Description

Adresses #6828

Grant the Service Account the roles/serviceusage.serviceUsageConsumer role to grant permission to use enabled Google Cloud services on the quota project.

My guess is that the since we specified in #6819 to use the user project for the quota, the service account makes a request against the user project. Granting the service account the permission to use the quota project should allow it to make requests against the quota project.

Scenarios Tested

Test case used: https://github.com/aalej/issues-6828-attempt-1

Manual - Verify if adding the role lets the pull requests automatically add the hosting preview domain to the Auth domain

1. Manually adding the roles/serviceusage.serviceUsageConsumer to the service account
2. Created a PR Branch 0 changes aalej/issues-6828-attempt-1#1

Via firebase init - Verify if the changes made will automatically add the Service Usage Consumer role by default on setup

1. Run firebase init hosting:github
   • Newly created service account should have the "Service Usage Consumer"(roles/serviceusage.serviceUsageConsumer) role
2. Created a PR Rerun fb init hg aalej/issues-6828-attempt-1#4

Notes

This will not fix issues if the GitHub action service account was created using firebase-tools v13.4.0 onwards and prior to this. Users would need to manually add the roles/serviceusage.serviceUsageConsumer to the service Account