ci: ignore OAuth scopes in endpoint check

Merge #6245

Fixes #6238

PiperOrigin-RevId: 954813339

Author: h-tsuboi918

scripts/compliance_checks.py

@@ -121,9 +121,15 @@ def check_cli_import(content: str, filename: str) -> bool:
 def check_mtls(content: str, filename: str) -> bool:
   if filename in _EXCLUDED_FROM_MTLS:
     return True
-  # Pattern for googleapis: https?://[a-zA-Z0-9.-]+\.googleapis\.com
-  endpoint_pattern = re.compile(r'https?://[a-zA-Z0-9.-]+\.googleapis\.com')
-  if endpoint_pattern.search(content):
+  urls = re.findall(
+      r'https?://[a-zA-Z0-9.-]+\.googleapis\.com[^"\'\s]*', content
+  )
+  non_scope_urls = [
+      url
+      for url in urls
+      if not re.match(r'https?://www\.googleapis\.com/auth(/|$)', url)
+  ]
+  if non_scope_urls:
     return '.mtls.googleapis.com' in content
   return True
 

tests/unittests/scripts/__init__.py

@@ -0,0 +1,13 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

tests/unittests/scripts/test_compliance_checks.py

@@ -0,0 +1,33 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from scripts import compliance_checks
+
+
+def test_check_mtls_ignores_oauth_scope() -> None:
+  content = 'scope = "https://www.googleapis.com/auth/cloud-platform"\n'
+  assert compliance_checks.check_mtls(content, 'test_file.py') is True
+
+
+def test_check_mtls_detects_missing_mtls() -> None:
+  content = 'endpoint = "https://storage.googleapis.com"\n'
+  assert compliance_checks.check_mtls(content, 'test_file.py') is False
+
+
+def test_check_mtls_passes_with_mtls() -> None:
+  content = (
+      'endpoint = "https://storage.googleapis.com"\n'
+      'mtls_endpoint = "https://storage.mtls.googleapis.com"\n'
+  )
+  assert compliance_checks.check_mtls(content, 'test_file.py') is True