff-e2c8e057de5d6c45c574e847ac9a77cf141d44e19a09dfd8358933d32aa4e0eaR408

Full debug output:

[2025-10-22T23:21:05.417Z] > command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"]
[2025-10-22T23:21:05.418Z] > authorizing via signed-in user (REDACTED)
[2025-10-22T23:21:05.419Z] [iam] checking project tri-reporting-test for permissions ["cloudfunctions.functions.create","cloudfunctions.functions.delete","cloudfunctions.functions.get","cloudfunctions.functions.list","cloudfunctions.functions.update","cloudfunctions.operations.get","firebase.projects.get"]
[2025-10-22T23:21:05.420Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:05.420Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:05.421Z] >>> [apiv2][query] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions [none]
[2025-10-22T23:21:05.421Z] >>> [apiv2][(partial)header] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions x-goog-quota-user=projects/tri-reporting-test
[2025-10-22T23:21:05.421Z] >>> [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions {"permissions":["cloudfunctions.functions.create","cloudfunctions.functions.delete","cloudfunctions.functions.get","cloudfunctions.functions.list","cloudfunctions.functions.update","cloudfunctions.operations.get","firebase.projects.get"]}
[2025-10-22T23:21:05.755Z] <<< [apiv2][status] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions 200
[2025-10-22T23:21:05.755Z] <<< [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions {"permissions":["cloudfunctions.functions.create","cloudfunctions.functions.delete","cloudfunctions.functions.get","cloudfunctions.functions.list","cloudfunctions.functions.update","cloudfunctions.operations.get","firebase.projects.get"]}
[2025-10-22T23:21:05.756Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:05.756Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:05.756Z] >>> [apiv2][query] POST https://iam.googleapis.com/v1/projects/tri-reporting-test/serviceAccounts/tri-reporting-test@appspot.gserviceaccount.com:testIamPermissions [none]
[2025-10-22T23:21:05.756Z] >>> [apiv2][body] POST https://iam.googleapis.com/v1/projects/tri-reporting-test/serviceAccounts/tri-reporting-test@appspot.gserviceaccount.com:testIamPermissions {"permissions":["iam.serviceAccounts.actAs"]}
[2025-10-22T23:21:06.048Z] <<< [apiv2][status] POST https://iam.googleapis.com/v1/projects/tri-reporting-test/serviceAccounts/tri-reporting-test@appspot.gserviceaccount.com:testIamPermissions 200
[2025-10-22T23:21:06.048Z] <<< [apiv2][body] POST https://iam.googleapis.com/v1/projects/tri-reporting-test/serviceAccounts/tri-reporting-test@appspot.gserviceaccount.com:testIamPermissions {"permissions":["iam.serviceAccounts.actAs"]}

=== Deploying to 'tri-reporting-test'...

