Skip to content

Support env vars for local/zip deploys#10163

Closed
falahat wants to merge 55 commits intomainfrom
zip_deploy_env_vars
Closed

Support env vars for local/zip deploys#10163
falahat wants to merge 55 commits intomainfrom
zip_deploy_env_vars

Conversation

@falahat
Copy link
Copy Markdown
Contributor

@falahat falahat commented Mar 23, 2026

Description

Scenarios Tested

Sample Commands

annajowang and others added 30 commits November 22, 2025 01:29
1. Fix for injecting auto-init variables into the build

2. Fixes how we handle dependencies, nodejs paths, modulepaths, etc. This needs closer attention/fixes.

3. Adds env var handling (not secrets) and determines which env vars to pass down to the build
… variants) and include them in the final artifact
…ctually a local build (instead of assuming true.)
…ore strictly. We also remove some hardcoded values and we generalize the code so that it does not affect source deploys.

The goal is to prepare this PR so that we can safely submit it to main (behind the experiment flag.)
…ive. Only run it if it's a local build and the local build experiment flag is enabled.
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the App Hosting deployment workflow by introducing robust support for environment variables during local and zip deployments. It enables the definition and automatic injection of environment variables, including Firebase web app configuration, into the build environment, ensuring consistent behavior across development and deployment stages. The changes also include necessary permission checks for the App Hosting service agent and refined handling of build artifacts.

Highlights

  • Environment Variable Handling: Introduced a new splitEnvVars utility to categorize environment variables from apphosting.yaml into build-time and runtime-time sets, ensuring numeric values are stringified for consistency.
  • Local Build Environment Injection: The local build process (localBuild) now accepts and injects build-time environment variables, including dynamically generated Firebase web app configuration, into the process.env during the build, then restores the original environment. NODE_PATH is also correctly updated.
  • Service Agent Permissions: Added a step to ensure the App Hosting service agent has the roles/storage.objectViewer role, which is crucial for local builds, with appropriate logging and warnings for permission issues.
  • Deployment Context Enhancement: The LocalBuild interface and deployment context (Context) were updated to properly store and pass both build-time and runtime-time environment variables throughout the deployment pipeline.
  • Build Configuration Integration: The release process now correctly merges discovered build-time environment variables with those explicitly defined in the build configuration for a comprehensive environment setup.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds support for environment variables for local and zip-based deployments in App Hosting. The changes include parsing environment variables from apphosting.yaml, splitting them into build-time and runtime variables, and injecting them into the local build process. New tests are added to cover this functionality. My review includes a few suggestions: fixing a potential bug in how environment variables are merged, adhering to the style guide for error handling, and cleaning up some code duplication in both source and test files.

Comment thread src/deploy/apphosting/release.ts Outdated
Comment thread src/deploy/apphosting/prepare.spec.ts Outdated
Comment thread src/deploy/apphosting/prepare.ts
Comment thread src/deploy/apphosting/prepare.ts Outdated
Comment thread src/deploy/apphosting/prepare.ts Outdated
Comment thread src/deploy/apphosting/release.ts Outdated
Comment thread src/deploy/apphosting/prepare.ts Outdated
@falahat
Copy link
Copy Markdown
Contributor Author

falahat commented Mar 25, 2026

After my recent changes, the env vars stopped working. I suspect it's because of this:

I removed the "env" field from LocalBuild, because i assumed it was redundant. After all, we already have LocalBuild.BuildConfig.Env. Therefore, I just put the env vars into this field.

However, I wonder if BuildConfig.Env is only for build-level configs.

@falahat
Copy link
Copy Markdown
Contributor Author

falahat commented Mar 25, 2026

/gemini review

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request significantly enhances App Hosting local builds and service agent role management. Key changes include the introduction of ensureAppHostingServiceAgentRoles for granting necessary permissions and the implementation of splitEnvVars to categorize environment variables for build and runtime. The localBuild process now injects these environment variables into process.env and handles NODE_PATH. Additionally, the prepare step dynamically fetches and injects Firebase web app configuration into the build environment when an appId is present. Review feedback highlights potential issues with toProcessEnv incorrectly converting numeric 0 or boolean false to empty strings, the local build being hardcoded for "nextjs", the need for more robust error logging for unknown types, type-safety improvements for numeric values in tests, and an unresolved uncertainty regarding buildInput.config behavior.


function toProcessEnv(env: EnvMap): NodeJS.ProcessEnv {
return Object.fromEntries(
Object.entries(env).map(([key, value]) => [key, value.value || ""]),
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The expression value.value || "" could unintentionally convert numeric 0 or boolean false values to an empty string. It's safer to explicitly convert value.value to a string using String(value.value) to ensure all values are correctly represented as strings in process.env.

Suggested change
Object.entries(env).map(([key, value]) => [key, value.value || ""]),
Object.entries(env).map(([key, value]) => [key, String(value.value || "")]),

}
context.backendLocalBuilds[cfg.backendId] = {
// TODO(9114): This only works for nextjs.
buildDir: outputFiles[0],
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The TODO comment indicates that the local build is currently hardcoded for "nextjs". This is a significant functional limitation for a general App Hosting feature. It should be addressed to support other frameworks or at least clearly documented as a known limitation.

Comment thread src/apphosting/backend.ts Outdated
["roles/storage.objectViewer"],
/* skipAccountLookup= */ true,
);
} catch (err: unknown) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The err variable is of type unknown. It's safer to explicitly convert it to a string using String(err) or use a utility like getErrMsg from ../error to ensure proper logging, especially if err might not always be an Error instance.

    logger.debug(`Failed to grant storage.objectViewer to ${p4saEmail}: ${String(err)}`);

Comment on lines +480 to +481
NUM: { value: 12345 as any },
BUILD_AND_RUNTIME_NUM: { value: 67890 as any, availability: ["BUILD", "RUNTIME"] },
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using as any here for numeric values, while functional due to explicit string conversion in splitEnvVars, could be made more type-safe. Consider defining the EnvMap type to explicitly allow number for value if that's the intended input, or provide string literals if the input is always expected to be stringified before use.

Suggested change
NUM: { value: 12345 as any },
BUILD_AND_RUNTIME_NUM: { value: 67890 as any, availability: ["BUILD", "RUNTIME"] },
NUM: { value: "12345" },
BUILD_AND_RUNTIME_NUM: { value: "67890", availability: ["BUILD", "RUNTIME"] },

location: context.backendLocations[backendId],
buildInput: {
config: context.backendLocalBuilds[backendId]?.buildConfig,
// TODO: Confirm this config behavior
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The TODO comment "Confirm this config behavior" indicates an unresolved uncertainty about the buildInput.config behavior. This should be clarified and confirmed to ensure the deployment process behaves as expected, or a plan for its resolution should be in place.

@falahat falahat closed this Mar 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants