BUG: functions:secrets:prune was not affecting secrets created after apphosting launch

src/functions/secrets.ts

@@ -81,7 +81,7 @@
   }
   try {
     validateKey(transformedKey);
   } catch (err: any) {
     throw new FirebaseError(`Invalid secret key ${transformedKey}`, { children: [err] });
   }
   return transformedKey;
@@ -96,9 +96,9 @@
 export function validateJsonSecret(secretName: string, secretValue: string): void {
   try {
     JSON.parse(secretValue);
   } catch (e: any) {
     throw new FirebaseError(
       `Provided value for ${secretName} is not valid JSON: ${e.message}\n\n` +
         `For complex JSON values, use:\n` +
         `  firebase functions:secrets:set ${secretName} --data-file <file.json>\n` +
         `Or pipe from stdin:\n` +
@@ -155,8 +155,8 @@
       }
     }
     return secret;
   } catch (err: any) {
     if (err.status !== 404) {
       throw err;
     }
   }
@@ -189,7 +189,7 @@
 /**
  * Checks whether a secret is in use by the given endpoint.
  */
 export function inUse(projectInfo: ProjectInfo, secret: Secret, endpoint: backend.Endpoint) {
   const { projectId, projectNumber } = projectInfo;
   for (const sev of of([endpoint])) {
     if (
@@ -234,11 +234,14 @@
   endpoints: backend.Endpoint[],
 ): Promise<SecretForPruning[]> {
   const { projectId, projectNumber } = projectInfo;
   const pruneKey = (name: string, version: string) => `${name}@${version}`;
   const prunedSecrets: Set<string> = new Set();
 
   // Collect all Firebase managed secret versions
-  const haveSecrets = await listSecrets(projectId, `labels.${FIREBASE_MANAGED}=true`);
+  const haveSecrets = await listSecrets(
+    projectId,
+    `labels.${FIREBASE_MANAGED}=true OR labels.${FIREBASE_MANAGED}=functions`,
+  );
   for (const secret of haveSecrets) {
     const versions = await listSecretVersions(projectId, secret.name, `NOT state: DESTROYED`);
     for (const version of versions) {
@@ -302,7 +305,7 @@
   const { projectId, projectNumber } = projectInfo;
 
   logger.debug("Pruning secrets to find unused secret versions...");
   const unusedSecrets: SecretForPruning[] = await module.exports.pruneSecrets(
     { projectId, projectNumber },
     endpoints,
   );