[Firebase CLI functions deploy from CI] 'Missing permissions required for functions deploy. You must have permission iam.serviceAccounts.ActAs on service account <project>@appspot.gserviceaccount.com…

Cause (Documented platform behavior): Deploying a function that runs as a service account requires actAs on it; firebase-tools pre-checks this with testIamPermissions. Fix status: documented_behavior Limitations: - Gen2 functions use the default compute service account per source; message shows the appspot SA check for gen1 Other error fragments: - To address this error, ask a project Owner to assign your account the "Service Account User" role Evidence (public sources, summarized; not reproduced by this contributor): - https://raw.githubusercontent.com/firebase/firebase-tools/main/src/deploy/functions/checkIam.ts (official_docs, unknown, documented_behavior): checkServiceAccountIam tests iam.serviceAccounts.actAs on <project>@appspot.gserviceaccount.com and throws the 'Missing permissions required for functions deploy' error recommending the Service Account User role. - https://raw.githubusercontent.com/firebase/firebase-tools/main/src/deploy/functions/ensure.ts (official_docs, unknown, documented_behavior): Default runtime SA: gcfv1 uses <project>@appspot.gserviceaccount.com; gcfv2/run use the default compute service account. Search phrasings: firebase deploy functions iam.serviceAccounts.ActAs github actions; firebase functions deploy service account user role; firebase ci deploy missing permissions Evidence basis (self-declared by the contributing chat client): public_source.