i  deploying functions 
Running command: npm --prefix "$RESOURCE_DIR" run build

> build
> tsc

+  functions: Finished running predeploy script. 
[2025-10-22T23:21:06.550Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:06.550Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:06.550Z] >>> [apiv2][query] GET https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test [none]
[2025-10-22T23:21:06.703Z] <<< [apiv2][status] GET https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test 200
[2025-10-22T23:21:06.703Z] <<< [apiv2][body] GET https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test {"projectNumber":"321419452425","projectId":"tri-reporting-test","lifecycleState":"ACTIVE","name":"TRI Reporting Test","labels":{"firebase":"enabled","firebase-core":"disabled"},"createTime":"2025-02-22T00:02:04.355468Z","parent":{"type":"organization","id":"459614981102"}}
i  functions: preparing codebase default for deployment 
i  functions: ensuring required API cloudfunctions.googleapis.com is enabled... 
i  functions: ensuring required API cloudbuild.googleapis.com is enabled... 
i  artifactregistry: ensuring required API artifactregistry.googleapis.com is enabled... 
[2025-10-22T23:21:06.705Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:06.706Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:06.706Z] >>> [apiv2][query] GET https://firebase.googleapis.com/v1beta1/projects/tri-reporting-test/adminSdkConfig [none]
[2025-10-22T23:21:07.036Z] <<< [apiv2][status] GET https://firebase.googleapis.com/v1beta1/projects/tri-reporting-test/adminSdkConfig 200
[2025-10-22T23:21:07.036Z] <<< [apiv2][body] GET https://firebase.googleapis.com/v1beta1/projects/tri-reporting-test/adminSdkConfig {"projectId":"tri-reporting-test","storageBucket":"tri-reporting-test.firebasestorage.app"}
[2025-10-22T23:21:07.037Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:07.037Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:07.037Z] >>> [apiv2][query] GET https://runtimeconfig.googleapis.com/v1beta1/projects/tri-reporting-test/configs [none]
[2025-10-22T23:21:07.385Z] <<< [apiv2][status] GET https://runtimeconfig.googleapis.com/v1beta1/projects/tri-reporting-test/configs 200
[2025-10-22T23:21:07.385Z] <<< [apiv2][body] GET https://runtimeconfig.googleapis.com/v1beta1/projects/tri-reporting-test/configs {}
[2025-10-22T23:21:07.387Z] Validating nodejs source
!  functions: package.json indicates an outdated version of firebase-functions. Please upgrade using npm install --save firebase-functions@latest in your functions directory. 
[2025-10-22T23:21:08.087Z] > [functions] package.json contents: {
  "name": "functions",
  "scripts": {
    "build": "tsc",
    "build:watch": "tsc --watch",
    "serve": "npm run build && firebase emulators:start --only functions",
    "shell": "npm run build && firebase functions:shell",
    "start": "npm run shell",
    "deploy": "firebase deploy --only functions",
    "logs": "firebase functions:log",
    "generate-db-types": "tsx ./db-generate-types.ts"
  },
  "engines": {
    "node": "22"
  },
  "main": "lib/functions/src/index.js",
  "dependencies": {
    "@google/genai": "^1.24.0",
    "@googleapis/gmail": "^15.0.0",
    "@sinclair/typebox": "^0.34.41",
    "firebase-admin": "^13.5.0",
    "firebase-functions": "^6.5.0",
    "googleapis-common": "^8.0.0",
    "jszip": "^3.10.1",
    "kysely": "^0.28.8",
    "nodemailer": "^7.0.9",
    "pg": "^8.16.3",
    "xlsx-populate": "^1.21.0",
    "xmlbuilder2": "^3.1.1"
  },
  "devDependencies": {
    "@types/jszip": "^3.4.0",
    "@types/nodemailer": "^7.0.2",
    "@types/pg": "^8.15.5",
    "@types/pluralize": "^0.0.33",
    "kysely-ctl": "^0.19.0",
    "pluralize": "^8.0.0",
    "typescript": "^5.9.3"
  },
  "private": true
}
[2025-10-22T23:21:08.088Z] Building nodejs source
i  functions: Loading and analyzing source code for codebase default to determine what to deploy 
[2025-10-22T23:21:08.089Z] Could not find functions.yaml. Must use http discovery
[2025-10-22T23:21:08.100Z] Found firebase-functions binary at 'G:\consulting\hiser-joy\firebase\tri-reporting\functions\node_modules\.bin\firebase-functions'
Serving at port 8876

