fix(cli): correct deploy roles (#3783)

Author: abraham

docs/tutorials/04-deploy.md

@@ -55,7 +55,7 @@ Both workflows sign in to Google Cloud with Workload Identity Federation. GitHub
 The command uses your Firebase CLI login. It needs the Owner role, or permission to create service accounts, workload identity pools and IAM bindings. It is safe to run again. It:
 
 1. Enables the IAM, IAM Credentials, Security Token Service and Cloud Resource Manager APIs.
-1. Creates a `github-deploy` service account with the roles a deploy needs: `Firebase Hosting Admin`, `Firebase Rules Admin`, `Cloud Datastore Index Admin`, `Cloud Datastore Viewer` (the build reads your content), `Firebase Storage Viewer`, `Cloud Functions Admin`, `Cloud Scheduler Admin`, `Service Usage Consumer` and `Service Account User`. It can't write to Firestore or read Auth users and Storage files. Earlier versions granted `Firebase Admin`, `Cloud Run Admin`, `Artifact Registry Writer` and `Service Usage Admin`, and the command takes them away (verify with a deploy of every target).
+1. Creates a `github-deploy` service account with the roles a deploy needs: `Firebase Hosting Admin`, `Firebase Rules Admin`, `Cloud Datastore Index Admin`, `Cloud Datastore Viewer` (the build reads your content), `Firebase Storage Viewer`, `Storage Bucket Viewer`, `Cloud Functions Admin`, `Cloud Scheduler Admin`, `Service Usage Consumer` and `Service Account User`. It can't write to Firestore or read Auth users and Storage files. Earlier versions granted `Firebase Admin`, `Cloud Run Admin`, `Artifact Registry Writer` and `Service Usage Admin`, and the command takes them away (verify with a deploy of every target).
 1. Creates a `github` workload identity pool and provider that only accept tokens from your repository. It reads the repository from the `origin` remote. Pass `--repo owner/name` to choose another one.
 1. Sets the `WIF_PROVIDER` and `DEPLOY_SERVICE_ACCOUNT` repository variables with the [GitHub CLI](https://cli.github.com/). Without it, the command prints the values to add in the repository settings.
 

packages/cli/src/commands/setup-github.test.ts

@@ -254,6 +254,7 @@ describe('setupGitHub', () => {
       'roles/datastore.indexAdmin',
       'roles/datastore.viewer',
       'roles/firebasestorage.viewer',
+      'roles/storage.bucketViewer',
       'roles/cloudfunctions.admin',
       'roles/cloudscheduler.admin',
       'roles/serviceusage.serviceUsageConsumer',

packages/cli/src/commands/setup-github.ts

@@ -31,8 +31,10 @@ export const DEPLOY_ROLES = [
   'roles/datastore.indexAdmin',
   // The build reads the site's content.
   'roles/datastore.viewer',
-  // The Storage rules deploy looks up the default bucket.
+  // The Storage rules deploy looks up the default bucket, which also checks storage.buckets.get and
+  // list, despite its docs (firebase/firebase-tools#6593).
   'roles/firebasestorage.viewer',
+  'roles/storage.bucketViewer',
   // Functions, with their Eventarc triggers and Cloud Run services.
   'roles/cloudfunctions.admin',
   // The job that runs scheduleNotifications.