Add Direct VPC Egress support for 2nd gen Cloud Functions

[Rohit1024]

Description

• Adds direct VPC egress support for 2nd gen Cloud Functions, allowing functions to route outbound network traffic through a VPC network or subnetwork without running a Serverless VPC Access connector.
• Direct VPC egress removes connector maintenance overhead, supports network tags for firewall rules, and handles higher network throughput.

New action inputs

The following optional inputs are added to action.yml:

Input	Type	Default	Description
network	string	None	VPC network name or fully-qualified resource path, such as projects/PROJECT_ID/global/networks/NETWORK_NAME. Specify network, subnet, or both.
subnet	string	None	VPC subnetwork name or fully-qualified resource path, such as projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME. Maps to subnetwork in the Cloud Functions v2 API.
network_tags	string	None	Comma-separated list of Compute Engine network tags to apply to egress traffic, such as internal-egress,db-client.
direct_vpc_egress	string	PRIVATE_RANGES_ONLY when direct VPC is set	Controls outbound traffic routing. Allowed values: PRIVATE_RANGES_ONLY, private-ranges-only, ALL_TRAFFIC, or all-traffic.

---

Key changes and implementation details

1. API types and client (src/client.ts):

   • Added the DirectVpcEgress enum with VPC_EGRESS_PRIVATE_RANGES_ONLY and VPC_EGRESS_ALL_TRAFFIC.
   • Added the DirectVpcNetworkInterface type with network, subnetwork, and tags.
   • Added directVpcNetworkInterface and directVpcEgress to CloudFunction.serviceConfig.
   • Updated computeUpdateMask to include serviceConfig.directVpcNetworkInterface and serviceConfig.directVpcEgress when set on the function object.

2. Validation and parsing (src/util.ts, src/main.ts):

   • Enforced mutual exclusivity between vpc_connector and direct VPC settings.
   • Allowed passing network alone, subnet alone, or both, mapping subnet to subnetwork for the API.
   • Rejected network_tags or direct_vpc_egress when neither network nor subnet is provided.
   • Blocked direct VPC settings when environment is GEN_1.
   • Normalized direct_vpc_egress values from uppercase and kebab-case strings, defaulting to VPC_EGRESS_PRIVATE_RANGES_ONLY when direct VPC is active.

3. Documentation and tests:

   • Added input definitions to action.yml and updated README.md docs.
   • Added direct VPC egress workflow examples to README.md.
   • Added unit tests in tests/util.test.ts for validation rules, tag trimming, and enum parsing.
   • Added tests in tests/client.test.ts for update mask generation.

---

Example usage

- name: 'Deploy Cloud Function with direct VPC egress'
  uses: 'google-github-actions/deploy-cloud-functions@v4'
  with:
    name: 'my-function'
    runtime: 'nodejs22'
    network: 'default'
    subnet: 'default'
    network_tags: 'internal-egress,db-client'
    direct_vpc_egress: 'private-ranges-only'

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.