[2025-10-22T23:21:08.988Z] Got response from /__/functions.yaml {"endpoints":{"tri":{"availableMemoryMb":1024,"timeoutSeconds":120,"minInstances":null,"maxInstances":4,"ingressSettings":"ALLOW_ALL","concurrency":80,"serviceAccountEmail":null,"vpc":null,"platform":"gcfv2","cpu":2,"secretEnvironmentVariables":[{"key":"POSTGRES_HOST"},{"key":"POSTGRES_PASSWORD"},{"key":"GEMINI_API_KEY"},{"key":"EMAIL_CREDENTIALS"},{"key":"OPENAI_API_KEY"},{"key":"OPENAI_VECTOR_STORE_ID"}],"labels":{},"httpsTrigger":{"invoker":["public"]},"entryPoint":"tri"},"beforeUserCreated":{"availableMemoryMb":null,"timeoutSeconds":null,"minInstances":null,"maxInstances":null,"ingressSettings":null,"concurrency":null,"serviceAccountEmail":null,"vpc":null,"platform":"gcfv2","secretEnvironmentVariables":[{"key":"POSTGRES_HOST"},{"key":"POSTGRES_PASSWORD"},{"key":"GEMINI_API_KEY"},{"key":"EMAIL_CREDENTIALS"},{"key":"OPENAI_API_KEY"},{"key":"OPENAI_VECTOR_STORE_ID"}],"labels":{},"blockingTrigger":{"eventType":"providers/cloud.auth/eventTypes/user.beforeCreate","options":{"accessToken":false,"idToken":false,"refreshToken":false}},"entryPoint":"beforeUserCreated"},"beforeUserSignedIn":{"availableMemoryMb":null,"timeoutSeconds":null,"minInstances":null,"maxInstances":null,"ingressSettings":null,"concurrency":null,"serviceAccountEmail":null,"vpc":null,"platform":"gcfv2","secretEnvironmentVariables":[{"key":"POSTGRES_HOST"},{"key":"POSTGRES_PASSWORD"},{"key":"GEMINI_API_KEY"},{"key":"EMAIL_CREDENTIALS"},{"key":"OPENAI_API_KEY"},{"key":"OPENAI_VECTOR_STORE_ID"}],"labels":{},"blockingTrigger":{"eventType":"providers/cloud.auth/eventTypes/user.beforeSignIn","options":{"accessToken":false,"idToken":false,"refreshToken":false}},"entryPoint":"beforeUserSignedIn"},"askQuestionFromVectorStore":{"availableMemoryMb":null,"timeoutSeconds":null,"minInstances":null,"maxInstances":null,"ingressSettings":"ALLOW_ALL","concurrency":null,"serviceAccountEmail":null,"vpc":null,"platform":"gcfv2","secretEnvironmentVariables":[{"key":"POSTGRES_HOST"},{"key":"POSTGRES_PASSWORD"},{"key":"GEMINI_API_KEY"},{"key":"EMAIL_CREDENTIALS"},{"key":"OPENAI_API_KEY"},{"key":"OPENAI_VECTOR_STORE_ID"}],"labels":{},"httpsTrigger":{"invoker":["public"]},"entryPoint":"askQuestionFromVectorStore"},"julySecondProcessing":{"availableMemoryMb":1024,"timeoutSeconds":540,"minInstances":null,"maxInstances":1,"ingressSettings":null,"concurrency":1,"serviceAccountEmail":null,"vpc":null,"platform":"gcfv2","cpu":2,"secretEnvironmentVariables":[{"key":"POSTGRES_HOST"},{"key":"POSTGRES_PASSWORD"},{"key":"GEMINI_API_KEY"},{"key":"EMAIL_CREDENTIALS"},{"key":"OPENAI_API_KEY"},{"key":"OPENAI_VECTOR_STORE_ID"}],"labels":{},"scheduleTrigger":{"schedule":"7 8 2 7 *","retryConfig":{},"timeZone":"America/Phoenix"},"entryPoint":"julySecondProcessing"}},"specVersion":"v1alpha1","requiredAPIs":[{"api":"identitytoolkit.googleapis.com","reason":"Needed for auth blocking functions"},{"api":"cloudscheduler.googleapis.com","reason":"Needed for scheduled functions."}],"extensions":{},"params":[{"type":"secret","name":"POSTGRES_HOST"},{"type":"secret","name":"POSTGRES_PASSWORD"},{"type":"secret","name":"GEMINI_API_KEY"},{"type":"secret","name":"EMAIL_CREDENTIALS"},{"type":"secret","name":"OPENAI_API_KEY"},{"type":"secret","name":"OPENAI_VECTOR_STORE_ID"}]}
i  extensions: ensuring required API firebaseextensions.googleapis.com is enabled... 
[2025-10-22T23:21:13.032Z] > command requires scopes: ["email","openid","https://www.googleapis.com/auth/cloudplatformprojects.readonly","https://www.googleapis.com/auth/firebase","https://www.googleapis.com/auth/cloud-platform"]
[2025-10-22T23:21:13.032Z] > authorizing via signed-in user (REDACTED)
[2025-10-22T23:21:13.032Z] [iam] checking project tri-reporting-test for permissions ["firebase.projects.get","firebaseextensions.instances.list"]
[2025-10-22T23:21:13.032Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:13.032Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:13.033Z] >>> [apiv2][query] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions [none]
[2025-10-22T23:21:13.033Z] >>> [apiv2][(partial)header] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions x-goog-quota-user=projects/tri-reporting-test
[2025-10-22T23:21:13.033Z] >>> [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions {"permissions":["firebase.projects.get","firebaseextensions.instances.list"]}
[2025-10-22T23:21:13.180Z] <<< [apiv2][status] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions 200
[2025-10-22T23:21:13.180Z] <<< [apiv2][body] POST https://cloudresourcemanager.googleapis.com/v1/projects/tri-reporting-test:testIamPermissions {"permissions":["firebase.projects.get","firebaseextensions.instances.list"]}
[2025-10-22T23:21:13.181Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:13.181Z] Checked if tokens are valid: true, expires at: 1761178032661
[2025-10-22T23:21:13.181Z] >>> [apiv2][query] GET https://firebaseextensions.googleapis.com/v1beta/projects/tri-reporting-test/instances pageSize=100&pageToken=
[2025-10-22T23:21:13.531Z] <<< [apiv2][status] GET https://firebaseextensions.googleapis.com/v1beta/projects/tri-reporting-test/instances 200
[2025-10-22T23:21:13.532Z] <<< [apiv2][body] GET https://firebaseextensions.googleapis.com/v1beta/projects/tri-reporting-test/instances {}

