From d7fef3fcb84e88681c3a75ff328638c46a935483 Mon Sep 17 00:00:00 2001 From: ohmayr Date: Tue, 7 Jul 2026 21:18:01 +0000 Subject: [PATCH 1/3] ci(google-auth): separate core vs extras lower-bound constraints --- packages/google-auth/noxfile.py | 30 ++++++++++++------- packages/google-auth/setup.py | 15 ++++++---- .../google-auth/testing/constraints-3.11.txt | 4 ++- .../google-auth/testing/constraints-3.12.txt | 4 ++- .../google-auth/testing/constraints-3.13.txt | 3 ++ .../testing/constraints-extras-3.10.txt | 10 +++++++ .../testing/constraints-extras-3.14.txt | 10 +++++++ 7 files changed, 59 insertions(+), 17 deletions(-) create mode 100644 packages/google-auth/testing/constraints-extras-3.10.txt create mode 100644 packages/google-auth/testing/constraints-extras-3.14.txt diff --git a/packages/google-auth/noxfile.py b/packages/google-auth/noxfile.py index 19cc47a02a03..5cca1ec5a9cc 100644 --- a/packages/google-auth/noxfile.py +++ b/packages/google-auth/noxfile.py @@ -159,27 +159,37 @@ def mypy(session): @nox.session(python=ALL_PYTHON) -@nox.parametrize(["install_deprecated_extras"], (True, False)) -def unit(session, install_deprecated_extras): +@nox.parametrize(["install_extras"], (True, False)) +def unit(session, install_extras): # Install all test dependencies, then install this package in-place. min_py, max_py = UNIT_TEST_PYTHON_VERSIONS[0], UNIT_TEST_PYTHON_VERSIONS[-1] - if not install_deprecated_extras and session.python not in (min_py, max_py): + if not install_extras and session.python not in (min_py, max_py): # only run double tests on first and last supported versions session.skip( f"Extended tests only run on boundary Python versions ({min_py}, {max_py}) to reduce CI load." ) - constraints_path = str( + core_constraints = ( CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" ) - extras_str = "testing" - if install_deprecated_extras: - # rsa and oauth2client were both archived and support dropped, - # but we still test old code paths + extras_constraints = ( + CURRENT_DIRECTORY / "testing" / f"constraints-extras-{session.python}.txt" + ) + + install_args = ["-e"] + if install_extras: session.install("oauth2client") - extras_str += ",rsa" - session.install("-e", f".[{extras_str}]", "-c", constraints_path) + install_args.append(".[testing,enterprise_cert,rsa]") + else: + install_args.append(".[testing]") + + if core_constraints.exists(): + install_args.extend(["-c", str(core_constraints)]) + if install_extras and extras_constraints.exists(): + install_args.extend(["-c", str(extras_constraints)]) + + session.install(*install_args) session.run( "pytest", f"--junitxml=unit_{session.python}_sponge_log.xml", diff --git a/packages/google-auth/setup.py b/packages/google-auth/setup.py index 1dfb9ee734ff..8fefb55beb9a 100644 --- a/packages/google-auth/setup.py +++ b/packages/google-auth/setup.py @@ -56,18 +56,23 @@ # Unit test requirements. testing_extra_require = [ + # gRPC extra *grpc_extra_require, + # PyJWT extra + *pyjwt_extra_require, + # Reauth extra + *reauth_extra_require, + # urllib3 extra + *urllib3_extra_require, + # aiohttp extra + *aiohttp_extra_require, + # Test runners & mocks "flask", "freezegun", - *pyjwt_extra_require, "pytest", "pytest-cov", "pytest-localserver", - *reauth_extra_require, "responses", - *urllib3_extra_require, - # Async Dependencies - *aiohttp_extra_require, "aioresponses", "pytest-asyncio", ] diff --git a/packages/google-auth/testing/constraints-3.11.txt b/packages/google-auth/testing/constraints-3.11.txt index 09aeeca1c1bc..7fef73db57b9 100644 --- a/packages/google-auth/testing/constraints-3.11.txt +++ b/packages/google-auth/testing/constraints-3.11.txt @@ -1 +1,3 @@ -urllib3>2.0.0 \ No newline at end of file +# Lower-bound constraints for Python 3.11 core dependencies. +pyasn1-modules==0.2.1 +cryptography==38.0.3 \ No newline at end of file diff --git a/packages/google-auth/testing/constraints-3.12.txt