ci(google-auth): separate core vs extras lower-bound constraints

packages/google-auth/noxfile.py

@@ -170,16 +170,28 @@ def unit(session, install_deprecated_extras):
             f"Extended tests only run on boundary Python versions ({min_py}, {max_py}) to reduce CI load."
         )
 
-    constraints_path = str(
+    constraints_path = (
         CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
     )
-    extras_str = "testing"
+    extras_constraints_path = (
+        CURRENT_DIRECTORY / "testing" / f"constraints-extras-{session.python}.txt"
+    )
+
     if install_deprecated_extras:
         # rsa and oauth2client were both archived and support dropped,
         # but we still  test old code paths
         session.install("oauth2client")
-        extras_str += ",rsa"
-    session.install("-e", f".[{extras_str}]", "-c", constraints_path)
+        extra_str = ".[testing,enterprise_cert,rsa]"
+    else:
+        extra_str = ".[testing]"
+
+    install_args = ["-e", extra_str]
+    if constraints_path.exists():
+        install_args.extend(["-c", str(constraints_path)])
+    if install_deprecated_extras and extras_constraints_path.exists():
+        install_args.extend(["-c", str(extras_constraints_path)])
+
+    session.install(*install_args)
     session.run(
         "pytest",
         f"--junitxml=unit_{session.python}_sponge_log.xml",

packages/google-auth/testing/constraints-3.10.txt

@@ -8,10 +8,3 @@
 pyasn1-modules==0.2.1
 setuptools==40.3.0
 cryptography==38.0.3
-aiohttp==3.8.0
-requests==2.30.0
-pyjwt==2.0
-grpcio==1.59.0
-urllib3==1.26.15
-packaging==20.0
-rsa==4.0.0

packages/google-auth/testing/constraints-3.11.txt

@@ -1 +1,9 @@
-urllib3>2.0.0
+# This constraints file is used to check that lower bounds
+# are correct in setup.py
+# List *all* library dependencies and extras in this file.
+# Pin the version to the lower bound.
+#
+# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
+# Then this file should have foo==1.14.0
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.12.txt

@@ -1 +1,9 @@
-urllib3>2.0.0
+# This constraints file is used to check that lower bounds
+# are correct in setup.py
+# List *all* library dependencies and extras in this file.
+# Pin the version to the lower bound.
+#
+# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
+# Then this file should have foo==1.14.0
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.13.txt

@@ -0,0 +1,9 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py
+# List *all* library dependencies and extras in this file.
+# Pin the version to the lower bound.
+#
+# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
+# Then this file should have foo==1.14.0
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.14.txt

@@ -7,4 +7,3 @@
 # Then this file should have foo==1.14.0
 pyasn1-modules==0.2.1
 cryptography==41.0.5
-aiohttp==3.9.0

packages/google-auth/testing/constraints-extras-3.10.txt

@@ -0,0 +1,16 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py
+# List *all* library dependencies and extras in this file.
+# Pin the version to the lower bound.
+#
+# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
+# Then this file should have foo==1.14.0
+aiohttp==3.8.0 # aiohttp extra
+requests==2.30.0 # requests extra
+pyjwt==2.0 # pyjwt extra
+grpcio==1.59.0 # grpc extra
+urllib3==1.26.15 # urllib3 extra
+packaging==20.0 # urllib3 extra
+pyu2f==0.1.5 # reauth extra
+rsa==4.0.0 # rsa extra
+oauth2client==4.1.3 # deprecated test dependency

packages/google-auth/testing/constraints-extras-3.14.txt

@@ -0,0 +1,16 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py
+# List *all* library dependencies and extras in this file.
+# Pin the version to the lower bound.
+#
+# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
+# Then this file should have foo==1.14.0
+aiohttp==3.9.0 # aiohttp extra
+requests==2.30.0 # requests extra
+pyjwt==2.0 # pyjwt extra
+grpcio==1.75.1 # grpc extra
+urllib3==1.26.15 # urllib3 extra
+packaging==20.0 # urllib3 extra
+pyu2f==0.1.5 # reauth extra
+rsa==4.0.0 # rsa extra
+oauth2client==4.1.3 # deprecated test dependency