Integrate FAH Local Builds with Universal Maker

src/apphosting/backend.spec.ts

@@ -123,7 +123,6 @@ describe("apphosting setup functions", () => {
         serviceAccount: "custom-service-account",
         appId: webAppId,
         runtime: { value: "" },
-        automaticBaseImageUpdatesDisabled: undefined,
       };
       expect(createBackendStub).to.be.calledWith(projectId, location, backendInput, backendId);
     });
@@ -155,74 +154,11 @@ describe("apphosting setup functions", () => {
           serviceAccount: "custom-service-account",
           appId: webAppId,
           runtime: { value: runtime ?? "" },
-          automaticBaseImageUpdatesDisabled: undefined,
         };
         expect(createBackendStub).to.be.calledWith(projectId, location, backendInput, backendId);
       });
     }
 
-    it("should create a new backend with automatic base image updates disabled", async () => {
-      createBackendStub.resolves(op);
-      pollOperationStub.resolves(completeBackend);
-
-      await createBackend(
-        projectId,
-        location,
-        backendId,
-        "custom-service-account",
-        cloudBuildConnRepo,
-        webAppId,
-        "/",
-        undefined,
-        true, // automaticBaseImageUpdatesDisabled
-      );
-
-      const backendInput: Omit<apphosting.Backend, apphosting.BackendOutputOnlyFields> = {
-        servingLocality: "GLOBAL_ACCESS",
-        codebase: {
-          repository: cloudBuildConnRepo.name,
-          rootDirectory: "/",
-        },
-        labels: deploymentTool.labels(),
-        serviceAccount: "custom-service-account",
-        appId: webAppId,
-        runtime: { value: "" },
-        automaticBaseImageUpdatesDisabled: true,
-      };
-      expect(createBackendStub).to.be.calledWith(projectId, location, backendInput, backendId);
-    });
-
-    it("should create a new backend with automatic base image updates enabled", async () => {
-      createBackendStub.resolves(op);
-      pollOperationStub.resolves(completeBackend);
-
-      await createBackend(
-        projectId,
-        location,
-        backendId,
-        "custom-service-account",
-        cloudBuildConnRepo,
-        webAppId,
-        "/",
-        undefined,
-        false, // automaticBaseImageUpdatesDisabled
-      );
-
-      const backendInput: Omit<apphosting.Backend, apphosting.BackendOutputOnlyFields> = {
-        servingLocality: "GLOBAL_ACCESS",
-        codebase: {
-          repository: cloudBuildConnRepo.name,
-          rootDirectory: "/",
-        },
-        labels: deploymentTool.labels(),
-        serviceAccount: "custom-service-account",
-        appId: webAppId,
-        runtime: { value: "" },
-        automaticBaseImageUpdatesDisabled: false,
-      };
-      expect(createBackendStub).to.be.calledWith(projectId, location, backendInput, backendId);
-    });
-
     it("should set default rollout policy to 100% all at once", async () => {
       const completeTraffic: apphosting.Traffic = {
         name: `projects/${projectId}/locations/${location}/backends/${backendId}/traffic`,

src/apphosting/backend.ts

@@ -29,7 +29,7 @@ import fetch from "node-fetch";
 import { orchestrateRollout } from "./rollout";
 import * as fuzzy from "fuzzy";
 import { isEnabled } from "../experiments";
-import { DEFAULT_RUNTIME, promptRuntime, promptAutomaticBaseImageUpdates } from "./prompts";
+import { DEFAULT_RUNTIME, promptRuntime } from "./prompts";
 
 const DEFAULT_COMPUTE_SERVICE_ACCOUNT_NAME = "firebase-app-hosting-compute";
 
@@ -82,7 +82,6 @@ export async function doSetup(
   primaryRegion?: string,
   rootDir?: string,
   runtime?: string,
-  automaticBaseImageUpdatesDisabled?: boolean,
 ): Promise<void> {
   await ensureRequiredApisEnabled(projectId);
 