b/packages/google-auth/testing/constraints-3.12.txt index 09aeeca1c1bc..7e54d9dd3f16 100644 --- a/packages/google-auth/testing/constraints-3.12.txt +++ b/packages/google-auth/testing/constraints-3.12.txt @@ -1 +1,3 @@ -urllib3>2.0.0 \ No newline at end of file +# Lower-bound constraints for Python 3.12 core dependencies. +pyasn1-modules==0.2.1 +cryptography==38.0.3 \ No newline at end of file diff --git a/packages/google-auth/testing/constraints-3.13.txt b/packages/google-auth/testing/constraints-3.13.txt index e69de29bb2d1..63cba27bd7cb 100644 --- a/packages/google-auth/testing/constraints-3.13.txt +++ b/packages/google-auth/testing/constraints-3.13.txt @@ -0,0 +1,3 @@ +# Lower-bound constraints for Python 3.13 core dependencies. +pyasn1-modules==0.2.1 +cryptography==38.0.3 diff --git a/packages/google-auth/testing/constraints-extras-3.10.txt b/packages/google-auth/testing/constraints-extras-3.10.txt new file mode 100644 index 000000000000..20476b335226 --- /dev/null +++ b/packages/google-auth/testing/constraints-extras-3.10.txt @@ -0,0 +1,10 @@ +# Lower-bound constraints for Python 3.10 optional extras & test dependencies. +aiohttp==3.8.0 +requests==2.30.0 +pyjwt==2.0 +grpcio==1.59.0 +urllib3==1.26.15 +packaging==20.0 +pyu2f==0.1.5 +rsa==4.0.0 +oauth2client==4.1.3 diff --git a/packages/google-auth/testing/constraints-extras-3.14.txt b/packages/google-auth/testing/constraints-extras-3.14.txt new file mode 100644 index 000000000000..7614da4d320d --- /dev/null +++ b/packages/google-auth/testing/constraints-extras-3.14.txt @@ -0,0 +1,10 @@ +# Lower-bound constraints for Python 3.14 optional extras & test dependencies. +aiohttp==3.9.0 +requests==2.30.0 +pyjwt==2.0 +grpcio==1.75.1 +urllib3==2.0.0 +packaging==20.0 +pyu2f==0.1.5 +rsa==4.0.0 +oauth2client==4.1.3 From 55c9b186a9199ebadf4deb21b9d0809f9ec5c6e7 Mon Sep 17 00:00:00 2001 From: ohmayr Date: Tue, 7 Jul 2026 21:35:10 +0000 Subject: [PATCH 2/3] style(google-auth): restore original header in constraints files --- packages/google-auth/noxfile.py | 28 ++++++++++--------- packages/google-auth/setup.py | 15 ++++------ .../google-auth/testing/constraints-3.10.txt | 7 ----- .../google-auth/testing/constraints-3.11.txt | 8 +++++- .../google-auth/testing/constraints-3.12.txt | 8 +++++- .../google-auth/testing/constraints-3.13.txt | 8 +++++- .../google-auth/testing/constraints-3.14.txt | 1 - .../testing/constraints-extras-3.10.txt | 8 +++++- .../testing/constraints-extras-3.14.txt | 10 +++++-- 9 files changed, 56 insertions(+), 37 deletions(-) diff --git a/packages/google-auth/noxfile.py b/packages/google-auth/noxfile.py index 5cca1ec5a9cc..99e19c0b21ad 100644 --- a/packages/google-auth/noxfile.py +++ b/packages/google-auth/noxfile.py @@ -159,35 +159,37 @@ def mypy(session): @nox.session(python=ALL_PYTHON) -@nox.parametrize(["install_extras"], (True, False)) -def unit(session, install_extras): +@nox.parametrize(["install_deprecated_extras"], (True, False)) +def unit(session, install_deprecated_extras): # Install all test dependencies, then install this package in-place. min_py, max_py = UNIT_TEST_PYTHON_VERSIONS[0], UNIT_TEST_PYTHON_VERSIONS[-1] - if not install_extras and session.python not in (min_py, max_py): + if not install_deprecated_extras and session.python not in (min_py, max_py): # only run double tests on first and last supported versions session.skip( f"Extended tests only run on boundary Python versions ({min_py}, {max_py}) to reduce CI load." ) - core_constraints = ( + constraints_path = ( CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt" ) - extras_constraints = ( + extras_constraints_path = ( CURRENT_DIRECTORY / "testing" / f"constraints-extras-{session.python}.txt" ) - install_args = ["-e"] - if install_extras: + if install_deprecated_extras: + # rsa and oauth2client were both archived and support dropped, + # but we still test old code paths session.install("oauth2client") - install_args.append(".