firebase / firebase/firebase-tools

firebase deploy reports success when Cloud Run revision rollout silently fails

Open
#10,294 1 comment 1 reaction 1 assignee Claimed by @IzaakGough View on GitHub
api: functions
Dominant language
TypeScript
Stars
4.5k
Forks
1.3k
Avg merge
1d 12h
Merged PRs (30d)
84

Description

When deploying Cloud Functions (2nd gen), `firebase deploy` reports "Successful update operation" even when the underlying Cloud Run service does not route traffic to the new revision. This happens when the new revision fails its startup health check — Cloud Run silently keeps traffic on the previous revision, but the CLI gives no indication of this.

## Impact

We had 21 consecutive deploys over 2 days that all reported success, while the function continued serving a stale revision from 2 days prior. The only way to detect this was manually inspecting Cloud Run:

```
$ gcloud run services describe telegramwebhook --region=europe-west1 \
--format='value(status.traffic[0].revisionName)'
telegramwebhook-00052-kog # created 2 days ago

$ gcloud run revisions list --service=telegramwebhook --region=europe-west1 --limit=1 \
--format='value(name)'
telegramwebhook-00073-qid # latest, created today — never received traffic
```

All 21 revisions between 00052 and 00073 were created, imported, and immediately Retired — never passing the startup health check.

## Steps to reproduce

1. Deploy a 2nd gen Cloud Function that passes health checks
2. Deploy again with a change that causes the new revision to fail the startup probe (e.g., a misconfigured secret or a transient GCP issue during rollout)
3. Observe: `firebase deploy` reports `✔ Successful update operation`
4. Verify: `gcloud run services describe --format='value(status.traffic[0].revisionName)'` shows the **old** revision is still serving
5. All subsequent deploys continue to report success while traffic stays pinned to the stale revision

## Expected behavior

The CLI should verify that Cloud Run actually routed traffic to the new revision after reporting a successful update. If the rollout failed (new revision Retired, traffic still on old revision), the CLI should warn or error — e.g.:

```
⚠ functions[telegramWebhook(europe-west1)] Deploy succeeded but Cloud Run
did not route traffic to the new revision. The previous revision is still serving.
Fix with: gcloud run services update-traffic telegramwebhook --region=europe-west1 --to-latest
```

## Environment

- firebase-tools: 15.12.0
- Cloud Functions: 2nd gen (Cloud Run-backed)
- Region: europe-west1
- Node.js: 22

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.