@@ -137,12 +136,6 @@ export async function doSetup(
     }
   }
 
-  if (automaticBaseImageUpdatesDisabled === undefined && isEnabled("abiu")) {
-    if (!nonInteractive) {
-      automaticBaseImageUpdatesDisabled = !(await promptAutomaticBaseImageUpdates());
-    }
-  }
-
   const webApp = await webApps.getOrCreateWebApp(
     projectId,
     webAppName ? webAppName : null,
@@ -162,7 +155,6 @@ export async function doSetup(
     webApp?.id,
     rootDir,
     runtime,
-    automaticBaseImageUpdatesDisabled,
   );
   createBackendSpinner.succeed(`Successfully created backend!\n\t${backend.name}\n`);
 
@@ -373,7 +365,6 @@ export async function createBackend(
   webAppId: string | undefined,
   rootDir = "/",
   runtime?: string,
-  automaticBaseImageUpdatesDisabled?: boolean,
 ): Promise<Backend> {
   const defaultServiceAccount = defaultComputeServiceAccountEmail(projectId);
   const backendReqBody: Omit<Backend, BackendOutputOnlyFields> = {
@@ -392,7 +383,6 @@ export async function createBackend(
   // this is to be extra careful that we do not set the ABIU fields if the experiment is disabled
   if (isEnabled("abiu")) {
     backendReqBody.runtime = { value: runtime ?? "" };
-    backendReqBody.automaticBaseImageUpdatesDisabled = automaticBaseImageUpdatesDisabled;
   }
 
   async function createBackendAndPoll(): Promise<apphosting.Backend> {

src/apphosting/localbuilds.spec.ts

@@ -1,7 +1,11 @@
 import * as sinon from "sinon";
 import { expect } from "chai";
 import * as localBuildModule from "@apphosting/build";
-import { localBuild } from "./localbuilds";
+import { localBuild, runUniversalMaker } from "./localbuilds";
+import * as secrets from "./secrets";
+import { EnvMap } from "./yaml";
+import * as childProcess from "child_process";
+import * as fs from "fs";
 
