Disable local Google Cloud credentials in cirq-google tests#8083
Conversation
Prevent `cirq_google.engine` tests from connecting to the actual services with local user credentials. Tell gcloud to use empty configuration directory instead of user configuration.
pavoljuhas
requested review from
a team,
hoisinberg,
verult and
wcourtney
as code owners
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8083 +/- ##
==========================================
- Coverage 99.63% 99.63% -0.01%
==========================================
Files 1110 1110
Lines 100242 100438 +196
==========================================
+ Hits 99879 100072 +193
- Misses 363 366 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
pavoljuhas
added
the
ci/no-release
dstrain115
left a comment
dstrain115
left a comment
There was a problem hiding this comment.
Sweet. I hate when I run tests and it complains about cloud credentials.
|
|
||
| @pytest.fixture(scope="session", autouse=True) | ||
| def disable_local_gcloud_credentials(tmp_path_factory): | ||
| # Ensure tests cannot authenticate to production servers with user credentials |
There was a problem hiding this comment.
Might be worth changing this to a triple quote docstring.
Also, I would appreciate a comment as to how this prevents cloud authentication to production. It's not totally obvious why this directory and environment variable fixes it.
| def disable_local_gcloud_credentials(tmp_path_factory): | ||
| # Ensure tests cannot authenticate to production servers with user credentials | ||
| empty_dir = tmp_path_factory.mktemp("empty_gcloud_config-cirq_google", numbered=False) | ||
| with mock.patch.dict(os.environ, {"CLOUDSDK_CONFIG": str(empty_dir)}): |
There was a problem hiding this comment.
Does this break any other tests that would happen to use os.environ for other variables? (not sure if we use os environment anywhere else, but I could see us using it for a flag at some point).
There was a problem hiding this comment.
Nope, patch.dict by default updates the dictionary with its second argument, i.e., everything except CLOUDSDK_CONFIG is left in os.environ as is.
That said, I changed this in df1b7ef to completely replace os.environ with its sanitized content.
Also scrub the `GOOGLE_APPLICATION_CREDENTIALS` environment variable. Ref: https://google-auth.readthedocs.io/en/latest/reference/google.auth.html
3 participants
Prevent
cirq_google.enginetests from connecting to the actualservices with local user credentials. Tell gcloud to use empty
configuration directory instead of user configuration and also
unset
GOOGLE_APPLICATION_CREDENTIALSfrom the environment.Ref: https://google-auth.readthedocs.io/en/latest/reference/google.auth.html
May resolve b/511678310