ci(google-auth): separate core vs extras lower-bound constraints

Author: ohmayr

packages/google-auth/noxfile.py

@@ -159,27 +159,37 @@ def mypy(session):
 
 
 @nox.session(python=ALL_PYTHON)
-@nox.parametrize(["install_deprecated_extras"], (True, False))
-def unit(session, install_deprecated_extras):
+@nox.parametrize(["install_extras"], (True, False))
+def unit(session, install_extras):
     # Install all test dependencies, then install this package in-place.
 
     min_py, max_py = UNIT_TEST_PYTHON_VERSIONS[0], UNIT_TEST_PYTHON_VERSIONS[-1]
-    if not install_deprecated_extras and session.python not in (min_py, max_py):
+    if not install_extras and session.python not in (min_py, max_py):
         # only run double tests on first and last supported versions
         session.skip(
             f"Extended tests only run on boundary Python versions ({min_py}, {max_py}) to reduce CI load."
         )
 
-    constraints_path = str(
+    core_constraints = (
         CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
     )
-    extras_str = "testing"
-    if install_deprecated_extras:
-        # rsa and oauth2client were both archived and support dropped,
-        # but we still  test old code paths
+    extras_constraints = (
+        CURRENT_DIRECTORY / "testing" / f"constraints-extras-{session.python}.txt"
+    )
+
+    install_args = ["-e"]
+    if install_extras:
         session.install("oauth2client")
-        extras_str += ",rsa"
-    session.install("-e", f".[{extras_str}]", "-c", constraints_path)
+        install_args.append(".[testing,enterprise_cert,rsa]")
+    else:
+        install_args.append(".[testing]")
+
+    if core_constraints.exists():
+        install_args.extend(["-c", str(core_constraints)])
+    if install_extras and extras_constraints.exists():
+        install_args.extend(["-c", str(extras_constraints)])
+
+    session.install(*install_args)
     session.run(
         "pytest",
         f"--junitxml=unit_{session.python}_sponge_log.xml",

packages/google-auth/setup.py

@@ -43,10 +43,7 @@
     "packaging >= 20.0",
 ]
 
-rsa_extra_require = [
-    "rsa>=3.1.4,<5; python_version < '3.11'",
-    "rsa>=4.0,<5; python_version >= '3.11'",
-]
+rsa_extra_require = ["rsa>=4.0.0,<5"]
 
 grpc_extra_require = [
     "grpcio >= 1.59.0, < 2.0.0; python_version < '3.14'",
@@ -55,18 +52,23 @@
 
 # Unit test requirements.
 testing_extra_require = [
+    # gRPC extra
     *grpc_extra_require,
+    # PyJWT extra
+    *pyjwt_extra_require,
+    # Reauth extra
+    *reauth_extra_require,
+    # urllib3 extra
+    *urllib3_extra_require,
+    # aiohttp extra
+    *aiohttp_extra_require,
+    # Test runners & mocks
     "flask",
     "freezegun",
-    *pyjwt_extra_require,
     "pytest",
     "pytest-cov",
     "pytest-localserver",
-    *reauth_extra_require,
     "responses",
-    *urllib3_extra_require,
-    # Async Dependencies
-    *aiohttp_extra_require,
     "aioresponses",
     "pytest-asyncio",
 ]

packages/google-auth/testing/constraints-3.10.txt

@@ -1,16 +1,4 @@
-# This constraints file is used to check that lower bounds
-# are correct in setup.py
-# List *all* library dependencies and extras in this file.
-# Pin the version to the lower bound.
-#
-# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
-# Then this file should have foo==1.14.0
+# Lower-bound constraints for Python 3.10 core dependencies.
+# Used during CI unit tests to verify minimum supported core package versions.
 pyasn1-modules==0.2.1
-setuptools==40.3.0
 cryptography==38.0.3
-aiohttp==3.8.0
-requests==2.30.0
-pyjwt==2.0
-grpcio==1.59.0
-urllib3==1.26.15
-packaging==20.0

packages/google-auth/testing/constraints-3.11.txt

@@ -1 +1,3 @@
-urllib3>2.0.0
+# Lower-bound constraints for Python 3.11 core dependencies.
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.12.txt

@@ -1 +1,3 @@
-urllib3>2.0.0
+# Lower-bound constraints for Python 3.12 core dependencies.
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.13.txt

@@ -0,0 +1,3 @@
+# Lower-bound constraints for Python 3.13 core dependencies.
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.14.txt

@@ -1,4 +1,3 @@
 # Lower-bound constraints for Python 3.14 core dependencies.
-# Used during CI unit tests to verify minimum supported package versions.
 pyasn1-modules==0.2.1
 cryptography==41.0.5

packages/google-auth/testing/constraints-extras-3.10.txt

@@ -0,0 +1,10 @@
+# Lower-bound constraints for Python 3.10 optional extras & test dependencies.
+aiohttp==3.8.0
+requests==2.30.0
+pyjwt==2.0
+grpcio==1.59.0
+urllib3==1.26.15
+packaging==20.0
+pyu2f==0.1.5
+rsa==4.0.0
+oauth2client==4.1.3

packages/google-auth/testing/constraints-extras-3.14.txt

@@ -0,0 +1,10 @@
+# Lower-bound constraints for Python 3.14 optional extras & test dependencies.
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+grpcio==1.75.1
+urllib3==2.0.0
+packaging==20.0
+pyu2f==0.1.5
+rsa==4.0.0
+oauth2client==4.1.3