 describe("localBuild", () => {
   afterEach(() => {
@@ -11,6 +15,7 @@ describe("localBuild", () => {
   it("returns the expected output", async () => {
     const bundleConfig = {
       version: "v1" as const,
+
       runConfig: {
         runCommand: "npm run build:prod",
       },
@@ -38,10 +43,231 @@ describe("localBuild", () => {
     const localApphostingBuildStub: sinon.SinonStub = sinon
       .stub(localBuildModule, "localBuild")
       .resolves(bundleConfig);
-    const { outputFiles, annotations, buildConfig } = await localBuild("./", "nextjs");
+    const { outputFiles, annotations, buildConfig } = await localBuild(
+      "test-project",
+      "./",
+      "nextjs",
+    );
     expect(annotations).to.deep.equal(expectedAnnotations);
     expect(buildConfig).to.deep.equal(expectedBuildConfig);
     expect(outputFiles).to.deep.equal(expectedOutputFiles);
     sinon.assert.calledWith(localApphostingBuildStub, "./", "nextjs");
   });
+
+  it("resolves BUILD-available secrets passed in the environment map and ignores RUNTIME-only ones", async () => {
+    const bundleConfig = {
+      version: "v1" as const,
+      runConfig: { runCommand: "npm run build:prod" },
+      metadata: {
+        adapterPackageName: "@apphosting/angular-adapter",
+        adapterVersion: "14.1",
+        framework: "nextjs",
+      },
+      outputFiles: { serverApp: { include: ["./next/standalone"] } },
+    };
+    sinon.stub(localBuildModule, "localBuild").callsFake(async () => {
+      expect(process.env.MY_BUILD_SECRET).to.equal("secret-value");
+      expect(process.env.MY_RUNTIME_SECRET).to.be.undefined;
+      expect(process.env.MY_PLAIN_VAR).to.equal("plain-value");
+      return bundleConfig;
+    });
+    const loadSecretStub = sinon.stub(secrets, "loadSecret").resolves("secret-value");
+
+    const envMap: EnvMap = {
+      MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      MY_RUNTIME_SECRET: { secret: "runtime-only-id", availability: ["RUNTIME"] },
+      MY_PLAIN_VAR: { value: "plain-value" },
+    };
+
+    await localBuild("test-project", "./", "nextjs", envMap, {
+      nonInteractive: true,
+      allowLocalBuildSecrets: true,
+    });
+
+    expect(loadSecretStub).to.have.been.calledWith("test-project", "my-secret-id");
+    // Confirm RUNTIME-only secret was ignored
+    expect(loadSecretStub).to.have.been.calledOnce;
+    // Confirm injected envs were cleaned up from the global scope after the build finishes
+    expect(process.env.MY_BUILD_SECRET).to.be.undefined;
+    expect(process.env.MY_RUNTIME_SECRET).to.be.undefined;
+  });
+
+  it("handles environment variables that do not contain secrets", async () => {
+    const bundleConfig = {
+      version: "v1" as const,
+      runConfig: { runCommand: "npm run build:prod" },
+      metadata: {
+        adapterPackageName: "@apphosting/angular-adapter",
+        adapterVersion: "14.1",
+        framework: "nextjs",
+      },
+      outputFiles: { serverApp: { include: ["./next/standalone"] } },
+    };
+    sinon.stub(localBuildModule, "localBuild").callsFake(async () => {
+      expect(process.env.MY_PLAIN_VAR).to.equal("plain-value");
+      expect(process.env.ANOTHER_VAR).to.equal("another-value");
+      return bundleConfig;
+    });
+    const loadSecretStub = sinon.stub(secrets, "loadSecret").resolves("secret-value");
+
+    const envMap: EnvMap = {
+      MY_PLAIN_VAR: { value: "plain-value" },
+      ANOTHER_VAR: { value: "another-value" },
+    };
+
+    await localBuild("test-project", "./", "nextjs", envMap);
+
+    expect(loadSecretStub).to.not.have.been.called;
+    // We expect the original process.env to not have these injected globally after run completes,
+    // as localBuild cleans up.
+    expect(process.env.MY_PLAIN_VAR).to.be.undefined;
+    expect(process.env.ANOTHER_VAR).to.be.undefined;
+  });
+
+  describe("localBuild secret confirmations", () => {
+    let confirmStub: sinon.SinonStub;
+
+    beforeEach(() => {
+      confirmStub = sinon.stub(require("../prompt"), "confirm");
+    });
+
+    it("throws an error in non-interactive mode if build-available secrets are used without the bypass flag", async () => {
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await expect(
+        localBuild("test-project", "./", "nextjs", envMap, { nonInteractive: true }),
+      ).to.be.rejectedWith(
+        "Using build-available secrets during a local build in non-interactive mode requires the --allow-local-build-secrets flag.",
+      );
+    });
+