[testing,enterprise_cert,rsa]") + extra_str = ".[testing,enterprise_cert,rsa]" else: - install_args.append(".[testing]") + extra_str = ".[testing]" - if core_constraints.exists(): - install_args.extend(["-c", str(core_constraints)]) - if install_extras and extras_constraints.exists(): - install_args.extend(["-c", str(extras_constraints)]) + install_args = ["-e", extra_str] + if constraints_path.exists(): + install_args.extend(["-c", str(constraints_path)]) + if install_deprecated_extras and extras_constraints_path.exists(): + install_args.extend(["-c", str(extras_constraints_path)]) session.install(*install_args) session.run( diff --git a/packages/google-auth/setup.py b/packages/google-auth/setup.py index 8fefb55beb9a..1dfb9ee734ff 100644 --- a/packages/google-auth/setup.py +++ b/packages/google-auth/setup.py @@ -56,23 +56,18 @@ # Unit test requirements. testing_extra_require = [ - # gRPC extra *grpc_extra_require, - # PyJWT extra - *pyjwt_extra_require, - # Reauth extra - *reauth_extra_require, - # urllib3 extra - *urllib3_extra_require, - # aiohttp extra - *aiohttp_extra_require, - # Test runners & mocks "flask", "freezegun", + *pyjwt_extra_require, "pytest", "pytest-cov", "pytest-localserver", + *reauth_extra_require, "responses", + *urllib3_extra_require, + # Async Dependencies + *aiohttp_extra_require, "aioresponses", "pytest-asyncio", ] diff --git a/packages/google-auth/testing/constraints-3.10.txt b/packages/google-auth/testing/constraints-3.10.txt index e4feaad658ca..2d1d471bc970 100644 --- a/packages/google-auth/testing/constraints-3.10.txt +++ b/packages/google-auth/testing/constraints-3.10.txt @@ -8,10 +8,3 @@ pyasn1-modules==0.2.1 setuptools==40.3.0 cryptography==38.0.3 -aiohttp==3.8.0 -requests==2.30.0 -pyjwt==2.0 -grpcio==1.59.0 -urllib3==1.26.15 -packaging==20.0 -rsa==4.0.0 diff --git a/packages/google-auth/testing/constraints-3.11.txt b/packages/google-auth/testing/constraints-3.11.txt index 7fef73db57b9..c3e513408330 100644 --- a/packages/google-auth/testing/constraints-3.11.txt +++ b/packages/google-auth/testing/constraints-3.11.txt @@ -1,3 +1,9 @@ -# Lower-bound constraints for Python 3.11 core dependencies. +# This constraints file is used to check that lower bounds +# are correct in setup.py +# List *all* library dependencies and extras in this file. +# Pin the version to the lower bound. +# +# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", +# Then this file should have foo==1.14.0 pyasn1-modules==0.2.1 cryptography==38.0.3 \ No newline at end of file diff --git a/packages/google-auth/testing/constraints-3.12.txt b/packages/google-auth/testing/constraints-3.12.txt index 7e54d9dd3f16..c3e513408330 100644 --- a/packages/google-auth/testing/constraints-3.12.txt +++ b/packages/google-auth/testing/constraints-3.12.txt @@ -1,3 +1,9 @@ -# Lower-bound constraints for Python 3.12 core dependencies. +# This constraints file is used to check that lower bounds +# are correct in setup.py +# List *all* library dependencies and extras in this file. +# Pin the version to the lower bound. +# +# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", +# Then this file should have foo==1.14.0 pyasn1-modules==0.2.1 cryptography==38.0.3 \ No newline at end of file diff --git a/packages/google-auth/testing/constraints-3.13.txt b/packages/google-auth/testing/constraints-3.13.txt index 63cba27bd7cb..0eedd607c8be 100644 --- a/packages/google-auth/testing/constraints-3.13.txt +++ b/packages/google-auth/testing/constraints-3.13.txt @@ -1,3 +1,9 @@ -# Lower-bound constraints for Python 3.13 core dependencies. +# This constraints file is used to check that lower bounds +# are correct in setup.py +# List *all* library dependencies and extras in this file. +# Pin the version to the lower bound. +# +# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", +# Then this file should have foo==1.14.0 pyasn1-modules==0.2.1 cryptography==38.0.3 diff --git