Firebase CLI doesn't automagically enable the Secret Manager API

[kaibolay]

Environment info

firebase-tools:

$ firebase --version
11.17.0

Platform: Debian Linux

Test case

Deploying a function which uses defineSecret() for parameterized configuration doesn't automatically enable the Secret Manager API, but instead fails with an HTTP Error: 403.

Example Code:

const apiKeyConfig = defineSecret("API_KEY", {
  description: "Jira API key",
});

Steps to reproduce

$ firebase --project adequate-test deploy --only functions

Expected behavior

CLI should ask for parameters (incl. secrets) - automagically enabling all APIs that are required.

Actual behavior

=== Deploying to 'adequate-test'...

i  deploying functions
Running command: npm --prefix "$RESOURCE_DIR" run lint

> lint
> eslint .

✔  functions: Finished running predeploy script.
i  functions: ensuring required API cloudfunctions.googleapis.com is enabled...
i  functions: ensuring required API cloudbuild.googleapis.com is enabled...
i  artifactregistry: ensuring required API artifactregistry.googleapis.com is enabled...
✔  functions: required API cloudbuild.googleapis.com is enabled
✔  artifactregistry: required API artifactregistry.googleapis.com is enabled
✔  functions: required API cloudfunctions.googleapis.com is enabled
i  functions: preparing codebase default for deployment

Error: HTTP Error: 403, Secret Manager API has not been used in project 123 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/secretmanager.googleapis.com/overview?project=123 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

After manually enabling the API, deploying works:

=== Deploying to 'adequate-test'...

i  deploying functions
Running command: npm --prefix "$RESOURCE_DIR" run lint

> lint
> eslint .

✔  functions: Finished running predeploy script.
i  functions: ensuring required API cloudfunctions.googleapis.com is enabled...
i  functions: ensuring required API cloudbuild.googleapis.com is enabled...
i  artifactregistry: ensuring required API artifactregistry.googleapis.com is enabled...
✔  functions: required API cloudbuild.googleapis.com is enabled
✔  artifactregistry: required API artifactregistry.googleapis.com is enabled
✔  functions: required API cloudfunctions.googleapis.com is enabled
i  functions: preparing codebase default for deployment
? This secret will be stored in Cloud Secret Manager (https://cloud.google.com/secret-manager/pricing) as API_KEY. Enter a value for 
API_KEY: [hidden]

[elhe26]

Any updates?