Deployment stopped working due to a permissions error introduced in firebase-tools 13.0.0

[SimonKib]

Please see this issue on firebase-tools: https://github.com/firebase/firebase-tools/issues/6593

Their solution is to give more permissions to service account until they manage to roll out a fix to IAM.

Unfortunately their fix does not resolve the error, but instead of

Error: HTTP Error: 403, Permission 'firebasestorage.defaultBucket.get' denied on resource '//firebasestorage.googleapis.com/projects/myProjectId/defaultBucket' (or it may not exist).

we now get:

Error: HTTP Error: 403, The caller does not have permission

It seems like a solution to downgrade to version 12.9, but I can't figure out how to do that using your action. I believe you hint that it is possible here, https://github.com/w9jds/firebase-action?tab=readme-ov-file#alternate-versions, but I don't understand how.

[luc122c]

See comment: https://github.com/firebase/firebase-tools/issues/6593#issuecomment-1846227494

These permissions would be added to your service account in the Google Cloud / Firebase console. This guide should help. Once the service account has been given the permission, try deployment again.

[SimonKib]

Thanks @luc122c I got the mentioned HTTP Error: 403, Permission 'firebasestorage.defaultBucket.get' denied on resource before. After applying the advised roles I now simply get HTTP Error: 403, The caller does not have permission, so the deployment still fails.

I added the advised permissions to ci-account@[my-project-id].iam.gserviceaccount.com as this is the SA being used as reported when deploying with --debug flag using your Github Action. I can see from another comment (https://github.com/firebase/firebase-tools/issues/6467#issuecomment-1846422710) that another solution is to downgrade to firebase-tools 12.9. I am wondering if this is possible with your solution?

Thanks for you great work with this Action.

[luc122c]

I can see from another comment (firebase/firebase-tools#6467 (comment)) that another solution is to downgrade to firebase-tools 12.9. I am wondering if this is possible with your solution?

Yes, you will need to update you action to target that version specifically:

    - name: Deploy to Firebase
-       uses: w9jds/firebase-action@master
+       uses: w9jds/firebase-action@v12.9.0
        with:
          args: deploy --only hosting
        env:
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}

Availale versions are listed here: https://github.com/w9jds/firebase-action/releases

[SimonKib]

Thanks very much @luc122c This is the solution that works for me 💥

[Psycarlo]

Is someone maintaining this repo?

[w9jds]

Yes, I built and maintain this.