+    it("allows build-available secrets in non-interactive mode if bypass flag is provided", async () => {
+      const bundleConfig = {
+        version: "v1" as const,
+        runConfig: { runCommand: "npm run build:prod" },
+        metadata: {
+          adapterPackageName: "@apphosting/angular-adapter",
+          adapterVersion: "14.1",
+          framework: "nextjs",
+        },
+        outputFiles: { serverApp: { include: ["./next/standalone"] } },
+      };
+      sinon.stub(localBuildModule, "localBuild").resolves(bundleConfig);
+      sinon.stub(secrets, "loadSecret").resolves("secret-value");
+
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await localBuild("test-project", "./", "nextjs", envMap, {
+        nonInteractive: true,
+        allowLocalBuildSecrets: true,
+      });
+
+      expect(confirmStub).to.not.have.been.called;
+    });
+
+    it("cancels the build if the user declines the secrets confirmation prompt", async () => {
+      confirmStub.resolves(false);
+
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await expect(
+        localBuild("test-project", "./", "nextjs", envMap, { nonInteractive: false }),
+      ).to.be.rejectedWith("Cancelled local build due to BUILD-available secrets.");
+      expect(confirmStub).to.have.been.calledOnce;
+    });
+
+    it("proceeds with the build if the user accepts the secrets confirmation prompt", async () => {
+      confirmStub.resolves(true);
+      const bundleConfig = {
+        version: "v1" as const,
+        runConfig: { runCommand: "npm run build:prod" },
+        metadata: {
+          adapterPackageName: "@apphosting/angular-adapter",
+          adapterVersion: "14.1",
+          framework: "nextjs",
+        },
+        outputFiles: { serverApp: { include: ["./next/standalone"] } },
+      };
+      sinon.stub(localBuildModule, "localBuild").resolves(bundleConfig);
+      sinon.stub(secrets, "loadSecret").resolves("secret-value");
+
+      const envMap: EnvMap = {
+        MY_BUILD_SECRET: { secret: "my-secret-id", availability: ["BUILD"] },
+      };
+
+      await localBuild("test-project", "./", "nextjs", envMap, { nonInteractive: false });
+      expect(confirmStub).to.have.been.calledOnce;
+    });
+  });
+
+  describe("runUniversalMaker", () => {
+    it("should successfully execute Universal Maker and parse output", () => {
+      process.env.UNIVERSAL_MAKER_BINARY = "/path/to/universal_maker";
+      const spawnStub = sinon
+        .stub(childProcess, "spawnSync")
+        .returns({} as unknown as childProcess.SpawnSyncReturns<string>);
+      sinon.stub(fs, "existsSync").returns(true);
+      const readFileSyncStub = sinon.stub(fs, "readFileSync").returns(
+        JSON.stringify({
+          command: "npm",
+          args: ["run", "start"],
+          language: "nodejs",
+          runtime: "nodejs22",
+          envVars: { PORT: 3000 },
+        }),
+      );
+
+      const output = runUniversalMaker("./", "nextjs");
+
+      expect(output).to.deep.equal({
+        metadata: {
+          language: "nodejs",
+          runtime: "nodejs22",
+          framework: "nextjs",
+        },
+        runConfig: {
+          runCommand: "npm run start",
+          environmentVariables: [{ variable: "PORT", value: "3000", availability: ["RUNTIME"] }],
+        },
+        outputFiles: {
+          serverApp: {
+            include: [".apphosting"],
+          },
+        },
+      });
+
+      sinon.assert.calledOnce(spawnStub);
+      sinon.assert.calledOnce(readFileSyncStub);
+      delete process.env.UNIVERSAL_MAKER_BINARY;
+    });
+
+    it("should raise clear FirebaseError when UNIVERSAL_MAKER_BINARY is undefined", () => {
+      delete process.env.UNIVERSAL_MAKER_BINARY;
+
+      expect(() => runUniversalMaker("./")).to.throw(
+        "Please specify the path to your Universal Maker binary by establishing the UNIVERSAL_MAKER_BINARY environment variable.",
+      );
+    });
+
+    it("should raise clear FirebaseError on permission errors within child execution", () => {
+      process.env.UNIVERSAL_MAKER_BINARY = "/path/to/universal_maker";
+      sinon.stub(childProcess, "spawnSync").callsFake(() => {
+        const err = new Error("EACCES exception") as NodeJS.ErrnoException;
+        err.code = "EACCES";
+
+        throw err;
+      });
+
+      expect(() => runUniversalMaker("./")).to.throw(
+        "Failed to execute the Universal Maker binary due to permission constraints. Please assure you have set chmod +x on your file.",
+      );
+      delete process.env.UNIVERSAL_MAKER_BINARY;
+    });
+  });
 });