Zip deploy aryanf

package.json

@@ -104,8 +104,7 @@
     ]
   },
   "dependencies": {
-    "@apphosting/build": "^0.1.6",
-    "@apphosting/common": "^0.0.8",
+    "@apphosting/build": "^0.1.7",
     "@electric-sql/pglite": "^0.3.3",
     "@electric-sql/pglite-tools": "^0.2.8",
     "@google-cloud/cloud-sql-connector": "^1.3.3",
@@ -167,6 +166,7 @@
     "stream-chain": "^2.2.4",
     "stream-json": "^1.7.3",
     "superstatic": "^10.0.0",
+    "tar": "^7.5.11",
     "tcp-port-used": "^1.0.2",
     "tmp": "^0.2.3",
     "triple-beam": "^1.3.0",

src/apphosting/backend.ts

@@ -13,6 +13,7 @@
   iamOrigin,
   secretManagerOrigin,
 } from "../api";
+import { logger } from "../logger";
 import { Backend, BackendOutputOnlyFields, API_VERSION } from "../gcp/apphosting";
 import { addServiceAccountToRoles } from "../gcp/resourceManager";
 import * as iam from "../gcp/iam";
@@ -49,7 +50,7 @@
     // SSL.
     const maybeNodeError = err as { cause: { code: string }; code: string };
     if (
       /HANDSHAKE_FAILURE/.test(maybeNodeError?.cause?.code) ||
       "EPROTO" === maybeNodeError?.code
     ) {
       return false;
@@ -272,6 +273,32 @@
   await githubConnections.linkGitHubRepository(projectId, location, connectionId);
 }
 
+/**
+ * Ensures that the App Hosting service agent has the necessary permissions to
+ * manage resources in the project.
+ */
+export async function ensureAppHostingServiceAgentRoles(
+  projectId: string,
+  projectNumber: string,
+): Promise<void> {
+  const p4saEmail = apphosting.serviceAgentEmail(projectNumber);
+  try {
+    await addServiceAccountToRoles(
+      projectId,
+      p4saEmail,
+      ["roles/storage.objectViewer"],
+      /* skipAccountLookup= */ true,
+    );
+  } catch (err: unknown) {
+    logger.debug(`Failed to grant storage.objectViewer to ${p4saEmail}: ${err}`);
+    // We don't want to fail the entire prepare step if this fails, as it might
+    // be due to insufficient permissions to grant roles.
+    logWarning(
+      `Unable to verify App Hosting service agent permissions for ${p4saEmail}. If you encounter a PERMISSION_DENIED error during rollout, please ensure the service agent has the "Storage Object Viewer" role.`,
+    );
+  }
+}
+
 /**
  * Ensures the service account is present the user has permissions to use it by
  * checking the `iam.serviceAccounts.actAs` permission. If the permissions
@@ -315,7 +342,7 @@
  * Prompts the user for a backend id and verifies that it doesn't match a pre-existing backend.
  */
 export async function promptNewBackendId(projectId: string, location: string): Promise<string> {
   while (true) {
     const backendId = await input({
       default: "my-web-app",
       message: "Provide a name for your backend [1-30 characters]",
@@ -624,7 +651,7 @@
     message: locationDisambugationPrompt,
     choices: [...backendsByLocation.keys()],
   });
   return backendsByLocation.get(location)!;
 }
 
 /**

src/apphosting/config.spec.ts

@@ -473,6 +473,27 @@
     });
   });
 
+  describe("splitEnvVars", () => {
+    it("should stringify numeric values", () => {
+      const env: AppHostingYamlConfig["env"] = {
+        STR: { value: "string" },
+        NUM: { value: 12345 as any },
+        BUILD_AND_RUNTIME_NUM: { value: 67890 as any, availability: ["BUILD", "RUNTIME"] },
+      };
+
+      const { build, runtime } = config.splitEnvVars(env);
+
+      expect(build["BUILD_AND_RUNTIME_NUM"].value).to.equal("67890");
+      expect(runtime).to.deep.include({ variable: "STR", value: "string" });
+      expect(runtime).to.deep.include({ variable: "NUM", value: "12345" });
+      expect(runtime).to.deep.include({
+        variable: "BUILD_AND_RUNTIME_NUM",
+        value: "67890",
+        availability: ["BUILD", "RUNTIME"],
+      });
+    });
+  });
+
   describe("getAppHostingConfiguration", () => {
     let loadAppHostingYamlStub: sinon.SinonStub;
     let listAppHostingFilesInPathStub: sinon.SinonStub;