a/packages/google-auth/testing/constraints-3.14.txt b/packages/google-auth/testing/constraints-3.14.txt index 64212e65e4df..f4a0ef4f1ac8 100644 --- a/packages/google-auth/testing/constraints-3.14.txt +++ b/packages/google-auth/testing/constraints-3.14.txt @@ -7,4 +7,3 @@ # Then this file should have foo==1.14.0 pyasn1-modules==0.2.1 cryptography==41.0.5 -aiohttp==3.9.0 diff --git a/packages/google-auth/testing/constraints-extras-3.10.txt b/packages/google-auth/testing/constraints-extras-3.10.txt index 20476b335226..8f93deefbbd4 100644 --- a/packages/google-auth/testing/constraints-extras-3.10.txt +++ b/packages/google-auth/testing/constraints-extras-3.10.txt @@ -1,4 +1,10 @@ -# Lower-bound constraints for Python 3.10 optional extras & test dependencies. +# This constraints file is used to check that lower bounds +# are correct in setup.py +# List *all* library dependencies and extras in this file. +# Pin the version to the lower bound. +# +# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", +# Then this file should have foo==1.14.0 aiohttp==3.8.0 requests==2.30.0 pyjwt==2.0 diff --git a/packages/google-auth/testing/constraints-extras-3.14.txt b/packages/google-auth/testing/constraints-extras-3.14.txt index 7614da4d320d..359c96b88a8b 100644 --- a/packages/google-auth/testing/constraints-extras-3.14.txt +++ b/packages/google-auth/testing/constraints-extras-3.14.txt @@ -1,9 +1,15 @@ -# Lower-bound constraints for Python 3.14 optional extras & test dependencies. +# This constraints file is used to check that lower bounds +# are correct in setup.py +# List *all* library dependencies and extras in this file. +# Pin the version to the lower bound. +# +# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", +# Then this file should have foo==1.14.0 aiohttp==3.9.0 requests==2.30.0 pyjwt==2.0 grpcio==1.75.1 -urllib3==2.0.0 +urllib3==1.26.15 packaging==20.0 pyu2f==0.1.5 rsa==4.0.0 From a77a9953a94a2dbe3b1b34cbd9577583be81a98b Mon Sep 17 00:00:00 2001 From: ohmayr Date: Wed, 8 Jul 2026 00:35:51 +0000 Subject: [PATCH 3/3] address feedback --- .../testing/constraints-extras-3.10.txt | 18 +++++++++--------- .../testing/constraints-extras-3.14.txt | 18 +++++++++--------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/packages/google-auth/testing/constraints-extras-3.10.txt b/packages/google-auth/testing/constraints-extras-3.10.txt index 8f93deefbbd4..a53b96c82a85 100644 --- a/packages/google-auth/testing/constraints-extras-3.10.txt +++ b/packages/google-auth/testing/constraints-extras-3.10.txt @@ -5,12 +5,12 @@ # # e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", # Then this file should have foo==1.14.0 -aiohttp==3.8.0 -requests==2.30.0 -pyjwt==2.0 -grpcio==1.59.0 -urllib3==1.26.15 -packaging==20.0 -pyu2f==0.1.5 -rsa==4.0.0 -oauth2client==4.1.3 +aiohttp==3.8.0 # aiohttp extra +requests==2.30.0 # requests extra +pyjwt==2.0 # pyjwt extra +grpcio==1.59.0 # grpc extra +urllib3==1.26.15 # urllib3 extra +packaging==20.0 # urllib3 extra +pyu2f==0.1.5 # reauth extra +rsa==4.0.0 # rsa extra +oauth2client==4.1.3 # deprecated test dependency diff --git a/packages/google-auth/testing/constraints-extras-3.14.txt b/packages/google-auth/testing/constraints-extras-3.14.txt index 359c96b88a8b..10e09322fe56 100644 --- a/packages/google-auth/testing/constraints-extras-3.14.txt +++ b/packages/google-auth/testing/constraints-extras-3.14.txt @@ -5,12 +5,12 @@ # # e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", # Then this file should have foo==1.14.0 -aiohttp==3.9.0 -requests==2.30.0 -pyjwt==2.0 -grpcio==1.75.1 -urllib3==1.26.15 -packaging==20.0 -pyu2f==0.1.5 -rsa==4.0.0 -oauth2client==4.1.3 +aiohttp==3.9.0 # aiohttp extra +requests==2.30.0 # requests extra +pyjwt==2.0 # pyjwt extra +grpcio==1.75.1 # grpc extra +urllib3==1.26.15 # urllib3 extra +packaging==20.0 # urllib3 extra +pyu2f==0.1.5 # reauth extra +rsa==4.0.0 # rsa extra +oauth2client==4.1.3 # deprecated test dependency