Error: In non-interactive mode but have no value for the following secrets: POSTGRES_HOST, POSTGRES_PASSWORD, GEMINI_API_KEY, EMAIL_CREDENTIALS, OPENAI_API_KEY, OPENAI_VECTOR_STORE_ID

Set these secrets before deploying:
        firebase functions:secrets:set POSTGRES_HOST
        firebase functions:secrets:set POSTGRES_PASSWORD
        firebase functions:secrets:set GEMINI_API_KEY
        firebase functions:secrets:set EMAIL_CREDENTIALS
        firebase functions:secrets:set OPENAI_API_KEY
        firebase functions:secrets:set OPENAI_VECTOR_STORE_ID

[TorbenWetter]

Submitted PR #9370 with a fix that checks Secret Manager for existing secrets before throwing the non-interactive error. Would appreciate any feedback or review on the approach.

[aalej]

Thank you @tylerc for opening this issue, we appreciate the detailed report! Also, thanks @TorbenWetter for submitting a PR!

I am able to reproduce the error on the latest version(14.21.0). I'll raise this to our engineering team so they can take a look. In the meantime, to workaround the issue, try downgrading to v14.20.0.

sharing mcve here

[lukejacksonn]

Spent about 3 hours trying to debug my deploy finding this thread, thank you @tylerc for detailing and creating the issue. I can confirm that the workaround suggested by @aalej (pinning to firebase-tools@14.20.0) does resolve the issue.

[MaitreyaBuddha]

Can confirm repro as well. I guess it was time to pin the tools version in https://github.com/marketplace/actions/deploy-firebase-python-resources